Skip to main content
Completion requirements

Definitions and Descriptions.

Browse the glossary using this index

Special | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | ALL

Page: (Previous)   1  2  3  4  5  6  7  8  9  10  11  (Next)


Network Forensics

Network forensics is a branch of digital forensics that focuses on capturing, recording, and analyzing network traffic and data to investigate security incidents, policy violations, or legal issues. It involves techniques like packet capture, log analysis, and traffic analysis to identify suspicious network activities, reconstruct events, and gather evidence related to network-based attacks or unauthorized access attempts.

Network forensics techniques may include packet capture and analysis, log analysis, network traffic reconstruction, protocol analysis, and intrusion detection system (IDS) monitoring.


Nmap (Network Mapper) is an open source network security tool used for network exploration and security auditing. Its primary purpose is to detect active network connections and services as well as hosts and operating systems that are running on the network. Nmap can be used to perform port scans, run intrusion detection systems, identify system vulnerabilities, and more. It is often used as a tool for security professionals to gain an understanding of their networks or to detect and analyze suspicious activity.

For example, an administrator may run a Nmap scan to see what machine addresses, ports, and services are available on the network and afterwards use this information to configure a firewall. For instance, they may block or limit access to ports they do not trust or use to improve the security of their network.

Another example is using Nmap to detect hosts on the network. This can be helpful for identifying potential intruders or for tracking down machines that are not visible to the network due to being outside of the allowed range. In addition, Nmap can be used to look for open ports and services running on those ports so the security team can investigate further what is running and if any potential threats are present.

Nmap can also be used for vulnerability scanning to detect potential security issues. For example, a scan can be used to determine if services and services versions that are vulnerable to known threats are running on the network. This allows the security team to take appropriate and timely action to fix or mitigate the issue.

Finally, Nmap can be used to run operating system fingerprinting to detect what operating system is running on a given machine. This can help identify possible malicious activity or detect compromised machines on the network.

Non-Disclosure Agreement (NDA)

A Non-Disclosure Agreement (NDA), also known as a confidentiality agreement, is a legally binding contract between two or more parties that outlines confidential material, knowledge, or information that the parties wish to share with one another for certain purposes but wish to restrict from wider use or dissemination. NDAs are commonly used in business contexts to protect sensitive information, but can also be used in any situation where confidentiality is important.

The key elements of an NDA include:

  • Definition of Confidential Information: The agreement specifies what information is considered confidential. This could include technical data, trade secrets, business plans, customer lists, and other proprietary information. The definition may also specify what is not considered confidential, such as information already publicly available.
  • Obligations of Parties: The NDA outlines the obligations of the receiving party regarding the confidential information. This typically includes stipulations that the information be used only for specified purposes, not be disclosed to others without permission, and be protected with a reasonable degree of care to prevent unauthorized access or use.
  • Exclusions from Confidential Information: Information that is not protected by the NDA is also defined. Common exclusions include information that is already known by the receiving party before disclosure, information that becomes publicly known through no fault of the receiving party, and information that is independently developed by the receiving party.
  • Duration: The agreement specifies the period during which the information must remain confidential. This duration can vary depending on the nature of the information and the agreement between the parties.
  • Consequences of Breach: The NDA outlines the consequences if one party violates the terms of the agreement. This often includes monetary damages and may also include injunctions to prevent further breaches.
  • Return of Information: Upon the termination of the agreement or at the request of the disclosing party, the receiving party is often required to return or destroy all materials containing the confidential information.
  • Jurisdiction and Dispute Resolution: The agreement may specify the legal jurisdiction under which disputes will be resolved and the method for dispute resolution, whether through arbitration, mediation, or court proceedings.

NDAs can be unilateral (where only one party discloses confidential information) or mutual (where both parties share confidential information with each other). They are a standard practice in many industries, particularly where businesses need to protect sensitive information, intellectual property, or trade secrets while negotiating deals, partnerships, or during the innovation process.

Understanding and carefully drafting an NDA is crucial to ensuring that it effectively protects confidential information while allowing for the necessary sharing of information for business or other collaborative efforts.



Operational security (OPSEC) refers to the protection of sensitive information and activities in order to prevent adversaries from gaining an advantage or disrupting operations. In the military, OPSEC is critical to the success of missions and the safety of personnel.

Examples of OPSEC considerations in the military include:

  1. Security of communications: Ensuring that sensitive information is not compromised through unsecured communication channels, such as phone or email. This may involve using encrypted communication methods or secure communication devices.

  2. Physical security: Protecting military facilities and equipment from unauthorized access or tampering. This may involve measures such as security patrols, perimeter fencing, and access controls.

  3. Personnel security: Protecting the identities and personal information of military personnel in order to prevent adversaries from targeting individuals or their families. This may involve measures such as strict control of personal information and use of pseudonyms or code names.

  4. Operations security: Protecting the details of military operations in order to prevent adversaries from gaining an advantage or disrupting the mission. This may involve measures such as disguising the true purpose of an operation or using misdirection to mislead adversaries.

Overall, OPSEC is an important consideration in the military as it helps to protect sensitive information and activities, ensuring the success of missions and the safety of personnel.

OSI Model

The OSI (Open Systems Interconnection) model is a framework for understanding how communication occurs between different devices within a computer network. It is composed of seven different layers, each of which performs a specific function in the communication process. These layers are:

  1. Physical Layer: This layer deals with the physical connection between devices, including the transmission media (such as cables or wireless signals) and the hardware (such as network interface cards) used to transmit data. Protocols at this layer include Ethernet, WiFi, and Bluetooth.

  2. Data Link Layer: This layer is responsible for establishing a connection between two devices and ensuring that the data is transmitted accurately between them. Protocols at this layer include MAC (Media Access Control) addresses, which are unique identifiers assigned to each device on the network.

  3. Network Layer: This layer is responsible for routing data packets between devices, ensuring that they reach their intended destination even if the network topology changes. Protocols at this layer include IP (Internet Protocol), which provides a unique address for each device on the network, and routing protocols such as OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol).

  4. Transport Layer: This layer is responsible for ensuring that data is delivered reliably between devices, including retransmitting any lost or corrupted packets. Protocols at this layer include TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).  Some argue that SSL and TLS now reside on this layer.

  5. Session Layer: This layer is a framework for understanding how data is transmitted over networks. The session layer is responsible for establishing, maintaining, and terminating communication sessions between computers. Some of the protocols that operate at the session layer include:

    • NetBIOS (Network Basic Input/Output System)
    • RPC (Remote Procedure Call)
    • SIP (Session Initiation Protocol)
    • SS7 (Signaling System No. 7)

    NetBIOS is a protocol that provides services such as name resolution, datagram transmission, and session establishment for applications on a network. RPC is a protocol that allows a computer to request a service from a program located on another computer, and it is used to build distributed applications. SIP is a signaling protocol used for initiating, maintaining, modifying and terminating real-time sessions that involve video, voice, messaging and other communications applications and services between endpoints on the Internet. SS7 is a signaling system that is used to set up and tear down telephone calls, as well as to provide other services such as caller ID and call forwarding

  6. Presentation Layer: This layer is responsible for formatting and encoding data so that it can be transmitted between devices. Protocols at this layer include ASCII (American Standard Code for Information Interchange) and JPEG (Joint Photographic Experts Group).

  7. Application Layer: This layer is the highest layer in the OSI model and is responsible for providing services to the user, such as file transfer, email, and web browsing. Protocols at this layer include FTP (File Transfer Protocol), HTTP (Hypertext Transfer Protocol), and SMTP (Simple Mail Transfer Protocol).

In summary, the OSI model is a framework that helps to understand how communication occurs between devices on a computer network, with each layer performing a specific function in the process. Protocols at each layer provide the necessary standards and protocols to ensure that data is transmitted accurately and reliably between devices.


OSINT stands for "Open-Source Intelligence." It is the practice of collecting and analyzing information from publicly available sources to support decision-making or research. This includes information from the internet, social media, newspapers, television, radio, and other open sources.

Examples of OSINT include:

  1. Researching a company's financial performance by analyzing publicly available financial statements and news articles.

  2. Investigating a person's background by searching for their name on social media platforms, public records, and online directories.

  3. Analyzing a country's political climate by studying news articles and social media posts from local sources.

  4. Tracking the spread of a disease by collecting data from healthcare websites and social media accounts.

  5. Monitoring the activities of a political organization by analyzing their website and social media posts.

Overall, OSINT is a powerful tool for gathering information about a wide range of topics, from individuals and organizations to countries and events. It is an essential part of intelligence gathering and is often used in conjunction with other forms of intelligence, such as human intelligence (HUMINT) and signal intelligence (SIGINT).

Oxen Cryptocurrency

Oxen is a privacy-centric cryptocurrency designed to facilitate secure and anonymous online transactions. Built on the principles of blockchain technology, Oxen prioritizes the privacy of its users by employing advanced cryptographic techniques to ensure transactions are not only secure but also untraceable. This makes Oxen an ideal choice for individuals and organizations looking for a high degree of privacy in their digital financial activities.

Oxen appeals to a wide range of users, from privacy advocates and journalists to activists and general users who value their financial privacy online. It serves as the foundational currency for privacy-focused applications and services, including the Lokinet privacy network, where it incentivizes the operation of service nodes and powers private transactions within the ecosystem.

Oxen utilizes several key technologies to achieve its privacy goals:

  • Ring Signatures: This technology ensures the anonymity of the sender by mixing their transaction details with others, making it virtually impossible to trace transactions back to their source.
  • Stealth Addresses: These one-time addresses are generated for each transaction, protecting the recipient's privacy by preventing transactions from being linked to their wallet.
  • Ring Confidential Transactions (RingCT): RingCT hides the amount of Oxen being transferred, further enhancing the privacy of transactions by making it impossible for outside observers to determine the value of exchanges.

Key Features:

  • Privacy: Oxen's use of sophisticated cryptographic techniques shields both the sender and receiver in transactions, ensuring their activities remain confidential.
  • Security: Built on a robust and secure blockchain, Oxen offers a secure environment for financial transactions free from the risk of fraud or theft.
  • Decentralization: As a cryptocurrency, Oxen benefits from blockchain's inherent decentralization, reducing reliance on centralized financial institutions and increasing resistance to censorship.

While Oxen provides significant privacy advantages, users should remain aware of the legal and ethical considerations associated with using privacy-focused cryptocurrencies. The same features that protect user privacy can also be misused. However, for those committed to digital privacy and security, Oxen represents a valuable tool for conducting financial transactions with confidence in the digital age.

In conclusion, Oxen cryptocurrency stands at the intersection of privacy and blockchain technology, offering a secure and anonymous alternative for online transactions. Its integration into the Lokinet ecosystem underscores its commitment to providing comprehensive privacy solutions, marking Oxen as a pivotal player in the ongoing evolution of digital privacy tools.


Lokinet | Anonymous internet access
Oxen | Privacy made simple.
Course: CSI Linux Certified Dark Web Investigator | CSI Linux Academy
Course: CSI Linux Certified Covert Comms Specialist (CSIL-C3S) | CSI Linux Academy


Plain View

The plain view doctrine is a legal principle that allows law enforcement officers to seize evidence that is in plain view without a warrant. This doctrine is based on the idea that if an officer is lawfully present in a location and sees evidence of a crime in plain view, they have the right to seize that evidence without the need for a warrant.

Here are some examples of how the plain view doctrine might be applied:

  1. If an officer is conducting a traffic stop and sees drugs or a weapon in plain view in the vehicle, they can seize those items without a warrant.

  2. If an officer is responding to a noise complaint and sees illegal drugs on a coffee table as they enter the apartment, they can seize the drugs without a warrant.

  3. If an officer is serving a warrant for one crime and sees evidence of another crime in plain view, they can seize that evidence without a separate warrant.

There are some limitations to the plain view doctrine. The evidence must be in plain view, meaning that it is clearly visible to the officer. The officer must also be lawfully present in the location where the evidence is found. Additionally, the officer must have probable cause to believe that the evidence is connected to a crime.

Here are some examples of how the plain view doctrine might be applied in digital forensics:

  1. Searching a suspect's home: If a police officer has a warrant to search a suspect's home for drugs, and while searching they come across a laptop on the kitchen table with child pornography on the screen, they can seize the laptop and use the evidence against the suspect without violating their Fourth Amendment rights.

  2. Searching a suspect's phone: If a police officer has probable cause to search a suspect's phone and while searching they come across evidence of a crime, they can seize the phone and use the evidence against the suspect without violating their Fourth Amendment rights.

  3. Searching a suspect's email: If a police officer has probable cause to search a suspect's email account and while searching they come across evidence of a crime, they can seize the email account and use the evidence against the suspect without violating their Fourth Amendment rights.

Overall, the plain view doctrine allows law enforcement officers to seize evidence that is in plain view if they have a legitimate reason for being in the location where the evidence is found and if the evidence is clearly related to a crime. This doctrine can be a powerful tool for digital forensics investigators, as it allows them to seize electronic devices and data without having to obtain a warrant. 

Preservation of Evidence

Preservation of evidence refers to the process of safeguarding and protecting physical or digital evidence that may be used as evidence in a legal or investigative context. It involves ensuring that the evidence is collected, stored, and handled in a way that maintains its integrity and authenticity.

There are several reasons why it is important to preserve evidence. First, preserving evidence helps to ensure that it is available for use in legal proceedings. For example, if a crime has been committed, the police may need to collect physical evidence such as fingerprints, DNA, or other forensic evidence to help identify the perpetrator. If this evidence is not properly preserved, it may be contaminated, damaged, or lost, making it difficult or impossible to use in a court of law.

Second, preserving evidence helps to establish the chain of custody, which refers to the record of who has had possession of the evidence at different points in time. This is important because it helps to establish the authenticity and reliability of the evidence. For example, if the police collect evidence from a crime scene, they must maintain a record of who handled the evidence, how it was stored, and how it was transported to ensure that it is not compromised in any way.

Examples of preservation of evidence include:

  1. Collecting and storing physical evidence such as fingerprints, DNA, or other forensic evidence in a secure location to prevent contamination or tampering.

  2. Maintaining a chain of custody record to document who has handled the evidence and how it has been stored or transported.

  3. Securely storing digital evidence such as emails, text messages, or other electronic documents in a way that preserves their authenticity and integrity.

  4. Using secure servers or cloud storage to store digital evidence to prevent unauthorized access or tampering.

  5. Ensuring that evidence is handled in a way that preserves its authenticity, such as using gloves when handling physical evidence to prevent contamination.

Probable Cause

Probable cause refers to the legal standard that must be met in order to justify the search or seizure of property or the arrest of an individual. It requires that there be a reasonable belief that a crime has been committed or is about to be committed, and that the property or person in question is connected to the crime in some way.

Here are some examples of probable cause:

  1. A police officer witnesses a suspect breaking into a car and stealing items from inside. The officer has probable cause to arrest the suspect for theft.

  2. A police officer receives a tip from a reliable informant that a person is selling illegal drugs out of their home. The officer has probable cause to obtain a search warrant for the person's home.

  3. A police officer sees a person driving erratically and swerving across lanes on the highway. The officer has probable cause to pull the person over and investigate for possible drunk driving.

  4. A police officer receives a report of a domestic disturbance and arrives at the scene to find one person with visible injuries and the other person holding a weapon. The officer has probable cause to arrest the person with the weapon for assault.

Probable cause must be based on specific facts and circumstances, and cannot be based on mere suspicion or speculation. It is an important legal principle that helps to protect the rights of individuals and ensure that law enforcement has a valid reason for conducting searches, seizures, or arrests.

Probable cause in digital forensics refers to the standard of evidence required for a forensic investigator to justify the search, seizure, and examination of digital devices or data. In the Us, this standard is based on the Fourth Amendment to the U.S. Constitution, which protects citizens from unreasonable searches and seizures.

In order to establish probable cause in digital forensics, an investigator must provide evidence that suggests that a crime has been committed and that digital devices or data may contain evidence of that crime. This evidence may be based on a variety of factors, including witness testimony, physical evidence, or other circumstances that support the belief that a crime has been committed.

Here are some examples of probable cause in digital forensics:

  1. A witness reports seeing an individual accessing and downloading child pornography on their computer. This information, combined with other evidence, may be sufficient to establish probable cause for a forensic investigation of the individual's computer.

  2. A company suspects that an employee is leaking confidential information to competitors. The company may provide evidence of this suspicion, such as email communications or other data that suggests the employee is engaging in inappropriate behavior. This evidence may be used to establish probable cause for a forensic investigation of the employee's computer and other digital devices.

  3. A forensic investigator receives a tip from a reliable source that a suspect may be using encrypted messaging apps to communicate with other individuals about illegal activities. This information, combined with other evidence, may be sufficient to establish probable cause for a forensic investigation of the suspect's phone and other digital devices.

Overall, probable cause in digital forensics is a critical standard that must be met in order for forensic investigators to conduct searches and seizures of digital devices and data. It helps to ensure that the privacy rights of individuals are protected while also allowing investigators to gather the necessary evidence to solve crimes and bring perpetrators to justice

Page: (Previous)   1  2  3  4  5  6  7  8  9  10  11  (Next)

loader image