Acquisition
The process of collecting or creating a forensic copy or extraction from a source using an identified method and tool. ByteCase documents this work but does not perform the acquisition itself.
ByteCase Glossary
Shared language for repeatable forensic workflow.
Plain-language definitions for the workflow, documentation, verification, validation, timeline, and software terms used throughout ByteCase.
Artifact
A data item, record, structure, or trace that may have forensic relevance. ByteCase does not automatically determine whether an artifact is relevant or what it means.
Case record
A saved file or structured record connected to a case, such as an intake summary, acquisition packet, manifest, note, timeline entry, or review checklist.
Deliverable
A human-readable or structured output created by a module and preserved for later review, reporting, handoff, verification, or reopening.
Examiner-authored
Information intentionally entered, selected, categorized, or interpreted by the examiner rather than automatically concluded by the software.
Hash manifest
A saved inventory of files and associated hash values, paths, algorithms, and supporting metadata intended to support later re-verification.
Known-value dataset
Test material with documented expected contents or results that can be used to evaluate whether a tool or workflow behaves as expected.
Normalized timestamp
A timestamp converted into a selected reference timezone or format while preserving the original recorded value and its context.
Portable application
An application designed to run directly without a traditional installation workflow. Portable does not mean unrestricted or exempt from organizational approval.
Re-verification
Recalculating hashes later and comparing the new values with an earlier saved manifest to document matches, changes, missing items, and exceptions.
Validation
Documented testing used to evaluate whether a tool or process performs as expected for defined functions, datasets, versions, and environments.
Verification
A check that compares a current result with an expected or previously recorded result. Verification is narrower than a complete validation program.
Workflow state
A status such as complete, missing, waiting, optional, under review, or not applicable. A state records workflow progress; it does not prove technical correctness.