Ambient Data Defined
Ambient data is a forensic term which describes, in general terms, data stored in non-traditional computer storage areas and formats. The term was coined in 1996 by NTI to help our students understand NTI's computer evidence processing techniques which deal with evidence stored in other than standard computer files, formats and storage areas. The term is now widely used in the computer forensics community and it generally describes data stored in the Windows swap file, unallocated space, and file slack.
Ambient data and related processing issues are covered in detail in NTI's popular 5-Day Computer Forensics Course. Students leave the training course with a suite of NTI's computer forensics software tools that are designed to capture and analyze the various types of ambient data. The tools can also be purchased separately, without the training. However, we strongly recommend that individuals be trained in these non-traditional data types before they attempt to process computer evidence. Without proper computer forensics training, it is very difficult to use computer forensic software with proficiency sufficient enough to withstand the scrutiny of the litigation process.