DeNISTing compares collected file hashes against the NIST National Software Reference Library, which catalogs known operating system and commercial software files, and removes matches from the review population.
These files are program components rather than user-created content.
Alternative Names:
NIST Filtering, System File Filtering
Why it Matters?
DeNISTing is routine and uncontroversial, removing operating system and application files that have no evidentiary value from full-disk collections. It matters mainly in volume terms, since a forensic image contains far more system files than user documents. The step is unnecessary for targeted email and document collections, which contain no system files to begin with.
Frequently Confused with
Related terms
Frequently asked questions
What does DeNISTing remove?
Is it always necessary?
