Vocabulary: Terms you should understand

This list will be always updated.

• inodes

Inodes (IndexNodes) represent a main component of file management under the Unix systems. Each file in the file system has its own inode. The inode is the location for all file metadata and also for the file system blocks in which the actual file contents are stored.
So a inode is so to say a reference of a file.

• orphan files

This are files with no purpose left, since their parent applikation is gone. For example they appear often after an incomplete deinstallation.
You can find another definition in the sleuthkit wiki: "Orphan files are deleted files that still have file metadata in the file system, but that cannot be accessed from the root directory."

• offset

Offset is in our context some sort of logical "distance". It describes the location of data in relation of an other location. I found a good example in the wikipedia article:

For example, in A as an array of characters containing "abcdef", the fourth element containing the character 'd' has an offset of three from the start of A.

•  virtual memory

Virtual memory is all about making use of address space.

The address space of a processor refers the range of possible addresses that it can use when loading and storing to memory. The address space is limited by the width of the registers, since as we know to load an address we need to issue a load instruction with the address to load from stored in a register. For example, registers that are 32 bits wide can hold addresses in a register range from 0x00000000 to 0xFFFFFFF. 2^32 is equal to 4GB, so a 32 bit processor can load or store to up to 4GB of memory.  link

remember:

As with most components of the operating system, virtual memory acts as an abstraction between the address space and the physical memory available in the system. This means that when a program uses an address that address does not refer to the bits in an actual physical location in memory.

So to this end, we say that all addresses a program uses are virtual. The operating system keeps track of virtual addresses and how they are allocated to physical addresses. When a program does a load or store from an address, the processor and operating system work together to convert this virtual address to the actual address in the system memory chips.  link

• Pid (process id)

• PPid (parent process id)

In addition to a unique process ID, each process is assigned a parent process ID (PPid) that tells which process started it.