Digital Forensics for Digital Archivists

I’ve been very fortunate here at UVa to have at my disposal some wonderful resources for getting up to speed with born-digital theory and practice. First and foremost, UVa is home to Rare Book School which has offered a course on Born Digital Materials for the past two years (and I’ve just learned will offer it again in 2012). I was able to take this course in July along with 11 fellow classmates from around the country. A week and a half later I was then off to the headquarters of Digital Intelligence, Inc. makers of our Forensic Recovery of Evidence Device (FRED) for Computer Forensics with FRED. This was a two day course covering basic digital forensic skills as well as the FRED system.

Mulder and Scully are concerned about the viability of this forensic evidence gathered next to UVa's FRED...

Given my great bounty, and my belief in professional karma, I’ve decided to give a brief overview of both of these classes here on the blog followed by my thoughts on a potential Digital Forensics for Archivists class/workshop that I’d really like to see developed, by myself or whomever! Two major classes out there that I have not taken are the DigCCurr Professional Institute and SAA’s electronic records workshop. Anyone with experiences in those classes, please add your comparisons in the comments.

RBS L95 — Born Digital Materials: Theory and Practice

Overall, I’d say this class has the perfect name: there’s an almost equal amount of theory and practice. That may sound like faint praise, but it’s really not. It’s something that too few workshops or classes get right. Instructors Naomi Nelson and Matt Kirschenbaum deserve much credit for a well constructed week that built practice on top of theory.

For someone new to the field of the born-digital it’s a great foundation. Concepts like metadata, preservation, “the cloud,” essential characteristics, physicality/materiality and digital humanities are combined with real-life examples from libraries, archives, and the university. This overview allowed us to attack the fundamental question of the class: what should we be trying to accomplish when we attempt to “save” (or steward, curate, safeguard, preserve, “archive”) born-digital materials.

On the practical side of things, digital forensics is covered and students get the opportunity to do a few lab exercises with emulators, floppy drives, and older models of equipment. The syllabus and reading list provide an excellent bibliography for further research.

It’s a relatively high-level class and therefore a great way to get started or a great way to get administrators thinking intelligently about the issues they need to face. I think that a more practitioner-focused and through digital forensics curriculum in the archives or cultural heritage setting could complement the course very nicely.

Computer Forensics with FRED training

University of Virginia decided to invest in the FRED technology last year and has not regretted it. While the FRED can do lots of neat things, I feel it is important to note that many or all of the same things can be done with other hardware and software, it just takes a bit more persistence. Similarly, despite the name a lot of this course dealt with basic data and file system concepts, as well as a little bit about some of the specific hardware most commonly found. In the future, DI is going to be splitting this up into two classes: Digital Forensic Essentials and Digital Forensics with FRED. The first part is a two day course and covers the hardware, data, and system stuff. The second is a one day class that covers the specifics of FRED. Although the first class will be more expensive than the current combined class is, it would be of more interest to those in the archival world.

As it is geared for law enforcement, a lot of time was spent on detected deleted, fraudulent, or hidden material. While all the cops in the room thought that this would be of no use to me, I disagreed. I need to know what I am collecting (whether inadvertent or not), whether it is authentic, and how to communicate with donors to decide how to deal with it. In addition, if we can get donors to agree to let us transfer backup or deleted versions of manuscripts, we’ll gain a wealth of information about how the final version evolved. Knowing that such recovery is possible is one of the more glamorous promises of digital forensics.

We also learned how to create and navigate disk images. While some of this stuff was fairly easy for me to pick up beforehand from Peter Chan’s tutorials, the extra practice and insight was very useful.

Digital Forensics for Archivists

Based on my experiences in these two classes, I would propose a Digital Forensics for Archivists workshop geared specifically for those interested in incorporating forensic techniques into the capture and processing of digital materials. The outline of topics I would expect to see on the syllabus below is probably a bit ambitious for a one-day workshop and would certainly have some hurdles to overcome related to provisioning hardware for all. However, these are the areas I’ve come to think of as necessary for an archive to be prepared for the variety of media that we will be collecting for the continuing future.

Digital Forensics for Archivists

• Hardware basics


• IDE, SCSI, SATA, USB, Firewire
• Floppy drives
• Optical disks
• Hard drives
• Internal basics (motherboard, pci, power, etc.)


• Operating Systems


• DOS
• Windows
• MAC OS
• Linux


• File system basics


• FAT


• NTFS


• HPFS


• Forensic vs. logical copying


• What happens to deleted data


• How it can be recovered


• Why you need to know…


• Write blocking


• How to achieve it


• Image files


• Types


• Software


• Uses


• Emulation and Migration


• Cost/benefit of each


• Possible use cases for each

So what do you think? Pipe dream? Useful? Impractical? Let me know in the comments…

DigCCurr Professional Institute 2010

During the week of May 16th – 21st, I attended the DigCCurr Professional Institute: Curation Practices for the Digital Object Lifecycle, at the University of North Carolina at Chapel Hill. The week-long course was entirely focused on best practices for digital preservation and curation with a balance of theory and hands-on labs using some of the common tools for the assessment of files and for the creation of curation workflows. The participants were a wide-array of librarians and archivists from all parts of the United States. The faculty (listed below) are, for the most part, well known in digital curation circles. I found this week of study to be entirely relevant to my work for the AIMS project and I would make the recommendation that this course would be highly useful to those engaged in archival processing, preservation and/or data curation.

The DigCCurr faculty are as follows:

UNC Chapel-Hill: Dr. Helen Tibbo, Dr. Cal Lee, Dr. Richard Marciano, & Carolyn Hank University of Michigan: Dr. Nancy McGovern University of Toronto: Dr. Seamus Ross University of Cologne: Dr. Manfred Thaller

Highlights of the Institute, aside from meeting a bunch of energetic and forward thinking librarians and archivists, was the focus on the importance of creating policies for one's institution for digital preservation & curation and the opportunity to get an overview of some of the tools that have been developed to help stewards of digital content manage their collections responsibly.

For those of you keen on drafting policies in regard to digital preservation and digital curation, both ICPSR and OpenDOAR provide examples of policies that can be used as guidelines for your institution. Curious about the readiness of your institution's repository to manage digital curation activities? DRAMBORA (Digital Repository Audit Method Based on Risk Assessment) is a tool meant for assessing risk associated with an institutional repository in terms of its readiness to manage curation activities. TRAC (Trusted Repositories Audit & Certification) provides a suite of tools for the audit, assessment, and potential certification of digital repositories. It establishes documentation requirements for an audit, outlines a process for certification, and establishes a framework for determining the sustainability of digital repositories. Auditors come from the outside of your organization.

I could go on (but I won't) since the week was packed with great hand-on labs and lectures. If you're interested in getting more information you can certainly contact me. One last thing I'll add is this; although this wasn't part of the formal program, I did have the opportunity to learn about a new project underway in Vancouver called Archivematica. It's an open source set of tools knit together for the management and preservation of born digital collections and archives. The 0.6 alpha version was just make available for download a couple of weeks ago - Check it out! And if you want an assessment from January 2010, check out Chris Prom's blog.

DigCCurr

Hello,

I'm getting geared up to attend the 2010-2011 DigCCurr Professional Institute at UNC-Chapel Hill next week. I'm looking forward to meeting my peers in the field, learning more about the life cycle of digital objects and getting some hands-on experience with tools to assist with their management over the long haul.

I'll be posting more about this institute once I've actually attended it; in the meantime, here's a bit of info:

DigCCurr Institute

Liz