Workshops onBorn-Digital Materials Workflow        Peter Chan, Digital Archivist               Oct. 20, 2011
Week 2 Agenda• Accessioning  – virus check;  – disk imaging;  – create FTK case;  – collection summary  – AT accession rec...
Virus Check• Quarantine for 30 days (count from the day  the media arrive at Stanford)• Run Sophos• Remove virus, if any, ...
Disk / Forensic image• A complete bit-by-bit copy of a storage  medium or device, such as a hard drive, SSD  (solid state ...
Logical image• A copy of the files in the directory(folder) / directories(folders)  specified in the copy process.• The fu...
Disk Partition• Disk partitioning is the act of dividing a  physical hard disk drive into multiple logical  storage units....
GParted
File System• Microsoft: FAT12 (File Allocation Table), FAT16, FAT32,  exFAT (FAT64), NTFS (New Technology File System)• Ap...
Computer Management
Capture 5.25 Floppy Diskette
Compare 4 5.25 Floppy Drive Solutions• https://docs.google.com/document/d/1TLY3  mn3duadGBLqqb2_XnYoF3jakjmo1hXfzvmWC  TzE...
Hard Disk Interface•   SCSI•   IDE•   Firewire 1394•   SATA•   USB
Internal Write Blocker
Image Log Spreadsheet• Use the following columns  – Box#  – CM#  – Media Details (3.5, 5.25, single/double sided,    singl...
FTK Imager
Create Disk Image•   Physical Drive – hard / flash memory drive•   Logical Drive – floppy / CD / DVD drive•   Contents of ...
Fernico Device
Create ImageTick “Verify images after they are created”Tick “Create directory listings of all files in the image after the...
Image Type
Image Type• Raw (dd) – commonly used disk image format  created by the UNIX command dd• SMART – proprietary disk image for...
Evidence Item Information
Evidence Item Information•   Use “Raw (dd)” as image type•   Use call no. as “Case Number”•   Use CMxxx as “Evidence Numbe...
Select Image Destination
Select Image Destination• Store all files under “Disk Image” folder in Desktop• Use “Case No.” + CMxxx as Image Filename f...
Storage Locations for Files
Create New Case in AccessData FTK• Copy image files to network before creating  new case.• Use call no. as Case Name• Stor...
Evidence Processing• Detailed Options  – Evidence Processing - "√" Flag Duplicate Files; "√"    MD-5 Hash, SHA-1 Hash; "√"...
Evidence Processing• KFF - Using a database of hashes from known files, this  option flags insignificant files as ignorabl...
Evidence – Add/Remove
Use “All Images of a Directory” at the    Network Forensic Lab Folder                                         35
Images Files Identified                          36
Choose Appropriate Time Zone                               37
Processing Status of Each Image File                                       38
File - Report
Report Output• Report Folder – Drive:FTKFTK ReportCall#• Formats – PDF• Don’t check “Use object identification number  for...
AT Accession Record  Alternate Extent
AT Accession Record  Alternate Extent
AT Accession RecordExternal Documents
External Documents Location• sul-wallabySpecial  CollectionsManuscriptsCollectionsM1437  Gould• M1437 FTK Accession Report...
Workshop 2 revised
Workshop 2 revised
Workshop 2 revised
Workshop 2 revised
Workshop 2 revised
Upcoming SlideShare
Loading in...5
×

Workshop 2 revised

224

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
224
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
6
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Workshop 2 revised

  1. 1. Workshops onBorn-Digital Materials Workflow Peter Chan, Digital Archivist Oct. 20, 2011
  2. 2. Week 2 Agenda• Accessioning – virus check; – disk imaging; – create FTK case; – collection summary – AT accession record
  3. 3. Virus Check• Quarantine for 30 days (count from the day the media arrive at Stanford)• Run Sophos• Remove virus, if any, before creating disk/logical image (unless you are capturing the disk for a researcher in computer virus!)
  4. 4. Disk / Forensic image• A complete bit-by-bit copy of a storage medium or device, such as a hard drive, SSD (solid state drive), tape drive, floppy disk, CD/DVD/BD, or flash memory device.• The image can be stored in one or more files.• Deleted files, if any, may be copied in this process.
  5. 5. Logical image• A copy of the files in the directory(folder) / directories(folders) specified in the copy process.• The full path of each file is recorded and the files are embedded in one or more files in AD1 format.• Since deleted files and unpartitioned space are not represented in a directory, they are not copied in the process.• The host operating system has to recognize the target directory (folder) for the operation. (You cannot perform a logical copy of an Apple disk using FTK Imager under Windows perform).
  6. 6. Disk Partition• Disk partitioning is the act of dividing a physical hard disk drive into multiple logical storage units.• The logical units can have different file systems so that we can set the same physical machine as a Window based PC and/or a Linux based PC and/or a Mac PC.
  7. 7. GParted
  8. 8. File System• Microsoft: FAT12 (File Allocation Table), FAT16, FAT32, exFAT (FAT64), NTFS (New Technology File System)• Apple: Apple ProDOS, HFS (Hierarchical File System), HFS+• CPM file system• Linux: ext (extended filesystem), ext2, ext3, ext4• Optical Discs: ISO 9660, UDF (Universal Disk Format)
  9. 9. Computer Management
  10. 10. Capture 5.25 Floppy Diskette
  11. 11. Compare 4 5.25 Floppy Drive Solutions• https://docs.google.com/document/d/1TLY3 mn3duadGBLqqb2_XnYoF3jakjmo1hXfzvmWC TzE/edit?hl=en_US
  12. 12. Hard Disk Interface• SCSI• IDE• Firewire 1394• SATA• USB
  13. 13. Internal Write Blocker
  14. 14. Image Log Spreadsheet• Use the following columns – Box# – CM# – Media Details (3.5, 5.25, single/double sided, single/double/high density, etc.) – Image Result (successful / unreadable) – Note (bad sector, etc.) – Manufacturer – Earliest modification/creation year of files – Folder title (if removed from collection folder)• Use “Call No. Imaging Log” as file name
  15. 15. FTK Imager
  16. 16. Create Disk Image• Physical Drive – hard / flash memory drive• Logical Drive – floppy / CD / DVD drive• Contents of a Folder – logical image• Fernico Device – a device which backs up forensic data from network locations or from locally attached hard drives, automatically spanning the content over a series of discs.
  17. 17. Fernico Device
  18. 18. Create ImageTick “Verify images after they are created”Tick “Create directory listings of all files in the image after they are created” if youneed one.
  19. 19. Image Type
  20. 20. Image Type• Raw (dd) – commonly used disk image format created by the UNIX command dd• SMART – proprietary disk image format created by ASR Data.• E01 – proprietary disk image format created by EnCase.• AFF – an open source disk image format, allow encryption of disk image• AD1 - proprietary logical disk image format created by AccessData.
  21. 21. Evidence Item Information
  22. 22. Evidence Item Information• Use “Raw (dd)” as image type• Use call no. as “Case Number”• Use CMxxx as “Evidence Number”• Put your name as “Examiner”• Use the following in the “Notes” field: – 3.5 inch floppy disk; 5.25 inch floppy disk; Zip disk; – External hard disk; Internal hard disk; – Optical Disk
  23. 23. Select Image Destination
  24. 24. Select Image Destination• Store all files under “Disk Image” folder in Desktop• Use “Case No.” + CMxxx as Image Filename for disk image• Default Image Fragment Size = 1500 MB• To save images segments that can be burned to a CD, specify 650 MB.• To save image segments that can be burned to a DVD, specify 4000 MB.• Selecting 0 (zero) produces the largest file, with no compression.
  25. 25. Storage Locations for Files
  26. 26. Create New Case in AccessData FTK• Copy image files to network before creating new case.• Use call no. as Case Name• Store case in Drive:FTKFTK Case• Field Mode: bypasses file signature analysis and detailed options in order to vastly speed the processing. (for people to analysis the case in the field)
  27. 27. Evidence Processing• Detailed Options – Evidence Processing - "√" Flag Duplicate Files; "√" MD-5 Hash, SHA-1 Hash; "√" Expand Compound Files; under “Expansion Options” "√" BZIP2, GZIP, RAR, TAR, ZIP; "√“ dtSearch Text Index; "√“ Create Thumbnails for Graphics (save as default) – Evidence Refinement (Advanced) - remove "√" Include File Slack, Include Free Space (save as default)
  28. 28. Evidence Processing• KFF - Using a database of hashes from known files, this option flags insignificant files as ignorable files and flags known illicit or dangerous files as alert files, alerting the examiner to their presence in the case.• Fuzzy hashing - A tool which provides the ability to compare two distinctly different files and determine a fundamental level of similarity. This similarity is expressed as score from 0-100. The higher the score reported the more similar the two pieces of data. A score of 100 would indicate that the files are close to identical. Alternatively a score of 0 would indicate no meaningful common sequence of data between the two files.
  29. 29. Evidence – Add/Remove
  30. 30. Use “All Images of a Directory” at the Network Forensic Lab Folder 35
  31. 31. Images Files Identified 36
  32. 32. Choose Appropriate Time Zone 37
  33. 33. Processing Status of Each Image File 38
  34. 34. File - Report
  35. 35. Report Output• Report Folder – Drive:FTKFTK ReportCall#• Formats – PDF• Don’t check “Use object identification number for filename” and “Append extension to filename if bad/absent”• Rename “Report” to Call# FTK Collection Summary• Copy the report to sul-wallabySpecial CollectionsManuscriptsCollectionsCall#
  36. 36. AT Accession Record Alternate Extent
  37. 37. AT Accession Record Alternate Extent
  38. 38. AT Accession RecordExternal Documents
  39. 39. External Documents Location• sul-wallabySpecial CollectionsManuscriptsCollectionsM1437 Gould• M1437 FTK Accession Report• M1437 Computer Media Imaging Log
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×