A brief intro to digital forensics, for the Queens College Graduate School of Library and Information Science class in digital preservation

2. What is digital forensics?
"…identifying, preserving, analyzing,
and presenting digital evidence…"
2
http://aic.gov.au/documents/9/C/A/%7B9CA41AE8-EADB-4BBF-9894-64E0DF87BDF7%7Dti118.pdf

3. Briefest history of digital media
3

4. Why apply digital forensics?
*To ensure data integrity and ease automation
and processing
4

5. Why apply digital forensics?
*In other words: preserve significant properties
such as authenticity and reliability
5

6. Why apply digital forensics?
*In other words: to ensure provenance, original
order, chain of custody, and context of digital
objects
6

7. Just one part of the plan
7

8. Many, many tools
BC, FTK, USB, JHOVE, E01, METS, PREMIS
8

9. What is BitCurator?
*Customized Linux OS running in virtual machine
with a tightly integrated, well-documented suite
of open-source digital forensics tools
9

10. What is BitCurator?
*Customized Linux OS running in virtual
machine…
10

11. What is BitCurator?
*Customized Linux OS running in virtual
machine…
11

12. What is BitCurator?
*…a tightly integrated, well-documented suite
of open-source digital forensics tools
12

13. 1. Creating a disk image
13

14. 2. Analyzing the disk image
14

15. 3. Create access copy
15

16. Just one part of the plan
16

17. Who is doing this work?
17

18. What skills might
digital archivists have?
18
Firm understanding of archival principles: provenance, original order, creation context
Firm understanding of archival standards: levels of description, DACS, the EAC suite
Outlines of METS, MARC/MODS/DC, PREMIS, and how they might fit together
Metadata wrangling tools: Excel, csv, OpenRefine
A “power tool” : XSLT, xQuery, command-line tools (grep, sed), or Python
Actionable curiosity http://gavialib.com/2013/09/the-one-skill/

19. What am I doing right now?
Using METS files to manage disk images
ePADD for email processing

20. Just one part of the plan
20

21. Additional Reading
21
*BitCurator wiki
[http://wiki.bitcurator.net/index.php?title=Main_Page]
*From Bitstreams to Heritage report
[http://www.bitcurator.net/docs/bitstreams-to-heritage.pdf]
*You’ve Got to Walk Before You Can Run: First Steps for Managing Born-Digital
Content Received on Physical Media
[http://www.oclc.org/content/dam/research/publications/library/2012/2012-
06.pdf?urlm=168601]
Thank you!