SAA Digital Forensics workshop

Course Description

Are you starting to receive disks as parts of collections or have you discovered disks in boxes of paper records? Caring for the records stored on removable storage media (e.g. floppy disks, hard drives, thumb drives, memory sticks, CDs) requires archivists to extract whatever useful information resides on the medium, while avoiding the accidental alteration of data or metadata. In this workshop, you'll learn how to apply existing digital forensics methods and tools in order to recover, preserve and ultimately provide access to born-digital records. We'll explore the layers of hardware and software that allow bitstreams on digital media to be read as files, the roles and relationships of these layers and tools and techniques for ensuring the completeness and evidential value of data. We'll apply digital forensics tools and methods to test data, in order to illustrate how and why they are used. The course is administered over two days. Both days includes lecture, discussion and hands-on exercise components.

Upon completion of this course you’ll be able to:

• Explain the roles and relationships between the main layers of technology required to read a string of bits off of a physical storage medium and treat it as a file;
• Identify various forms of data that may be “hidden” on the physical storage medium;
• Use write blockers and create disk images in order to prevent accidental manipulation of volatile data;
• Identify and extract the data that a file system uses to manage files;
• Apply digital forensics tools and methods to collections of records; and
• Identify and compare alternative strategies for providing public access to data from disk images.

See registration page for more info: http://saa.archivists.org/events/digital-forensics-advanced-1605/603