Digital Forensics for Archivists #1365 part of SAA's DAS Certificate

Course Details

Thu, Mar 21, 2013 
Worcester, MA

Are you starting to receive disks as parts of collections or have you discovered disks in boxes of paper records? Caring for the records stored on removable storage media (e.g. floppy disks, hard drives, thumb drives, memory sticks, CDs) requires archivists to extract whatever useful information resides on the medium, while avoiding the accidental alteration of data or metadata.  In this course, you’ll learn how to apply existing digital forensics methods and tools in order to recover, preserve and ultimately provide access to born-digital records. We’ll explore the layers of hardware and software that allow bitstreams on digital media to be read as files, the roles and relationships of these layers and tools and techniques for ensuring the completeness and evidential value of data. We’ll apply digital forensics tools and methods to test data, in order to illustrate how and why they are used.

Upon completion of this course you’ll be able to:

• Explain the roles and relationships between the main layers of technology required to read a string of bits off of a physical storage medium and treat it as a file
• Identify various forms of data that may be “hidden” on the physical storage medium
• Use write blockers and create disk images in order to prevent accidental manipulation of volatile data
• Identify and extract the data that a file system uses to manage files
• Apply digital forensics tools and methods to collections of records
• Identify and compare alternative strategies for providing public access to data from disk images
• Course attendees must bring a PC laptop (not a Mac) with them to participate successfully in this course.

Course Website (external link)

This information is provided as a convenience for informational purposes only; it does not constitute an endorsement by the Library of Congress.