Tag Archives: forensics

Our first local ‘dead’ hard disk acquisition

We’ve imaged lots of removable media over the past year (~ 400, according to Victoria’s stats), and I’ve also done a  fair amount of forensic imaging of material on-site with donors (live acquisition) . One aspect of our ‘forensic’ armoury that has not been subject to so much testing is the imaging of whole hard disks at BEAM. So-called ‘dead’ acquisitions.

In the past few months two new accessions have presented us with an additional four hard disks. This is excellent news, as I have finally had the chance to use our forensic computer’s Ultrabay (write-blocking device) to image a real ‘collection hard disk’. Everything went smoothly. So far so good.

-Susan Thomas

#4n6 event, and CLIR report on digital forensics as applied to cultural materials

For a couple of days week before last I was at a meeting which went by the name of Computer Forensics and Born-Digital Content in Cultural Heritage Collections. The meeting was in support of a report bearing the same name (for now at least) which is currently being written by Matt Kirschenbaum, Richard Ovenden and Gabby Redwine. The final day of the workshop was dedicated to reviewing the first draft of the report, and the finalised version should be published by CLIR later this year.

We’ve been adapting digital forensics tools and techniques within BEAM (Bodleian Electronic Archives and Manuscripts) for a few years now, and this meeting was a useful event to talk about how we do this, and some of the issues (process, technical and ethical) it raises.

It was a good meeting, and I very much enjoyed hearing from other digital archivists and *real* forensics practitioners (they have rather different objectives to ours, but their tools are still useful!). Another highlight for me was Stephen Ennis’ framing thoughts, presented in the first session. Ennis grounded the discussion, with three key – and very practical – points that should be important to any archivist:

1) What is the hard-cash value of born-digital archives?
Ennis contends that monetary value has been a preservation agent for literary manuscripts. If disks and digital data are of no value, their survival rate is likely to be poor. He cited the example of John Updike’s archive (at Harvard), which contained software disks but no related data disks. It’s worrying that dealers don’t/won’t appraise born-digital material, but this will surely change. Another issue is that we need dealers to be able to appraise digital archives without altering what they are appraising. Will they have to adopt digital forensic techniques too?

2) Are the steps that seem justified for celebrity authors justified for others?
This question is very important and equally applicable to ‘papers’, of course. In the digital domain, the obvious ‘celebrity’ example is the work Emory’s MARBL have done to make one of Salman Rushdie’s hard disks accessible to scholars through an emulator and a searchable database. We certainly won’t be processing every digital archive submission at this level, and I suspect MARBL won’t either. Where it’s justified, I think it’s a very good thing.

3) What is the researcher’s object of study? Are we promoting new and different forms of enquiry?
This question, perhaps, gets closer to exploring our simultaneous excitement and concern when we consider the potential of combining scholarly enquiry and digital forensic tools in relation to born-digital archives. There’s a good deal we need to learn about scholars’ requirements and I’m looking forward to the day that we have more case studies so we can move this discussion beyond conjecture!

If you’re interested in finding out more in advance of the report, you’ll probably find that some of the slides will be published in due course at the event’s website. You can also take a look at some photos and tweets.

I may extend this post with some of the more interesting tidbits if I find a moment.

-Susan Thomas