Workflow:Archival Forensics workflow (storage media deposit) - Revision history

Lkon115 at 12:13, 26 May 2023

2023-05-26T12:13:03Z

Lkon115 at 12:04, 26 May 2023

2023-05-26T12:04:18Z

172.104.134.96 at 11:59, 26 May 2023

2023-05-26T11:59:10Z

Lkon115: Version 0.1 of the archival forensics workflow

2022-11-07T16:44:43Z

Version 0.1 of the archival forensics workflow

Lkon115 at 16:38, 7 November 2022

2022-11-07T16:38:14Z

Lkon115 at 16:36, 7 November 2022

2022-11-07T16:36:27Z

Show changes

Lkon115: Created page with "{{Infobox COW |status=Experimental |tools=BitCurator, FTK (Forensic Toolkit) |input=Request to forensically process a digital deposit (storage media) to the University of Glas..."

2022-11-07T12:24:29Z

Created page with "{{Infobox COW |status=Experimental |tools=BitCurator, FTK (Forensic Toolkit) |input=Request to forensically process a digital deposit (storage media) to the University of Glas..."

New page

{{Infobox COW
|status=Experimental
|tools=BitCurator, FTK (Forensic Toolkit)
|input=Request to forensically process a digital deposit (storage media) to the University of Glasgow Archives & Special Collections, as part of of the Digital Archiving workflow (see Further Information).
|output=A verified, authentic copy of storage media content exported as a logical or physical image file, with or without forensic processing.
|organisation=Archives and Special Collections (ASC), University of Glasgow
|organisationurl=https://www.gla.ac.uk/myglasgow/archivespecialcollections/
}}
==Workflow Description==



[[File:Archival-forensics-workglow_v0-1_web_sm.png|1000px|Archival forensics workflow produced by Archives and Special Collections at the University of Glasgow]]<br>



; START
: A request to forensically process a digital deposit (storage media) to the University of Glasgow Archives & Special Collections, as part of of the [https://coptr.digipres.org/index.php/Workflow:Digital_archiving_workflow_(high-level) Digital Archiving workflow.] <br/>

; PRE-ACQUISITION APPRAISAL
: Processes for evaluating whether a deposit request will be accepted by the University Archives.
# Check the deposit request against the [https://www.gla.ac.uk/myglasgow/archivespecialcollections/collectionsdevelopmentpolicy/ Archives & Special Collections collection development policy] - does the request align with the core collecting areas?
# Prepare a records survey and/or pre-accession assessment of the proposed deposit.
# Evaluate the results of the records survey against the Appraisal & Retention policy, which:
#* addresses issues pertaining to selection and long-term retention of digital objects
#* extends the collections development policy
#* ensures that retention decisions are balanced between value and capacity to preserve for the long-term; and
#* provides clarity to avoid assumptions over digital storage costs and availability.
# Decide whether the requested deposit aligns with policies:
#* If not, re-evaluate acquisition and/or reject deposit.
#* If yes, proceed to Acquisition.

; ACQUISITION
: Processes for acquiring digital materials by transfer, donation, or purchase.
# Follow the methodology in the Space data and information transfer systems — Producer-archive interface — Methodology abstract standard (PAIMAS) ISO 20652:2006 standard. The standard "identifies, defines and provides structure to the relationships and interactions between an information producer and an archive. It defines the methodology for the structure of actions that are required from the initial time of contact between the producer and the archive until the objects of information are received and validated by the archive." ([https://www.iso.org/standard/39577.html ISO]). For more information, see [https://www.dpconline.org/handbook/organisational-activities/acquisition-and-appraisal Acquisition and appraisal, Digital Preservation Handbook (DPC)].
# Follow the Accepted file formats/media procedure, which:
#* Specifies decisions on file formats and/or storage media that the University Archives will accept.
#* Aligns with preservation planning decisions for format normalisation; and capability to access storage media (esp. legacy media, e.g. floppy or zip disks).
#* For a summary table of options, see the Acquisition workflow section in [https://www.dpconline.org/handbook/organisational-activities/acquisition-and-appraisal Acquisition and appraisal, Digital Preservation Handbook (DPC)].
# For acquisitions deposited in physical storage media:
#* Place all incoming items in quarantine area on arrival, inspect for pest infestation and mould; and follow handling and moving procedures.
#* Create physical conservation and preservation report, documenting all actions on the acquired media.
#* Proceed to Accessioning.
# For acquisitions deposited digitally (e.g. file transfer):
#* Proceed to Accessioning.

; ACCESSIONING
:Process of formally registering deposit into the University Archives, which enables intellectual control over the digital materials.
# Generate a unique accession number, based on the University Archives' archival processing guidelines.
# Compare the file manifests generated during Acquisition to make sure that the transfer includes everything that was deposited by the source.
# List the accession number into the University's Collections Management System for cataloguing. Cataloguing processes include decisions over the system of arrangement and level of description that will be used for the deposited materials; definition of access and reproduction conditions; and documentation via descriptive metadata.
# Decide whether archival forensic processing is required:
#* If Yes, follow the Archival Forensics workflow.
# Proceed to Transfer.

; TRANSFER
: Processes for transferring digital materials to the University Archives.
# Choose a method for transferring files:
#* Copy files from source media. OR
#* Create a disk image from source storage media. OR
#* Request that digital materials are submitted as a BagIt container.
# Check digital materials for viruses. See [https://www.nationalarchives.gov.uk/archives-sector/projects-and-programmes/plugged-in-powered-up/digital-preservation-workflows/1-select-and-transfer/ Select and transfer workflow in the TNA guide] (section 1.3) for a reasonable process. Depending on the results of virus checks:
#* if virus is found, quarantine and attempt removal; and/or request clean versions from source. If all these fail, prepare a report documenting actions and re-evaluate acquisition.
#* if virus-free, proceed with transfer.
# Generate checksums to verify data integrity during transmission and/or storage:
#* For digital acquisitions <i>in situ</i>, it might be appropriate to first store files in a temporary location for virus and/or integrity checks, before transferring to process store. Not applicable to all scenarios.
#* Transfer digital materials to Process store (e.g. network drive).
# Use tools to identify file types and validate file formats (e.g. DROID, JHOVE), then proceed to Appraisal.

==Purpose, Context and Content==


==Evaluation/Review==


==Further Information==

@@ Line 84: / Line 84: @@
 <!-- Add four tildes below ("~~~~") to create an automatic signature, including your wiki username. Ensure your user page (click on your username to create it) includes an up to date contact email address so that people can contact you if they want to discuss your workflow -->
-[[User:Lkon115|Lkon115]] ([[User talk:Lkon115|talk]]) 12:04, 26 May 2023 (UTC)
+[[User:Lkon115|Leo Konstantelos]] ([[User talk:Lkon115|talk]]) 12:13, 26 May 2023 (UTC)
 <!-- Note that your workflow will be marked with a CC3.0 licence -->

@@ Line 29: / Line 29: @@
 ; IMAGING
-: Create an exact copy of storage media, encapuslating contents and structures in a single file (a disk image).
+: Create an exact copy of storage media, encapsulating contents and structures in a single file (a disk image).
 # Use write-blocking tools (software or hardware) to only permit read-only access to storage media, so as to avoid compromising the integrity of the data; and protect the data chain of custody.
 # Use disk imaging software to generate a forensic image file, which can either be:
@@ Line 36: / Line 36: @@
 #* A selection of specific files and directories, also known as a targeted collection.
 # Instruct the disk imaging software to create a complete file and directory listing; and verify the integrity of the generated image file by comparing hashes:
-#* If verification fails and attempts at re-imaging are unsuccessful, create a "failed imaging" report in the COllections Management System logs.
+#* If verification fails and attempts at re-imaging are unsuccessful, create a "failed imaging" report in the Collections Management System logs.
 #* If verification is successful, store the image in process store.
 # Is further forensic processing and analysis required?
@@ Line 47: / Line 47: @@
 # Perform virus and malware detection checks on the collated sources.
 # Use forensic software to identify and, if possible, remove irrelevant or redundant files from processing. Examples may include operating systems, system files, or user-defined files that have been deemed as irrelevant.
-# Use forensic software to process the data, including hash generation for files; expanding compound files (e.g. zip archives); format identification and validation; creating search text indices; and preparing audiovisual, web amnd email data for analysis.
+# Use forensic software to process the data, including hash generation for files; expanding compound files (e.g. zip archives); format identification and validation; creating search text indices; and preparing audiovisual, web and email data for analysis.
 # Proceed to Analysis.
@@ Line 55: / Line 55: @@
 # Depending on the nature of the data and on archival needs, use forensic software to identify records of interest, and make them available for appraisal. Analysis methods may include:
 #* Data carving, for restoring data that was deleted or lost from the file system.
-#* Decrypting encrypted files and recovering passwords for passwrd-protected files.
+#* Decrypting encrypted files and recovering passwords for password-protected files.
 #* Viewing and exporting geolocation data from files that have geolocation information associated with them.
 #* Analysing document content to explore terms/words of interest; and automate the identification of personal information, such as names, phone numbers, credit card and social security numbers.
-#* Identifying the langauge in which documents are written.
+#* Identifying the language in which documents are written.
 #* Generating thumbnails from images and videos; and extracting metadata from multimedia files.
 #* Flagging duplicate files.
-#* Discovering infomation (incluidng documents and email communications) relating to pre-defined lists of persons of interest.
+#* Discovering information (including documents and email communications) relating to pre-defined lists of persons of interest.
 # Once all analyses have been completed, consolidate the resulting data into an appropriate file/folder structure.
 # Proceed to Exporting.
-; Exporting
+; EXPORTING
 : Export the forensically analysed contents of storage media as logical disk images, alongside relevant processing reports, filters and labels.
-# Export any custom filters and labels created to manage the data, which can be useful for other digital archiving processes. Filters help locate items of interest quickly; and labels allow for grouping files in customised ways (e.g. flagging content that requires arhivist attention; or records associated with a specific individual).
+# Export any custom filters and labels created to manage the data, which can be useful for other digital archiving processes. Filters help locate items of interest quickly; and labels allow for grouping files in customised ways (e.g. flagging content that requires archivist attention; or records associated with a specific individual).
 # Export any reports generated during processing and analysis, such as file hashes, virus and malware detection reports, search index terms and geolocation data.
 # Export the forensically curated contents of processed storage media into a logical disk image.

@@ Line 76: / Line 76: @@
 <!-- Describe what your workflow is for - i.e. what it is designed to achieve, what the organisational context of the workflow is, and what content it is designed to work with -->
 The workflow is meant to describe the steps and processes involved in an archival forensics examination of digital records submitted in storage media to University Archives at the University of Glasgow. Although the workflow can operate as stand-alone, it has been designed to align with and extend the [https://coptr.digipres.org/index.php/Workflow:Digital_archiving_workflow_(high-level) Digital Archiving workflow].
 <!-- Add four tildes below ("~~~~") to create an automatic signature, including your wiki username. Ensure your user page (click on your username to create it) includes an up to date contact email address so that people can contact you if they want to discuss your workflow -->
 <!-- Note that your workflow will be marked with a CC3.0 licence -->

@@ Line 1: / Line 1: @@
 {{Infobox COW
 |status=Experimental
-|tools=BitCurator, FTK (Forensic Toolkit)
+|tools=Archivists' Toolkit, Audacity, BitCurator, Duke Data Accessioner, FTK (Forensic Toolkit), Karen's Directory Printer, TeraCopy, TreeSize, VLC Media Player, VirtualBox, WinMerge
 |input=Request to forensically process a digital deposit (storage media) to the University of Glasgow Archives & Special Collections, as part of of the Digital Archiving workflow (see Further Information).
 |output=A verified, authentic copy of storage media content exported as a logical or physical image file, with or without forensic processing.