2 Forensic Information in Digital Objects (FIDO)

3 Session overview 1. Overview and terminologyLindsay & Kate Introduction to tools and processesGareth Hands on sessionLindsay & Gareth Break Group discussions of given scenariosAll Feedback and summaryLindsay & Gareth

4 JISC FIDO Project 6 month project from Feb 2011 – July 2011 Investigation of tools to aid data acquisition, file identification & process documentation Case study to report findings & lessons learnt Mapping of forensic terms to archival terms Address ethical issues of the approach Establish suitable computer hardware and tools to assist in newly defined digital acquisition process

5 Why Digital Forensics? Forensic investigation is an emerging profession developing tools that map user activity to legal admissibility standards Digital collections can be large and difficult to appraise – forensic tools can provide analysis of file characteristics and document what is done & when Forensic tools can provide contextual information such as a timeline or file types for initial appraisal Authenticity – Archivists need to capture authentic digital collections - forensic tools can support this process

6 Digital forensics vs Digital appraisal Different language – terms mean different things to each practitioner Confidence & skills – Digital archive skills are much closer to forensics or IT than traditional skills Forensics are dealing with potential crime scene – archivists work with the co-operation of the depositor Forensics want all available information including deleted documents & browser history whereas archivists may only have consent to take files defined by the donor

7 Scenario 1 An eminent retired KCL professor wishes to deposit her lifetimes work, because she is about to emigrate to New Zealand to be near her grandchildren. There are seven filing cabinets of papers, and three PCs, two of which she no longer uses. The older PCs have also been used in the past by other family members

8 Scenario 2 The literary executors of a military historian want to place his archive in an appropriate repository. He died eight months ago, leaving four shoe boxes full of disks and a PC, plus extensive printed proofs, off- prints of journal articles and assorted press cuttings. The executors are also in negotiation with a publisher with regard to the historians last, unpublished work.

9 Scenario 3 A colleague of a recently departed senior KCL manager in the Estates department gets in touch: she is concerned that there may be much useful information, and perhaps important documents, held only within his system, which will be deleted in a few weeks.

10 Scenario 4 The daughter of a retired Lieutenant General thinks he may have had the text of a draft memoir on his laptop. There may also be s relating to his service with NATO forces in Kosovo, 1999, and subsequent war crimes trials, some of which are still on-going. She isnt sure of anything, hasnt looked at anything herself, and doesnt know any passwords, but is anxious to find out if there is anything of significance and to see it safely preserved.