SlideShare a Scribd company logo
1 of 35
Download to read offline
Using and Developing
      with Open Source
  Digital Forensics Software
in Digital Archives Programs
              Mark A. Matienzo
Manuscripts and Archives, Yale University Library
          2012 SAA Research Forum
                August 7, 2012
Is open source digital forensics
  software extensible enough
   and well-suited to support
 work in the archival domain?
Digital forensics in the
        archival domain

• Increasing use of digital forensics tools/methodologies
   within the context of digital archives programs
   (Kirschenbaum et al. 2010)

• Technology-focused work (John 2008; Woods & Brown
   2009; AIMS Work Group 2012)

• Methodology-focused work (Duranti 2009; Xie 2011)
Significant barriers to use of
digital forensics in archives


• Cost (Kirschenbaum et al. 2010; Daigle 2012)
• Complexity (Kirschenbaum et al. 2010; Daigle 2012)
• Digital archives as an emerging market for forensics
Potential of open source
  digital forensics software


• Requires additional tool development work to be useful
   for archivists (Kirschenbaum et al. 2010)

• Requires additional integration work (Lee et al. 2012)
Institutional Context

• Focus on implementation of and development with open
  source digital forensics software at Yale University
  Library

• Work must support accessioning, processing, and
  management of born-digital archival material

• Primary focus are records received on legacy media
Design Principles
• Use and develop with open source digital forensics software to support
   accessioning, arrangement, and description of born-digital archival records

• Focus on first two phases (preservation and searching) of Carrier’s (2005)
   model of digital investigation process

• Curation micro-services (Abrams, et al. 2010) as philosophical basis to
   guide development and implementation

• Recognition of both disk images as digital object (Woods, Lee, and
   Garfinkel 2011) and objects within disk images as needing management

• Intention of forensic soundness, but assume much of state is lost
Micro-services as
                Design Philosophy*
    Principles               Preferences                                          Practices
• Granularity      • Small and simple over                                 • Define, decompose,
                        large and complex                                     recurse


• Orthogonality    • Minimally sufficient over • Top down design, bottom
                        feature-laden                                         up implementation


• Parsimony        • Configurable over the                                  • Code to interfaces
                        prescribed


• Evolution        • The proven over the                                   • Sufficiency through a
                        merely novel                                          series of incrementally
                                                                              necessary steps
                   • Outcomes over means
                    *UC Curation Center/California Digital Library, 2010
Workflow
   Start
accessioning                              Write-protect media               Verify image
  process            Media




                                          Record identifying              Extract filesystem-     Disk     Meta-
                 Retrieve media            characteristics of               and file-level      images     data

                                          media as metadata                   metadata         Transfer package




                                                                           Package images
               Assign identifiers to                                                             Ingest transfer
                                            Create image                  and metadata for
                     media                                                                         package
                                                                               ingest




                                  Media                         FS/File                           Document
                                                Disk
                                   MD                            MD                              accessioning
                                               image
                                                                                                   process




                                                                                                     End
                                                                                                 accessioning
                                                                                                   process
Disk Image Acquisition
• Requires a combination of hardware (drives/media
   readers, controller cards, write blockers) and software

• In some cases, software depends on particular hardware
• Software tested: FTK Imager (proprietary/gratis),
   hardware-specific solutions (FC5025 WinDIB; KryoFlux
   DTC/GUI; Catweasel Imagetool3)

• Goal: sector image interpretable by multiple tools
Using and Developing with Open Source Digital Forensics Software in Digital Archives Programs
Analysis Process
• Multiple levels of analysis within digital forensics based
   on layers of abstraction (Carrier 2003)

• Conceptual linkages with metadata extraction/analysis
   processes with digital curation/archival domain




                           Carrier, 2003
Metadata Extraction
• Use open source digital forensics software (Sleuth Kit,
   fiwalk) and other open source tools to characterize
   media, volume, file system, and file information

• Attempt to repurpose this information as descriptive,
   structural, and/or technical metadata to support
   accessioning, appraisal, and processing
The Sleuth Kit
•Open source C library, command line tools, and GUI
  application (Autopsy) for forensic analysis

•Supports analysis of FAT, NTFS, ISO9660, HFS+, Ext2/3,
  UFS1/2

•Splits tools into layers: volume system, file system, file
  name, metadata, data unit (“block”)

•Additional utilities to sort and post-process extracted
  metadata
Digital Forensics XML
•Representation in XML of structured forensic information
  developed by Simson Garfinkel

•Produced by tools including fiwalk (Garfinkel 2012),
  which uses Sleuth Kit for volume, file system, file, and
  application-level analysis

•Easily extensible (local plugin development as focus)
•Straight forward to process
Results
Disk Images
      •Acquired 1,039 disk images from across 69 accessions at
        Manuscripts and Archives
500
           422

375
                      312


250
                                    185


125                                          94

                                                            26
  0
             CDs     3.5” floppies    DVDs   5.25” floppies        Zip disks
Metadata Extraction
      •Ran metadata extraction on 812 images
                                  File Systems within Images
400         386



300
                            246

200
                                             155


100

                                                               14          11
  0
                  ISO9660         FAT12         Unidentified         HFS+        FAT16
Metadata Extraction
•Ran enhanced metadata extraction on 619 images (users
  plugins for fiwalk developed during research)

•Performed analysis on 49,724 files within images
•Successfully identified 43,729 files (147 unique file types)
  against PRONOM format registry

•Identified 9 files as containing virus signatures (2 unique
  virus signatures)
image/tiff!
                                                    Identified MIME Types by OPF FIDO (36320 total matches)!                                                                             image/jpeg!
14000!                                                                                                                                                                                  application/msword!
                                                                                                                                                                                        text/html!
                                                                                                                                                                                        application/pdf!
                                                                                                                                                                                        image/gif!
    image/tiff, 12429!
                                                                                                                                                                                        image/bmp!
                                                                                                                                                                                        image/x-pict!
12000!
                                                                                                                                                                                        application/x-gzip!
                                                                                                                                                                                        image/vnd.dwg!
                                                                                                                                                                                        message/rfc822!
                                                                                                                                                                                        application/postscript!
                                                                                                                                                                                        application/zip!
10000!                                                                                                                                                                                  application/octet-stream!
                                                                                                                                                                                        text/plain!
                                                                                                                                                                                        video/mpeg!
                                                                                                                                                                                        application/java-archive!
         image/jpeg, 8219!                                                                                                                                                              image/x-sgi-bw!
                                                                                                                                                                                        text/xml!
 8000!
                                                                                                                                                                                        application/vnd.lotus-1-2-3!
                                                                                                                                                                                        image/png!
                                                                                                                                                                                        text/css!
                                                                                                                                                                                        video/x-msvideo!
                                                                                                                                                                                        video/quicktime!
 6000!                                                                                                                                                                                  application/rtf!
                                                                                                                                                                                        application/xml!
         application/msword, 5008!
                                                                                                                                                                                        audio/mpeg!
                                                                                                                                                                                        application/vnd.ms-powerpoint!
                                                                                                                                                                                        application/javascript!
 4000!                                                                                                                                                                                  image/vnd.dxf!
                 text/html, 3558!
                                                                                                                                                                                        audio/x-wav!
                  application/pdf, 3111!                                                                                                                                                audio/prs.sid!
                                                                                                                                                                                        application/vnd.ms-excel!
                                                                                                                                                                                        application/inf!
                                                                                                                                                                                        video/x-ms-wmv!
 2000!
                                                                                                                                                                                        audio/x-ms-wma!
                                                                                                                                                                                        application/xhtml+xml!
                              756!                                                                                                                                                      application/x-endnote-refer!
                                 499!485!480!395!                                                                                                                                       image/vnd.microsoft.icon!
                                                280!208!
                                                       152!105!102!100! 89! 71! 58! 40!
                                                                                        23! 22! 17! 17! 15! 11! 10! 10! 10! 6!   6!   4!   4!   4!   3!   3!   3!   3!   2!   1!   1!   application/x-shockwave-flash!
    0!                                                                                                                                                                                  application/x-director!
                                                                                         1!
Software Development
•Created Fiwalk plugins to perform additional analysis
  and evaluation of files/bitstreams within disk images

•Virus identification plugin using ClamAV/pyclamd
•File format identification against PRONOM format
  registry using Open Planets Foundation’s FIDO

•Code (including additional plugins) available online:
  https://github.com/anarchivist/fiwalk-dgi/
Gumshoe
• Prototype based on Blacklight (Ruby on Rails + Solr)
• Indexing code works with fiwalk output or directly from a
   disk image

• Populates Solr index with all file-level metadata from
   fiwalk and, optionally, text strings extracted from files

• Provides searching, sorting and faceting based on
   metadata extracted from filesystems and files

• Code at http://github.com/anarchivist/gumshoe
Using and Developing with Open Source Digital Forensics Software in Digital Archives Programs
Advantages
•Faster (and more forensically sound) to extract metadata
  once rather than having to keep processing an image

•Possibility of developing better assessments during
  accessioning process (significance of directory structure,
  accuracy of timestamps)

•Integrating additional extraction processes and building
  supplemental tools is simple

•Performance of tools correlates to complexity of analysis
Limitations
• Use of tools limited to specific types of file systems
• Additional software (particularly to document imaging
  process) requires additional integration and data
  normalization

• DFXML is not (currently) a metadata format common
  within domains of archives/libraries and requires an
  domain-specific application profile

• Extracted metadata maybe harder to repurpose for
  descriptive purposes based on level of granularity
Work in Progress
• BitCurator project under development; early release
   available for testing: http://wiki.bitcurator.net

• The Sleuth Kit and related tools under continuing
   development (Autopsy, fiwalk, etc.): http://sleuthkit.org

• Additional testing, development integration under work
   at Yale and NYPL
Thanks!
   Mark A. Matienzo
mark.matienzo@yale.edu
  http://matienzo.org
      @anarchivist
References
•   Abrams, S., et al. (2011). “Curation Micro-Services: A Pipeline Metaphor for Repositories.” Journal of Digital Information 12(2). http://journals.tdl.org/
    jodi/article/view/1605

•   AIMS Work Group (2012). AIMS Born-Digital Collections: An Inter-Institutional Model for Stewardship. http://www2.lib.virginia.edu/aims/whitepaper/

•   Carrier, B. (2003). “Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers.” International Journal of Digital Evidence 1(4).

•   Carrier, B. (2005). File System Forensic Analysis. Boston and London: Addison Wesley.

•   Daigle, B.J. (2012). “The Digital Transformation of Special Collections.” Journal of Library Administration 52(3-4), 244-264.

•   Duranti, L. (2009). “From Digital Diplomatics to Digital Records Forensics.” Archivaria 68, 39-66.

•   Garfinkel, S. (2012). “Digital Forensics XML and the DFXML Toolset.” Digital Investigation 8, 161-174.

•   John, J.L. (2008). “Adapting Existing Technologies for Digitally Archiving Personal Lives: Digital Forensics, Ancestral Computing, and Evolutionary
    Perspectives and Tools.” Presented at iPRES 2008. http://www.bl.uk/ipres2008/presentations_day1/09_John.pdf

•   Kirschenbaum, M.G., et al. (2010). Digital Forensics and Born-Digital Content in Cultural Heritage Collections. Washington: Council on Library and
    Information Resources.

•   Lee, C.A., et al. (2012). “BitCurator: Tools and Techniques for Digital Forensics in Collecting Institutions.” D-Lib Magazine 18(5/6).

•   UC Curation Center/California Digital Library (2019). “UC3 Curation Foundations.” Revision 0.13. https://confluence.ucop.edu/download/attachments/
    13860983/UC3-Foundations-latest.pdf

•   Woods, K. and Brown, G. (2009). “From Imaging to Access: Effective Preservation of Legacy Removable Media.” In Archiving 2009. Springfield, VA:
    Society for Imaging Science and Technology.

•   Woods, K., Lee, C.A., and Garfinkel, S. (2011). “Extending Digital Repository Architectures to Support Disk Image Preservation and Access.” In JCDL ’11.

•   Xie, S.L. (2011). “Building Foundations for Digital Records Forensics: A Comparative Study of the Concept of Reproduction in Digital Records Management
    and Digital Forensics.” American Archivist 74(2), 576-599.
Sleuth Kit example
$ fsstat -t 2004-M-088.0007.dd
fat12
Sleuth Kit example
$ fsstat -t 2004-M-088.0007.dd
fat12

$ fls -a -m A: 2004-M-088.0007.dd
0|A:/DRURY|3|r/rrwxrwxrwx|0|0|1281|1284955200|871048826|0|0
0|A:/BEARD.897|4|r/rrwxrwxrwx|0|0|2392|1284955200|871054862|0|0
0|A:/_P}WP{2 (deleted)|5|r/rrwxrwxrwx|0|0|2392|0|871054894|0|0
0|A:/$MBR|45779|v/v---------|0|0|512|0|0|0|0
0|A:/$FAT1|45780|v/v---------|0|0|4608|0|0|0|0
0|A:/$FAT2|45781|v/v---------|0|0|4608|0|0|0|0
0|A:/$OrphanFiles|45782|d/d---------|0|0|0|0|0|0|0
Sleuth Kit example
$ fsstat -t 2004-M-088.0007.dd
fat12

$ fls -a -m A: 2004-M-088.0007.dd
0|A:/DRURY|3|r/rrwxrwxrwx|0|0|1281|1284955200|871048826|0|0
0|A:/BEARD.897|4|r/rrwxrwxrwx|0|0|2392|1284955200|871054862|0|0
0|A:/_P}WP{2 (deleted)|5|r/rrwxrwxrwx|0|0|2392|0|871054894|0|0
0|A:/$MBR|45779|v/v---------|0|0|512|0|0|0|0
0|A:/$FAT1|45780|v/v---------|0|0|4608|0|0|0|0
0|A:/$FAT2|45781|v/v---------|0|0|4608|0|0|0|0
0|A:/$OrphanFiles|45782|d/d---------|0|0|0|0|0|0|0

$ icat 2004-M-088.0007.dd 4 | file -
/dev/stdin: (Corel/WP)
Sleuth Kit example
$ fsstat -t 2004-M-088.0007.dd
fat12

$ fls -a -m A: 2004-M-088.0007.dd
0|A:/DRURY|3|r/rrwxrwxrwx|0|0|1281|1284955200|871048826|0|0
0|A:/BEARD.897|4|r/rrwxrwxrwx|0|0|2392|1284955200|871054862|0|0
0|A:/_P}WP{2 (deleted)|5|r/rrwxrwxrwx|0|0|2392|0|871054894|0|0
0|A:/$MBR|45779|v/v---------|0|0|512|0|0|0|0
0|A:/$FAT1|45780|v/v---------|0|0|4608|0|0|0|0
0|A:/$FAT2|45781|v/v---------|0|0|4608|0|0|0|0
0|A:/$OrphanFiles|45782|d/d---------|0|0|0|0|0|0|0

$ icat 2004-M-088.0007.dd 4 | file -
/dev/stdin: (Corel/WP)

$ icat 2004-M-088.0007.dd 4 | strings | head -n 6
WPCN
Courier 10cpi
HP LaserJet+
HPLASERJ.PRS
Cowles Foundation for Research in Economics
Yale University
Sleuth Kit example
$ fsstat -t 2004-M-088.0007.dd
fat12

$ fls -a -m A: 2004-M-088.0007.dd
0|A:/DRURY|3|r/rrwxrwxrwx|0|0|1281|1284955200|871048826|0|0
0|A:/BEARD.897|4|r/rrwxrwxrwx|0|0|2392|1284955200|871054862|0|0
0|A:/_P}WP{2 (deleted)|5|r/rrwxrwxrwx|0|0|2392|0|871054894|0|0
0|A:/$MBR|45779|v/v---------|0|0|512|0|0|0|0
0|A:/$FAT1|45780|v/v---------|0|0|4608|0|0|0|0
0|A:/$FAT2|45781|v/v---------|0|0|4608|0|0|0|0
0|A:/$OrphanFiles|45782|d/d---------|0|0|0|0|0|0|0

$ icat 2004-M-088.0007.dd 4 | file -
/dev/stdin: (Corel/WP)

$ icat 2004-M-088.0007.dd 4 | strings | head -n 6
WPCN
Courier 10cpi
HP LaserJet+
HPLASERJ.PRS
Cowles Foundation for Research in Economics
Yale University

$ tsk_recover -a 2004-M-088.0007.dd /tmp
Files Recovered: 2
Sample DFXML Output
<?xml version='1.0' encoding='UTF-8'?>
<dfxml version='1.0'>
  <metadata
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
  xmlns:dc='http://purl.org/dc/elements/1.1/'>
    <dc:type>Disk Image</dc:type>
  </metadata>
  <creator version='1.0'>
    <!-- provenance information re: extraction - software used; operating system -->
  </creator>
  <source>
    <image_filename>2004-M-088.0018.dd</image_filename>
  </source>
  <volume offset='0'><!-- partitions within each disk image -->
      <fileobject><!-- files within each partition --></fileobject>
  </volume>
  <runstats><!-- performance and other statistics --></runstats>
</dfxml>
Sample DFXML Output
<fileobject>
  <filename>_ublist1.wpd</filename>
  <partition>1</partition>
  <id>1</id>
  <name_type>r</name_type>
  <filesize>202152</filesize>
  <unalloc>1</unalloc>
  <used>1</used>
  <inode>3</inode>
  <meta_type>1</meta_type>
  <mode>511</mode>
  <nlink>0</nlink>
  <uid>0</uid>
  <gid>0</gid>
  <mtime>2001-02-22T22:30:52Z</mtime>
  <atime>2001-02-22T05:00:00Z</atime>
  <crtime>2001-02-22T22:31:54Z</crtime>
  <libmagic>(Corel/WP)</libmagic>
  <byte_runs>
   <byte_run file_offset='0' fs_offset='16896' img_offset='16896' len='512'/>
  </byte_runs>
  <hashdigest type='md5'>d7bc22242c0a88fd8b68712980d5ab28</hashdigest>
  <hashdigest type='sha1'>64bf2bdf82e33fcda50158804483ac611e753db5</hashdigest>
</fileobject>

More Related Content

What's hot

NCompass Live: Digital Preservation, Part 2: Storage and Protection
NCompass Live: Digital Preservation, Part 2: Storage and ProtectionNCompass Live: Digital Preservation, Part 2: Storage and Protection
NCompass Live: Digital Preservation, Part 2: Storage and ProtectionNebraska Library Commission
 
Needs for Data Management & Citation Throughout the Information Lifecycle
Needs for Data Management & Citation Throughout  the Information LifecycleNeeds for Data Management & Citation Throughout  the Information Lifecycle
Needs for Data Management & Citation Throughout the Information LifecycleMicah Altman
 
Data Management for Education Research
Data Management for Education Research Data Management for Education Research
Data Management for Education Research Rebekah Cummings
 
PRESERVATION Web archiving
PRESERVATION  Web archivingPRESERVATION  Web archiving
PRESERVATION Web archivingEssam Obaid
 
e-Science, Research Data and Libaries
e-Science, Research Data and Libariese-Science, Research Data and Libaries
e-Science, Research Data and LibariesRob Grim
 
Eudat user forum-london-11march2013-biovel-v3
Eudat user forum-london-11march2013-biovel-v3Eudat user forum-london-11march2013-biovel-v3
Eudat user forum-london-11march2013-biovel-v3Alex Hardisty
 
Bit Level Preservation
Bit Level PreservationBit Level Preservation
Bit Level PreservationMicah Altman
 
RDAP13 Mark Leggott: Stewarding research data using the Islandora framework
RDAP13 Mark Leggott: Stewarding research data using the Islandora frameworkRDAP13 Mark Leggott: Stewarding research data using the Islandora framework
RDAP13 Mark Leggott: Stewarding research data using the Islandora frameworkASIS&T
 
KeepIt Course 4: Putting storage, format management and preservation planning...
KeepIt Course 4: Putting storage, format management and preservation planning...KeepIt Course 4: Putting storage, format management and preservation planning...
KeepIt Course 4: Putting storage, format management and preservation planning...JISC KeepIt project
 
e-Services to Keep Your Digital Files Current
e-Services to Keep Your Digital Files Currente-Services to Keep Your Digital Files Current
e-Services to Keep Your Digital Files Currentpbajcsy
 

What's hot (14)

NCompass Live: Digital Preservation, Part 2: Storage and Protection
NCompass Live: Digital Preservation, Part 2: Storage and ProtectionNCompass Live: Digital Preservation, Part 2: Storage and Protection
NCompass Live: Digital Preservation, Part 2: Storage and Protection
 
Needs for Data Management & Citation Throughout the Information Lifecycle
Needs for Data Management & Citation Throughout  the Information LifecycleNeeds for Data Management & Citation Throughout  the Information Lifecycle
Needs for Data Management & Citation Throughout the Information Lifecycle
 
Metadata Workshop
Metadata WorkshopMetadata Workshop
Metadata Workshop
 
Data Management for Education Research
Data Management for Education Research Data Management for Education Research
Data Management for Education Research
 
PRESERVATION Web archiving
PRESERVATION  Web archivingPRESERVATION  Web archiving
PRESERVATION Web archiving
 
NISO Forum, Denver, Sept. 24, 2012: DataCite and Campus Data Services
NISO Forum, Denver, Sept. 24, 2012: DataCite and Campus Data ServicesNISO Forum, Denver, Sept. 24, 2012: DataCite and Campus Data Services
NISO Forum, Denver, Sept. 24, 2012: DataCite and Campus Data Services
 
e-Science, Research Data and Libaries
e-Science, Research Data and Libariese-Science, Research Data and Libaries
e-Science, Research Data and Libaries
 
Eudat user forum-london-11march2013-biovel-v3
Eudat user forum-london-11march2013-biovel-v3Eudat user forum-london-11march2013-biovel-v3
Eudat user forum-london-11march2013-biovel-v3
 
Bit Level Preservation
Bit Level PreservationBit Level Preservation
Bit Level Preservation
 
JeromeDL Tutorial
JeromeDL TutorialJeromeDL Tutorial
JeromeDL Tutorial
 
Dig c curr
Dig c currDig c curr
Dig c curr
 
RDAP13 Mark Leggott: Stewarding research data using the Islandora framework
RDAP13 Mark Leggott: Stewarding research data using the Islandora frameworkRDAP13 Mark Leggott: Stewarding research data using the Islandora framework
RDAP13 Mark Leggott: Stewarding research data using the Islandora framework
 
KeepIt Course 4: Putting storage, format management and preservation planning...
KeepIt Course 4: Putting storage, format management and preservation planning...KeepIt Course 4: Putting storage, format management and preservation planning...
KeepIt Course 4: Putting storage, format management and preservation planning...
 
e-Services to Keep Your Digital Files Current
e-Services to Keep Your Digital Files Currente-Services to Keep Your Digital Files Current
e-Services to Keep Your Digital Files Current
 

Viewers also liked

Become an Internet Sleuth!
Become an Internet Sleuth!Become an Internet Sleuth!
Become an Internet Sleuth!Nearpod
 
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics PlatformAutopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics PlatformBasis Technology
 
July132000
July132000July132000
July132000CTIN
 
Facebook Forensics Toolkit(FFT)
Facebook Forensics Toolkit(FFT)Facebook Forensics Toolkit(FFT)
Facebook Forensics Toolkit(FFT)Shuvo Sarker
 
Social Media for Investigations Tools
Social Media for Investigations ToolsSocial Media for Investigations Tools
Social Media for Investigations ToolsMandy Jenkins
 
WinFE: The (Almost) Perfect Triage Tool
WinFE: The (Almost) Perfect Triage ToolWinFE: The (Almost) Perfect Triage Tool
WinFE: The (Almost) Perfect Triage ToolBrent Muir
 
Mounting virtual hard drives
Mounting virtual hard drivesMounting virtual hard drives
Mounting virtual hard drivesCTIN
 
Windows nt istallation
Windows nt istallationWindows nt istallation
Windows nt istallationHarleen Johal
 
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian CarrierOSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian CarrierBasis Technology
 
Windows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-publicWindows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-publicCTIN
 
Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3CTIN
 
Windows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary ArtefactsWindows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary ArtefactsBrent Muir
 
2010 2013 sandro suffert memory forensics introdutory work shop - public
2010 2013 sandro suffert memory forensics introdutory work shop - public2010 2013 sandro suffert memory forensics introdutory work shop - public
2010 2013 sandro suffert memory forensics introdutory work shop - publicSandro Suffert
 
Installation of Joomla on Windows XP
Installation of Joomla on Windows XPInstallation of Joomla on Windows XP
Installation of Joomla on Windows XPRupesh Kumar
 
Forensics of a Windows System
Forensics of a Windows SystemForensics of a Windows System
Forensics of a Windows SystemConferencias FIST
 
Vista Forensics
Vista ForensicsVista Forensics
Vista ForensicsCTIN
 

Viewers also liked (20)

Become an Internet Sleuth!
Become an Internet Sleuth!Become an Internet Sleuth!
Become an Internet Sleuth!
 
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics PlatformAutopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
 
July132000
July132000July132000
July132000
 
Facebook Forensics Toolkit(FFT)
Facebook Forensics Toolkit(FFT)Facebook Forensics Toolkit(FFT)
Facebook Forensics Toolkit(FFT)
 
Capturing forensics image
Capturing forensics imageCapturing forensics image
Capturing forensics image
 
Social Media for Investigations Tools
Social Media for Investigations ToolsSocial Media for Investigations Tools
Social Media for Investigations Tools
 
WinFE: The (Almost) Perfect Triage Tool
WinFE: The (Almost) Perfect Triage ToolWinFE: The (Almost) Perfect Triage Tool
WinFE: The (Almost) Perfect Triage Tool
 
Mounting virtual hard drives
Mounting virtual hard drivesMounting virtual hard drives
Mounting virtual hard drives
 
NTFS Forensics
NTFS Forensics NTFS Forensics
NTFS Forensics
 
Windows nt istallation
Windows nt istallationWindows nt istallation
Windows nt istallation
 
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian CarrierOSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
 
Windows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-publicWindows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-public
 
Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3
 
Windows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary ArtefactsWindows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary Artefacts
 
2010 2013 sandro suffert memory forensics introdutory work shop - public
2010 2013 sandro suffert memory forensics introdutory work shop - public2010 2013 sandro suffert memory forensics introdutory work shop - public
2010 2013 sandro suffert memory forensics introdutory work shop - public
 
Windows forensic artifacts
Windows forensic artifactsWindows forensic artifacts
Windows forensic artifacts
 
File system
File systemFile system
File system
 
Installation of Joomla on Windows XP
Installation of Joomla on Windows XPInstallation of Joomla on Windows XP
Installation of Joomla on Windows XP
 
Forensics of a Windows System
Forensics of a Windows SystemForensics of a Windows System
Forensics of a Windows System
 
Vista Forensics
Vista ForensicsVista Forensics
Vista Forensics
 

Similar to Using and Developing with Open Source Digital Forensics Software in Digital Archives Programs

SCA Accessioning Born-Digital Materials Workshop, Nov. 8, 2012
SCA Accessioning Born-Digital Materials Workshop, Nov. 8, 2012SCA Accessioning Born-Digital Materials Workshop, Nov. 8, 2012
SCA Accessioning Born-Digital Materials Workshop, Nov. 8, 2012peterchanws
 
Accessioning Born-Digital Materials
Accessioning Born-Digital MaterialsAccessioning Born-Digital Materials
Accessioning Born-Digital Materialspeterchanws
 
Technologies For Appraising and Managing Electronic Records
Technologies For Appraising and Managing Electronic RecordsTechnologies For Appraising and Managing Electronic Records
Technologies For Appraising and Managing Electronic Recordspbajcsy
 
University of Bath Research Data Management training for researchers
University of Bath Research Data Management training for researchersUniversity of Bath Research Data Management training for researchers
University of Bath Research Data Management training for researchersJez Cope
 
Introduction of file based workflows 111004 vfinal
Introduction of file based workflows 111004 vfinalIntroduction of file based workflows 111004 vfinal
Introduction of file based workflows 111004 vfinalMarie Josée (MJ) Drouin
 
Tackling File Characterization and Analysis in Archivematica
Tackling File Characterization and Analysis in ArchivematicaTackling File Characterization and Analysis in Archivematica
Tackling File Characterization and Analysis in ArchivematicaCourtney Mumma
 
Cochrane von Suchodoletz File Creation, Rendering and Formats
Cochrane von Suchodoletz File Creation, Rendering and FormatsCochrane von Suchodoletz File Creation, Rendering and Formats
Cochrane von Suchodoletz File Creation, Rendering and FormatsFuture Perfect 2012
 
Research Data Management: What is it and why is the Library & Archives Servic...
Research Data Management: What is it and why is the Library & Archives Servic...Research Data Management: What is it and why is the Library & Archives Servic...
Research Data Management: What is it and why is the Library & Archives Servic...GarethKnight
 
2009 PLANETS Vienna - MIXED migration to XML
2009 PLANETS Vienna - MIXED migration to XML2009 PLANETS Vienna - MIXED migration to XML
2009 PLANETS Vienna - MIXED migration to XMLDirk Roorda
 
Systems, processes & how we stop the wheels falling off
Systems, processes & how we stop the wheels falling offSystems, processes & how we stop the wheels falling off
Systems, processes & how we stop the wheels falling offWellcome Library
 
Analytics with unified file and object
Analytics with unified file and object Analytics with unified file and object
Analytics with unified file and object Sandeep Patil
 
Watching the Detectives: Using digital forensics techniques to investigate th...
Watching the Detectives: Using digital forensics techniques to investigate th...Watching the Detectives: Using digital forensics techniques to investigate th...
Watching the Detectives: Using digital forensics techniques to investigate th...GarethKnight
 
Computer forensics libin
Computer forensics   libinComputer forensics   libin
Computer forensics libinlibinp
 
A little simple explanation abut Digital imaging
A little simple explanation abut Digital imagingA little simple explanation abut Digital imaging
A little simple explanation abut Digital imagingaechaa93
 
Workshop 1 revised
Workshop 1 revisedWorkshop 1 revised
Workshop 1 revisedpeterchanws
 

Similar to Using and Developing with Open Source Digital Forensics Software in Digital Archives Programs (20)

SCA Accessioning Born-Digital Materials Workshop, Nov. 8, 2012
SCA Accessioning Born-Digital Materials Workshop, Nov. 8, 2012SCA Accessioning Born-Digital Materials Workshop, Nov. 8, 2012
SCA Accessioning Born-Digital Materials Workshop, Nov. 8, 2012
 
Accessioning Born-Digital Materials
Accessioning Born-Digital MaterialsAccessioning Born-Digital Materials
Accessioning Born-Digital Materials
 
Electronic Records
Electronic RecordsElectronic Records
Electronic Records
 
Technologies For Appraising and Managing Electronic Records
Technologies For Appraising and Managing Electronic RecordsTechnologies For Appraising and Managing Electronic Records
Technologies For Appraising and Managing Electronic Records
 
University of Bath Research Data Management training for researchers
University of Bath Research Data Management training for researchersUniversity of Bath Research Data Management training for researchers
University of Bath Research Data Management training for researchers
 
Digitisation Overview
Digitisation OverviewDigitisation Overview
Digitisation Overview
 
Introduction of file based workflows 111004 vfinal
Introduction of file based workflows 111004 vfinalIntroduction of file based workflows 111004 vfinal
Introduction of file based workflows 111004 vfinal
 
I say emulate
I say emulateI say emulate
I say emulate
 
Tackling File Characterization and Analysis in Archivematica
Tackling File Characterization and Analysis in ArchivematicaTackling File Characterization and Analysis in Archivematica
Tackling File Characterization and Analysis in Archivematica
 
Digital Library Software
Digital Library SoftwareDigital Library Software
Digital Library Software
 
Cochrane von Suchodoletz File Creation, Rendering and Formats
Cochrane von Suchodoletz File Creation, Rendering and FormatsCochrane von Suchodoletz File Creation, Rendering and Formats
Cochrane von Suchodoletz File Creation, Rendering and Formats
 
Research Data Management: What is it and why is the Library & Archives Servic...
Research Data Management: What is it and why is the Library & Archives Servic...Research Data Management: What is it and why is the Library & Archives Servic...
Research Data Management: What is it and why is the Library & Archives Servic...
 
2009 PLANETS Vienna - MIXED migration to XML
2009 PLANETS Vienna - MIXED migration to XML2009 PLANETS Vienna - MIXED migration to XML
2009 PLANETS Vienna - MIXED migration to XML
 
Systems, processes & how we stop the wheels falling off
Systems, processes & how we stop the wheels falling offSystems, processes & how we stop the wheels falling off
Systems, processes & how we stop the wheels falling off
 
Analytics with unified file and object
Analytics with unified file and object Analytics with unified file and object
Analytics with unified file and object
 
Watching the Detectives: Using digital forensics techniques to investigate th...
Watching the Detectives: Using digital forensics techniques to investigate th...Watching the Detectives: Using digital forensics techniques to investigate th...
Watching the Detectives: Using digital forensics techniques to investigate th...
 
Computer forensics libin
Computer forensics   libinComputer forensics   libin
Computer forensics libin
 
A little simple explanation abut Digital imaging
A little simple explanation abut Digital imagingA little simple explanation abut Digital imaging
A little simple explanation abut Digital imaging
 
Workshop 1 revised
Workshop 1 revisedWorkshop 1 revised
Workshop 1 revised
 
Batch Document Processing with ImageRamp Batch
Batch Document Processing with ImageRamp BatchBatch Document Processing with ImageRamp Batch
Batch Document Processing with ImageRamp Batch
 

More from Mark Matienzo

To Hell With Good Intentions: Linked Data and the Power to Name
To Hell With Good Intentions: Linked Data and the Power to NameTo Hell With Good Intentions: Linked Data and the Power to Name
To Hell With Good Intentions: Linked Data and the Power to NameMark Matienzo
 
Linked Data and the Semantic Web in the Archival Context
Linked Data and the Semantic Web in the Archival ContextLinked Data and the Semantic Web in the Archival Context
Linked Data and the Semantic Web in the Archival ContextMark Matienzo
 
Archival Sensemaking: Personal Digital Archiving as an Iteration
Archival Sensemaking: Personal Digital Archiving as an IterationArchival Sensemaking: Personal Digital Archiving as an Iteration
Archival Sensemaking: Personal Digital Archiving as an IterationMark Matienzo
 
Findability in the Flow: Discovery through Linking
Findability in the Flow: Discovery through LinkingFindability in the Flow: Discovery through Linking
Findability in the Flow: Discovery through LinkingMark Matienzo
 
Learning to Take, Learning to Give: Linking as Repurposing Metadata
Learning to Take, Learning to Give: Linking as Repurposing MetadataLearning to Take, Learning to Give: Linking as Repurposing Metadata
Learning to Take, Learning to Give: Linking as Repurposing MetadataMark Matienzo
 
EAD and MARC sitting in a tree: D-R-U-P-A-L
EAD and MARC sitting in a tree: D-R-U-P-A-LEAD and MARC sitting in a tree: D-R-U-P-A-L
EAD and MARC sitting in a tree: D-R-U-P-A-LMark Matienzo
 
Online Presence and Participation
Online Presence and ParticipationOnline Presence and Participation
Online Presence and ParticipationMark Matienzo
 
Linked Data and Archival Description: Confluences, Contingencies, and Conflicts
Linked Data and Archival Description: Confluences, Contingencies, and ConflictsLinked Data and Archival Description: Confluences, Contingencies, and Conflicts
Linked Data and Archival Description: Confluences, Contingencies, and ConflictsMark Matienzo
 
Cheeseburgers With Everything: Context, Content, and Connections in Archival ...
Cheeseburgers With Everything: Context, Content, and Connections in Archival ...Cheeseburgers With Everything: Context, Content, and Connections in Archival ...
Cheeseburgers With Everything: Context, Content, and Connections in Archival ...Mark Matienzo
 
Archives & the Semantic Web
Archives & the Semantic WebArchives & the Semantic Web
Archives & the Semantic WebMark Matienzo
 
How I failed to present on using DVCS to control archival metadata
How I failed to present on using DVCS to control archival metadataHow I failed to present on using DVCS to control archival metadata
How I failed to present on using DVCS to control archival metadataMark Matienzo
 

More from Mark Matienzo (11)

To Hell With Good Intentions: Linked Data and the Power to Name
To Hell With Good Intentions: Linked Data and the Power to NameTo Hell With Good Intentions: Linked Data and the Power to Name
To Hell With Good Intentions: Linked Data and the Power to Name
 
Linked Data and the Semantic Web in the Archival Context
Linked Data and the Semantic Web in the Archival ContextLinked Data and the Semantic Web in the Archival Context
Linked Data and the Semantic Web in the Archival Context
 
Archival Sensemaking: Personal Digital Archiving as an Iteration
Archival Sensemaking: Personal Digital Archiving as an IterationArchival Sensemaking: Personal Digital Archiving as an Iteration
Archival Sensemaking: Personal Digital Archiving as an Iteration
 
Findability in the Flow: Discovery through Linking
Findability in the Flow: Discovery through LinkingFindability in the Flow: Discovery through Linking
Findability in the Flow: Discovery through Linking
 
Learning to Take, Learning to Give: Linking as Repurposing Metadata
Learning to Take, Learning to Give: Linking as Repurposing MetadataLearning to Take, Learning to Give: Linking as Repurposing Metadata
Learning to Take, Learning to Give: Linking as Repurposing Metadata
 
EAD and MARC sitting in a tree: D-R-U-P-A-L
EAD and MARC sitting in a tree: D-R-U-P-A-LEAD and MARC sitting in a tree: D-R-U-P-A-L
EAD and MARC sitting in a tree: D-R-U-P-A-L
 
Online Presence and Participation
Online Presence and ParticipationOnline Presence and Participation
Online Presence and Participation
 
Linked Data and Archival Description: Confluences, Contingencies, and Conflicts
Linked Data and Archival Description: Confluences, Contingencies, and ConflictsLinked Data and Archival Description: Confluences, Contingencies, and Conflicts
Linked Data and Archival Description: Confluences, Contingencies, and Conflicts
 
Cheeseburgers With Everything: Context, Content, and Connections in Archival ...
Cheeseburgers With Everything: Context, Content, and Connections in Archival ...Cheeseburgers With Everything: Context, Content, and Connections in Archival ...
Cheeseburgers With Everything: Context, Content, and Connections in Archival ...
 
Archives & the Semantic Web
Archives & the Semantic WebArchives & the Semantic Web
Archives & the Semantic Web
 
How I failed to present on using DVCS to control archival metadata
How I failed to present on using DVCS to control archival metadataHow I failed to present on using DVCS to control archival metadata
How I failed to present on using DVCS to control archival metadata
 

Recently uploaded

Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfinfogdgmi
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfDaniel Santiago Silva Capera
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureEric D. Schabell
 
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfJamie (Taka) Wang
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024D Cloud Solutions
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopBachir Benyammi
 
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAshyamraj55
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...DianaGray10
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsSeth Reyes
 
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsIgniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsSafe Software
 
Building AI-Driven Apps Using Semantic Kernel.pptx
Building AI-Driven Apps Using Semantic Kernel.pptxBuilding AI-Driven Apps Using Semantic Kernel.pptx
Building AI-Driven Apps Using Semantic Kernel.pptxUdaiappa Ramachandran
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Commit University
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1DianaGray10
 
Bird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemBird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemAsko Soukka
 
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online CollaborationCOMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online Collaborationbruanjhuli
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Adtran
 

Recently uploaded (20)

Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdf
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability Adventure
 
20150722 - AGV
20150722 - AGV20150722 - AGV
20150722 - AGV
 
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 Workshop
 
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
 
20230104 - machine vision
20230104 - machine vision20230104 - machine vision
20230104 - machine vision
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and Hazards
 
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsIgniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
 
Building AI-Driven Apps Using Semantic Kernel.pptx
Building AI-Driven Apps Using Semantic Kernel.pptxBuilding AI-Driven Apps Using Semantic Kernel.pptx
Building AI-Driven Apps Using Semantic Kernel.pptx
 
201610817 - edge part1
201610817 - edge part1201610817 - edge part1
201610817 - edge part1
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1
 
Bird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemBird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystem
 
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online CollaborationCOMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™
 

Using and Developing with Open Source Digital Forensics Software in Digital Archives Programs

  • 1. Using and Developing with Open Source Digital Forensics Software in Digital Archives Programs Mark A. Matienzo Manuscripts and Archives, Yale University Library 2012 SAA Research Forum August 7, 2012
  • 2. Is open source digital forensics software extensible enough and well-suited to support work in the archival domain?
  • 3. Digital forensics in the archival domain • Increasing use of digital forensics tools/methodologies within the context of digital archives programs (Kirschenbaum et al. 2010) • Technology-focused work (John 2008; Woods & Brown 2009; AIMS Work Group 2012) • Methodology-focused work (Duranti 2009; Xie 2011)
  • 4. Significant barriers to use of digital forensics in archives • Cost (Kirschenbaum et al. 2010; Daigle 2012) • Complexity (Kirschenbaum et al. 2010; Daigle 2012) • Digital archives as an emerging market for forensics
  • 5. Potential of open source digital forensics software • Requires additional tool development work to be useful for archivists (Kirschenbaum et al. 2010) • Requires additional integration work (Lee et al. 2012)
  • 6. Institutional Context • Focus on implementation of and development with open source digital forensics software at Yale University Library • Work must support accessioning, processing, and management of born-digital archival material • Primary focus are records received on legacy media
  • 7. Design Principles • Use and develop with open source digital forensics software to support accessioning, arrangement, and description of born-digital archival records • Focus on first two phases (preservation and searching) of Carrier’s (2005) model of digital investigation process • Curation micro-services (Abrams, et al. 2010) as philosophical basis to guide development and implementation • Recognition of both disk images as digital object (Woods, Lee, and Garfinkel 2011) and objects within disk images as needing management • Intention of forensic soundness, but assume much of state is lost
  • 8. Micro-services as Design Philosophy* Principles Preferences Practices • Granularity • Small and simple over • Define, decompose, large and complex recurse • Orthogonality • Minimally sufficient over • Top down design, bottom feature-laden up implementation • Parsimony • Configurable over the • Code to interfaces prescribed • Evolution • The proven over the • Sufficiency through a merely novel series of incrementally necessary steps • Outcomes over means *UC Curation Center/California Digital Library, 2010
  • 9. Workflow Start accessioning Write-protect media Verify image process Media Record identifying Extract filesystem- Disk Meta- Retrieve media characteristics of and file-level images data media as metadata metadata Transfer package Package images Assign identifiers to Ingest transfer Create image and metadata for media package ingest Media FS/File Document Disk MD MD accessioning image process End accessioning process
  • 10. Disk Image Acquisition • Requires a combination of hardware (drives/media readers, controller cards, write blockers) and software • In some cases, software depends on particular hardware • Software tested: FTK Imager (proprietary/gratis), hardware-specific solutions (FC5025 WinDIB; KryoFlux DTC/GUI; Catweasel Imagetool3) • Goal: sector image interpretable by multiple tools
  • 12. Analysis Process • Multiple levels of analysis within digital forensics based on layers of abstraction (Carrier 2003) • Conceptual linkages with metadata extraction/analysis processes with digital curation/archival domain Carrier, 2003
  • 13. Metadata Extraction • Use open source digital forensics software (Sleuth Kit, fiwalk) and other open source tools to characterize media, volume, file system, and file information • Attempt to repurpose this information as descriptive, structural, and/or technical metadata to support accessioning, appraisal, and processing
  • 14. The Sleuth Kit •Open source C library, command line tools, and GUI application (Autopsy) for forensic analysis •Supports analysis of FAT, NTFS, ISO9660, HFS+, Ext2/3, UFS1/2 •Splits tools into layers: volume system, file system, file name, metadata, data unit (“block”) •Additional utilities to sort and post-process extracted metadata
  • 15. Digital Forensics XML •Representation in XML of structured forensic information developed by Simson Garfinkel •Produced by tools including fiwalk (Garfinkel 2012), which uses Sleuth Kit for volume, file system, file, and application-level analysis •Easily extensible (local plugin development as focus) •Straight forward to process
  • 17. Disk Images •Acquired 1,039 disk images from across 69 accessions at Manuscripts and Archives 500 422 375 312 250 185 125 94 26 0 CDs 3.5” floppies DVDs 5.25” floppies Zip disks
  • 18. Metadata Extraction •Ran metadata extraction on 812 images File Systems within Images 400 386 300 246 200 155 100 14 11 0 ISO9660 FAT12 Unidentified HFS+ FAT16
  • 19. Metadata Extraction •Ran enhanced metadata extraction on 619 images (users plugins for fiwalk developed during research) •Performed analysis on 49,724 files within images •Successfully identified 43,729 files (147 unique file types) against PRONOM format registry •Identified 9 files as containing virus signatures (2 unique virus signatures)
  • 20. image/tiff! Identified MIME Types by OPF FIDO (36320 total matches)! image/jpeg! 14000! application/msword! text/html! application/pdf! image/gif! image/tiff, 12429! image/bmp! image/x-pict! 12000! application/x-gzip! image/vnd.dwg! message/rfc822! application/postscript! application/zip! 10000! application/octet-stream! text/plain! video/mpeg! application/java-archive! image/jpeg, 8219! image/x-sgi-bw! text/xml! 8000! application/vnd.lotus-1-2-3! image/png! text/css! video/x-msvideo! video/quicktime! 6000! application/rtf! application/xml! application/msword, 5008! audio/mpeg! application/vnd.ms-powerpoint! application/javascript! 4000! image/vnd.dxf! text/html, 3558! audio/x-wav! application/pdf, 3111! audio/prs.sid! application/vnd.ms-excel! application/inf! video/x-ms-wmv! 2000! audio/x-ms-wma! application/xhtml+xml! 756! application/x-endnote-refer! 499!485!480!395! image/vnd.microsoft.icon! 280!208! 152!105!102!100! 89! 71! 58! 40! 23! 22! 17! 17! 15! 11! 10! 10! 10! 6! 6! 4! 4! 4! 3! 3! 3! 3! 2! 1! 1! application/x-shockwave-flash! 0! application/x-director! 1!
  • 21. Software Development •Created Fiwalk plugins to perform additional analysis and evaluation of files/bitstreams within disk images •Virus identification plugin using ClamAV/pyclamd •File format identification against PRONOM format registry using Open Planets Foundation’s FIDO •Code (including additional plugins) available online: https://github.com/anarchivist/fiwalk-dgi/
  • 22. Gumshoe • Prototype based on Blacklight (Ruby on Rails + Solr) • Indexing code works with fiwalk output or directly from a disk image • Populates Solr index with all file-level metadata from fiwalk and, optionally, text strings extracted from files • Provides searching, sorting and faceting based on metadata extracted from filesystems and files • Code at http://github.com/anarchivist/gumshoe
  • 24. Advantages •Faster (and more forensically sound) to extract metadata once rather than having to keep processing an image •Possibility of developing better assessments during accessioning process (significance of directory structure, accuracy of timestamps) •Integrating additional extraction processes and building supplemental tools is simple •Performance of tools correlates to complexity of analysis
  • 25. Limitations • Use of tools limited to specific types of file systems • Additional software (particularly to document imaging process) requires additional integration and data normalization • DFXML is not (currently) a metadata format common within domains of archives/libraries and requires an domain-specific application profile • Extracted metadata maybe harder to repurpose for descriptive purposes based on level of granularity
  • 26. Work in Progress • BitCurator project under development; early release available for testing: http://wiki.bitcurator.net • The Sleuth Kit and related tools under continuing development (Autopsy, fiwalk, etc.): http://sleuthkit.org • Additional testing, development integration under work at Yale and NYPL
  • 27. Thanks! Mark A. Matienzo mark.matienzo@yale.edu http://matienzo.org @anarchivist
  • 28. References • Abrams, S., et al. (2011). “Curation Micro-Services: A Pipeline Metaphor for Repositories.” Journal of Digital Information 12(2). http://journals.tdl.org/ jodi/article/view/1605 • AIMS Work Group (2012). AIMS Born-Digital Collections: An Inter-Institutional Model for Stewardship. http://www2.lib.virginia.edu/aims/whitepaper/ • Carrier, B. (2003). “Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers.” International Journal of Digital Evidence 1(4). • Carrier, B. (2005). File System Forensic Analysis. Boston and London: Addison Wesley. • Daigle, B.J. (2012). “The Digital Transformation of Special Collections.” Journal of Library Administration 52(3-4), 244-264. • Duranti, L. (2009). “From Digital Diplomatics to Digital Records Forensics.” Archivaria 68, 39-66. • Garfinkel, S. (2012). “Digital Forensics XML and the DFXML Toolset.” Digital Investigation 8, 161-174. • John, J.L. (2008). “Adapting Existing Technologies for Digitally Archiving Personal Lives: Digital Forensics, Ancestral Computing, and Evolutionary Perspectives and Tools.” Presented at iPRES 2008. http://www.bl.uk/ipres2008/presentations_day1/09_John.pdf • Kirschenbaum, M.G., et al. (2010). Digital Forensics and Born-Digital Content in Cultural Heritage Collections. Washington: Council on Library and Information Resources. • Lee, C.A., et al. (2012). “BitCurator: Tools and Techniques for Digital Forensics in Collecting Institutions.” D-Lib Magazine 18(5/6). • UC Curation Center/California Digital Library (2019). “UC3 Curation Foundations.” Revision 0.13. https://confluence.ucop.edu/download/attachments/ 13860983/UC3-Foundations-latest.pdf • Woods, K. and Brown, G. (2009). “From Imaging to Access: Effective Preservation of Legacy Removable Media.” In Archiving 2009. Springfield, VA: Society for Imaging Science and Technology. • Woods, K., Lee, C.A., and Garfinkel, S. (2011). “Extending Digital Repository Architectures to Support Disk Image Preservation and Access.” In JCDL ’11. • Xie, S.L. (2011). “Building Foundations for Digital Records Forensics: A Comparative Study of the Concept of Reproduction in Digital Records Management and Digital Forensics.” American Archivist 74(2), 576-599.
  • 29. Sleuth Kit example $ fsstat -t 2004-M-088.0007.dd fat12
  • 30. Sleuth Kit example $ fsstat -t 2004-M-088.0007.dd fat12 $ fls -a -m A: 2004-M-088.0007.dd 0|A:/DRURY|3|r/rrwxrwxrwx|0|0|1281|1284955200|871048826|0|0 0|A:/BEARD.897|4|r/rrwxrwxrwx|0|0|2392|1284955200|871054862|0|0 0|A:/_P}WP{2 (deleted)|5|r/rrwxrwxrwx|0|0|2392|0|871054894|0|0 0|A:/$MBR|45779|v/v---------|0|0|512|0|0|0|0 0|A:/$FAT1|45780|v/v---------|0|0|4608|0|0|0|0 0|A:/$FAT2|45781|v/v---------|0|0|4608|0|0|0|0 0|A:/$OrphanFiles|45782|d/d---------|0|0|0|0|0|0|0
  • 31. Sleuth Kit example $ fsstat -t 2004-M-088.0007.dd fat12 $ fls -a -m A: 2004-M-088.0007.dd 0|A:/DRURY|3|r/rrwxrwxrwx|0|0|1281|1284955200|871048826|0|0 0|A:/BEARD.897|4|r/rrwxrwxrwx|0|0|2392|1284955200|871054862|0|0 0|A:/_P}WP{2 (deleted)|5|r/rrwxrwxrwx|0|0|2392|0|871054894|0|0 0|A:/$MBR|45779|v/v---------|0|0|512|0|0|0|0 0|A:/$FAT1|45780|v/v---------|0|0|4608|0|0|0|0 0|A:/$FAT2|45781|v/v---------|0|0|4608|0|0|0|0 0|A:/$OrphanFiles|45782|d/d---------|0|0|0|0|0|0|0 $ icat 2004-M-088.0007.dd 4 | file - /dev/stdin: (Corel/WP)
  • 32. Sleuth Kit example $ fsstat -t 2004-M-088.0007.dd fat12 $ fls -a -m A: 2004-M-088.0007.dd 0|A:/DRURY|3|r/rrwxrwxrwx|0|0|1281|1284955200|871048826|0|0 0|A:/BEARD.897|4|r/rrwxrwxrwx|0|0|2392|1284955200|871054862|0|0 0|A:/_P}WP{2 (deleted)|5|r/rrwxrwxrwx|0|0|2392|0|871054894|0|0 0|A:/$MBR|45779|v/v---------|0|0|512|0|0|0|0 0|A:/$FAT1|45780|v/v---------|0|0|4608|0|0|0|0 0|A:/$FAT2|45781|v/v---------|0|0|4608|0|0|0|0 0|A:/$OrphanFiles|45782|d/d---------|0|0|0|0|0|0|0 $ icat 2004-M-088.0007.dd 4 | file - /dev/stdin: (Corel/WP) $ icat 2004-M-088.0007.dd 4 | strings | head -n 6 WPCN Courier 10cpi HP LaserJet+ HPLASERJ.PRS Cowles Foundation for Research in Economics Yale University
  • 33. Sleuth Kit example $ fsstat -t 2004-M-088.0007.dd fat12 $ fls -a -m A: 2004-M-088.0007.dd 0|A:/DRURY|3|r/rrwxrwxrwx|0|0|1281|1284955200|871048826|0|0 0|A:/BEARD.897|4|r/rrwxrwxrwx|0|0|2392|1284955200|871054862|0|0 0|A:/_P}WP{2 (deleted)|5|r/rrwxrwxrwx|0|0|2392|0|871054894|0|0 0|A:/$MBR|45779|v/v---------|0|0|512|0|0|0|0 0|A:/$FAT1|45780|v/v---------|0|0|4608|0|0|0|0 0|A:/$FAT2|45781|v/v---------|0|0|4608|0|0|0|0 0|A:/$OrphanFiles|45782|d/d---------|0|0|0|0|0|0|0 $ icat 2004-M-088.0007.dd 4 | file - /dev/stdin: (Corel/WP) $ icat 2004-M-088.0007.dd 4 | strings | head -n 6 WPCN Courier 10cpi HP LaserJet+ HPLASERJ.PRS Cowles Foundation for Research in Economics Yale University $ tsk_recover -a 2004-M-088.0007.dd /tmp Files Recovered: 2
  • 34. Sample DFXML Output <?xml version='1.0' encoding='UTF-8'?> <dfxml version='1.0'> <metadata xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xmlns:dc='http://purl.org/dc/elements/1.1/'> <dc:type>Disk Image</dc:type> </metadata> <creator version='1.0'> <!-- provenance information re: extraction - software used; operating system --> </creator> <source> <image_filename>2004-M-088.0018.dd</image_filename> </source> <volume offset='0'><!-- partitions within each disk image --> <fileobject><!-- files within each partition --></fileobject> </volume> <runstats><!-- performance and other statistics --></runstats> </dfxml>
  • 35. Sample DFXML Output <fileobject> <filename>_ublist1.wpd</filename> <partition>1</partition> <id>1</id> <name_type>r</name_type> <filesize>202152</filesize> <unalloc>1</unalloc> <used>1</used> <inode>3</inode> <meta_type>1</meta_type> <mode>511</mode> <nlink>0</nlink> <uid>0</uid> <gid>0</gid> <mtime>2001-02-22T22:30:52Z</mtime> <atime>2001-02-22T05:00:00Z</atime> <crtime>2001-02-22T22:31:54Z</crtime> <libmagic>(Corel/WP)</libmagic> <byte_runs> <byte_run file_offset='0' fs_offset='16896' img_offset='16896' len='512'/> </byte_runs> <hashdigest type='md5'>d7bc22242c0a88fd8b68712980d5ab28</hashdigest> <hashdigest type='sha1'>64bf2bdf82e33fcda50158804483ac611e753db5</hashdigest> </fileobject>