±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 33166
New Yesterday: 0 Visitors: 240

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Saving the digital records

Discussion of forensic workstations, write blockers, bridges, adapters, disk duplicators, storage etc. Strictly no advertising of commercial products, please.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Saving the digital records

Post Posted: Tue Jun 13, 2017 1:39 pm

Hi!

I'm an archivist and basically deals with material stored on obsolete formats. In order to retrieve the content that obsolescence or decay , I need to use devices or digital forensic software within my institution. Just like Harvard Library, they already used writeblockers (device that ensures information only flows one way, preventing data from being overwritten).

My question are,

1. What is the most important thing that I need to consider before use the device (writeblocker) within my institution?

2. Is it appropriate to used the device (writeblocker) in small archival institution?

Really hope for any comments/opinion/suggestion from all of you.

Thanks in advance!  

NadiahAthirahAbdulRajah
Newbie
 
 
  

Re: Saving the digital records

Post Posted: Tue Jun 13, 2017 4:48 pm

First thing what is/are the source(s)?
Which specific media, bus technology, etc.

The activity you are after is not the same as forensics, they have different requirements overall, it is much more similar to data recovery.

Even in forensics the *need* to use a hardware writeblocker (as opposed to a read only Operating System or if you prefer a software writeblocker) is highly debatable, and all in all revolves around the possibility (in the rare case an issue can happen) to be able to put the blame on the hardware writeblocker manufacturer or to make things easier in court.

You are probably referring to this:
news.harvard.edu/gazet...al-record/

Heck! They are Harvard, they can afford FRED's, allow me to doubt that your institution is ready to spend several thousands dollars on a single PC's hardware.

The real issue is that you will have to deal with obsolete, possibly partially defective media, and with aging hardware, possibly gathered second or third hand after having been stored years, just as an example re-aligning heads of a 5 1/4 is a lost art, but, for a more recent example, how many zip drives experienced - before or later - the click of death?

Before being preoccupied by the need to use a hardware writeblocker (and finding a non SATA one may be in itself an issue nowadays, presuming you will have floppies and similar media, but also IDE and SCSI disks) I would rather study some basics of data recovery (appropriate for the media you need to image) and set up (and get familiar with) a read only OS (that needs of course the appropriate drivers for the specific hardware, so you may need to setup "old" machines with "old" OSes.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Saving the digital records

Post Posted: Wed Jun 14, 2017 2:13 pm

Thanks jaclaz for replying

So as I can see here, for my situation, it more like data recovery and not the same as forensics.

And as you said, you suggested that i need to study some basics of data recovery and set up a

read only OS for my institution.

Isnt it? Correct me if i'm wrong.

Yes, i referred to that link just as my reference.

And yes of course, my small archival institution cannot be able to compete with Harvard Library

since it was established for such a long years ago.  

NadiahAthirahAbdulRajah
Newbie
 
 
  

Re: Saving the digital records

Post Posted: Thu Jun 15, 2017 7:52 am

- NadiahAthirahAbdulRajah

And as you said, you suggested that i need to study some basics of data recovery and set up a read only OS for my institution.

Isnt it?


Yes.

In a perfect world you would not ever need to actually recover any data, sources would always be readable, devices would always work, etc. , but since we are not in a perfect world you need to be prepared for when you might need this kind of competence.

A good start would be to become familiar with Kali Linux (and its "forensic mode") which should be among the best pre-made read only OS around:
docs.kali.org/general-...nsics-mode
docs.kali.org/
www.kali.org/

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Saving the digital records

Post Posted: Thu Jun 22, 2017 2:55 pm

And again, thanks jaclaz for replying.
It such a honour when you share the links where I can refer to settle my problem. Now I can see that, I need to do extra homework before implement any devices or digital forensic software within my institution.
Thanks for the info. A good kick-start for a junior archivist like me.  

NadiahAthirahAbdulRajah
Newbie
 
 

Page 1 of 1