Saving the digital records
I'm an archivist and basically deals with material stored on obsolete formats. In order to retrieve the content that obsolescence or decay , I need to use devices or digital forensic software within my institution. Just like Harvard Library, they already used writeblockers (device that ensures information only flows one way, preventing data from being overwritten).
My question are,
1. What is the most important thing that I need to consider before use the device (writeblocker) within my institution?
2. Is it appropriate to used the device (writeblocker) in small archival institution?
Really hope for any comments/opinion/suggestion from all of you.
Thanks in advance!
First thing what is/are the source(s)?
Which specific media, bus technology, etc.
The activity you are after is not the same as forensics, they have different requirements overall, it is much more similar to data recovery.
Even in forensics the *need* to use a hardware writeblocker (as opposed to a read only Operating System or if you prefer a software writeblocker) is highly debatable, and all in all revolves around the possibility (in the rare case an issue can happen) to be able to put the blame on the hardware writeblocker manufacturer or to make things easier in court.
You are probably referring to this
Heck! They are Harvard, they can afford FRED's, allow me to doubt that your institution is ready to spend several thousands dollars on a single PC's hardware.
The real issue is that you will have to deal with obsolete, possibly partially defective media, and with aging hardware, possibly gathered second or third hand after having been stored years, just as an example re-aligning heads of a 5 1/4 is a lost art, but, for a more recent example, how many zip drives experienced - before or later - the click of death?
Before being preoccupied by the need to use a hardware writeblocker (and finding a non SATA one may be in itself an issue nowadays, presuming you will have floppies and similar media, but also IDE and SCSI disks) I would rather study some basics of data recovery (appropriate for the media you need to image) and set up (and get familiar with) a read only OS (that needs of course the appropriate drivers for the specific hardware, so you may need to setup "old" machines with "old" OSes.
Thanks jaclaz for replying
So as I can see here, for my situation, it more like data recovery and not the same as forensics.
And as you said, you suggested that i need to study some basics of data recovery and set up a
read only OS for my institution.
Isnt it? Correct me if i'm wrong.
Yes, i referred to that link just as my reference.
And yes of course, my small archival institution cannot be able to compete with Harvard Library
since it was established for such a long years ago.
And as you said, you suggested that i need to study some basics of data recovery and set up a read only OS for my institution.
In a perfect world you would not ever need to actually recover any data, sources would always be readable, devices would always work, etc. , but since we are not in a perfect world you need to be prepared for when you might need this kind of competence.
A good start would be to become familiar with Kali Linux (and its "forensic mode") which should be among the best pre-made read only OS around
And again, thanks jaclaz for replying.
It such a honour when you share the links where I can refer to settle my problem. Now I can see that, I need to do extra homework before implement any devices or digital forensic software within my institution.
Thanks for the info. A good kick-start for a junior archivist like me.