The following notes and information came out of Peer Forum I: Disk Imaging, a discussion that took place at MoMA on December 7 and 8, 2017. The following represent the views of the speakers and participants who attended this meeting.


 

Collaborative Resources

 

Background

 

Barrera-Gomez Julianna and Ricky Erway, “Walk This Way: Detailed Steps for Transferring Born-Digital Content from Media You Can Read In-House,” OCLC Research (2012).

Chassanoff, Alexandra, Kam Woods, and Christopher A. Lee Digital Preservation Metadata Practice for Disk Image Access, in Digital Preservation Metadata for Practitioners. Angela Dappert, Rebecca Squire Guenther, and Sebastien Peyrard (Eds.). Springer, January 2016.

Duryee, Alexander: "An Introduction to Optical Media Preservation" The Code4Lib Journal Syndication. April 16, 2014. Accessed July 22, 2015. http://journal.code4lib.org/articles/9581.

Erway, Ricky. “You’ve Got to Walk Before You Can Run: First Steps for Managing Born-Digital Content Received on Physical Media,” OCLC Research (2012).

Goethals, Andrea. “Disk Image Formats.” Harvard Wiki, Atlassian Confluence 5.8.17, 2016, wiki.harvard.edu/confluence/display/digitalpreservation/Disk+Image+Formats

Guerrero, Miriely, “Removable Media and the Use of Digital Forensics,” Bentley Historical Library, Digital Curation. July 2, 2012.

Kennedy, Tara. “45th Annual Meeting, Electronic Media, June 1, ‘Establishing a Workflow for the Preservation of Software-Based Artworks.’” Conservators Converse, 2016, www.conservators-converse.org/2017/07/45th-annual-meeting-electronic-media-june-1-establishing-a-workflow-for-the-preservation-of-software-based-artworks/.

Kirschenbaum, Matthew G. “An Old House with Many Rooms”: The Textual Forensics of Mestery_House.dsk. Mechanisms.

Kirschenbaum, Matthew, Richard Ovenden, Gabriela Redwine. “Digital Forensics and Born-Digital Content in Cultural Heritage Collections,” Council on Library and Information Sources (2010). http://www.clir.org/pubs/abstract/reports/pub149

Lee, Christopher A. and Kam Woods, Matthew Kirschenbaum, and Alexandra Chassanoff, “From Bitstreams to Heritage: Putting Digital Forensics into Practice in Collecting Institutions,” BitCurator Project (2013).

http://sils.unc.edu/sites/default/files/news/From%20Bitstream%20to%20Heritage%20S%20%282%29.pdf

Lee, Christopher A., Sunitha Misra, and Kam Woods. “A Web Service for File-Level Access to Disk Images”, Code4Lib Journal 25 (2014).   

McDonough, Jerome P.; Olendorf, Robert; Kirschenbaum, Matthew; Kraus, Kari; Reside, Doug; Donahue, Rachel; Phelps, Andrew; Egert, Christopher; Lowood, Henry; Rojo, Susan

https://www.ideals.illinois.edu/handle/2142/17097

Woods, Kam, Christopher Lee, Oleg Stobbe, Thomas Liebetraut and Klaus Rechert. 2015. Functional Access to Forensic Disk Images in a Web Service. In Proceedings of the 12th International Conference on Digital Curation (191-195). Chapel Hill, NC: University of North Carolina, School of Information and Library Science.                                                                                                                                            

Woods, Kam, Christopher A. Lee, and Sunitha Misra. 2013. Automated Analysis and Visualization of Disk Images and File Systems for Preservation. In Proceedings of Archiving 2013. Society for Imaging Science and Technology. Springfield, VA. 239-244.

                                                      

Woods, Kam, and Christopher A. Lee. 2012. Acquisition and Processing of Disk Images to Further Archival Goals. In Proceedings of Archiving 2012 Springfield, VA: Society for Imaging Science and Technology. 147-152.

                                                       

Woods, Kam, Christopher A. Lee, and Simson Garfinkel. 2011. Extending Digital Repository Architectures to Support Disk Image Preservation and Access. In Proceedings of the 2011 Joint Conference on Digital Libraries.

 

George Blood Audio, Video, Film. 2014. Preserving Write-Once DVDs. Producing Disc Images, Extracting Content, and Addressing Flaws and Errors. http://www.digitizationguidelines.gov/audio-visual/documents/Preserve_DVDs_BloodReport_20140901.pdf

 

Olsen, Porter. 2015. Hacking MITH’s Legacy Web Servers: A Holistic Approach to Preservation on the Web. http://mith.umd.edu/hacking-miths-legacy-servers/

 

Olsen, Porter. 2016. Accessing Mac Formatted Floppy Disks without A Kryoflux. https://porterolsen.wordpress.com/2016/06/15/accessing-mac-formatted-floppy-disks-without-the-kryoflux/

 

Sheward, Mike. 2012. Rock Solid: Will Digital Forensics Crack SSDs? http://resources.infosecinstitute.com/ssd-forensics/

 

Johan Van Der Knijff. 2015. Preserving Optical Media from the Command Line. http://blog.kbresearch.nl/2015/11/13/preserving-optical-media-from-the-command-line/ and https://gist.github.com/bitsgalore/1bea8f015eca21a706e7#file-

 

Kim, Yunhyong and Ross, Seamus. 2012. Digital Forensics Formats: Seeking a Digital Preservation Storage Container Format for Web Archiving. The International Journal of Digital Curation Volume 7, Issue 2. http://www.ijdc.net/index.php/ijdc/article/view/217/286

 

Walsh, Tim. “How to Access Digital Files from the Nineties. A Case Study by Tim Walsh” http://www.cca.qc.ca/en/issues/3/technology-sometimes-falls-short/49023/how-to-access-digital-files-from-the-nineties

 

 

Formats and Registries

 

JISC report examining the principles and practices associated with forensic disk imaging

https://fido.cerch.kcl.ac.uk/wp-content/uploads/2012/11/FIDO-Forensic-Disk-Imaging-Report-v1.pdf

 

PRONOM Format Registry

https://www.nationalarchives.gov.uk/PRONOM/Default.aspx

Direct link to search PRONOM by format:

https://www.nationalarchives.gov.uk/PRONOM/Format/proFormatSearch.aspx?status=new

 

DROID tool to programmatically access PRONOM:

http://www.nationalarchives.gov.uk/information-management/manage-information/preserving-digital-records/droid/

 

Siegfried tool, similar to DROID, for programmatically accessing PRONOM through command line:

Description: https://www.itforarchivists.com/siegfried

Demo video: https://asciinema.org/a/ernm49loq5ofuj48ywlvg7xq6

 

DPC File Formats and Standards master page:

http://www.dpconline.org/handbook/technical-solutions-and-tools/file-formats-and-standards

 

Harvard Wiki about Disk Image Formats:

https://wiki.harvard.edu/confluence/display/digitalpreservation/Disk+Image+Formats

 

 












 

 

Disk Imaging and Environments

Definition / History

 

Link to A (Brief) History of Disk Imaging slides:

https://goo.gl/mmLKn5

 

Disk imaging / simple definitions on Forensics Wiki:

http://forensicswiki.org/wiki/Disk_Imaging

 

Imaging (Old) IDE Disks — Harder than Imagined (article by Klaus Rechert about a case of multiple imaging passes on drives producing different MD5 checksums)

http://bw-fla.uni-freiburg.de/wordpress/?p=788

 

Tools

 

BitCurator Environment (includes several imaging and analysis tools):

https://wiki.bitcurator.net/ (download the Quickstart Guide for directions on getting started)

 

FTK Imager No-cost forensic imaging tool to run on Windows

https://accessdata.com/product-download/ftk-imager-version-4.1.1

 

Disktype and supported type list:

http://disktype.sourceforge.net/

 

(Older) survey of forensic disk image formats:

http://www.dfrws.org/sites/default/files/survey-dfrws-cdesf-diskimg-01.pdf

 

Isolyzer

http://openpreservation.org/blog/2017/07/12/update-on-isolyzer-udf-hfs-and-more/

Isolyzer GitHub repository - readme.md contains information and resources on common optical media filesystems:

https://github.com/KBNLresearch/isolyzer

 

Floppy Disks

Python-based Tool for trying to identify disk file system formats from kryoflux raw stream files

https://github.com/euanc/DiskFormatID

 

Ghost

https://support.symantec.com/en_US/article.TECH140190.html



 

Workflows

 

Yale’s Born Digital Archives Accessioning Service (includes workflow and q/a documentation) - separate process for non-archival media

https://guides.library.yale.edu/c.php?g=300384&p=3593184

 

Python script for reporting from Guymager log files:

https://github.com/euanc/GuymagerLogParser

 

 

 

Write Blocking and Disk Cloning Devices

 

Forensic Recovery of Evidence Device (FRED) - specialized PC to acquire materials

https://www.digitalintelligence.com/products/fredselect/

 

Standalone forensic imager:

https://www.digitalintelligence.com/products/forensic_imager_tx1/

 

Software write blocking may be a path for you to explore, but software write blocking in *general* is a fallacy

http://mykeytech.com/softwarewriteblocking2-4.pdf

http://www.forensicswiki.org/wiki/Write_Blockers

 

 

Emulation and Emulators

 

Emulation-as-a-Service [EaaS] original project page

http://bw-fla.uni-freiburg.de/

 

Emulation-as-a-Service [EaaS] Recent installation and setup guide

http://openpreservation.org/blog/2017/09/15/getting-started-with-emulation-the-eaas-desktop-application/

 

Quick link to EaaS setup (simplest - requires installing Docker)

http://eaas.uni-freiburg.de/docs/install/docker.html

 

Example of EaaS running at Rhizome

http://archive.rhizome.org/theresa-duncan-cdroms/

 

Introduction to an emulation-based preservation strategy for software-based artworks

http://www.tate.org.uk/download/file/fid/105887

 

Cory Arcangel’s Bomb Iraq on the web

http://media.rhizome.org/emulating-bomb-iraq-arcangel/index.html

 

SuperClock!

https://www.macintoshrepository.org/2366-superclock-4-0-4

 

------

 

QEMU image support guide (includes simple explanation of qcow):

https://en.wikibooks.org/wiki/QEMU/Images

Download page

https://www.qemu.org/

 

DOSBox

https://www.dosbox.com/information.php?page=0

 

MAME multi-purpose emulation framework

http://mamedev.org/

 

Fuse Emulator

http://fuse-emulator.sourceforge.net/

 

 


 

Mobile Device Imaging and Analysis  

 

Why it’s getting harder to extract data from iOS devices:

https://blog.elcomsoft.com/2017/09/new-security-measures-in-ios-11-and-their-fo

rensic-implications/

 

Tools to image iPhones and Android devices:

https://www.magnetforensics.com/magnet-acquire/ (note their warnings on how little you’ll get!)

https://www.blackbagtech.com/blacklight.html (*logical* acquisition and analysis of some devices)

 

 

Forensic Analysis for iOS Devices https://www.sans.org/reading-room/whitepapers/forensics/forensic-analysis-ios-devices-34092

 

Metadata and System Metrics

 

PREMIS: Metadata on preservation activities around digital objects

https://www.loc.gov/standards/premis/

 

Wikidata

www.wikidata.org

https://www.wikidata.org/wiki/Wikidata:Introduction

 

Wikidata for digital preservation

https://guides.library.yale.edu/WikidataDigitalPreservation

http://openpreservation.org/blog/2016/09/30/wikidata-as-a-digital-preservation-knowledgebase/

 

TOTEM Project

http://impact.ref.ac.uk/CaseStudies/CaseStudy.aspx?Id=15739

See report/model in this google doc

 

 






 

 

Cataloging

 

McDonough, Jerome P.  “‘Knee-Deep in the Data’: Practical Problems in Applying the OAIS Reference Model to the Preservation of Computer Games.” Proceedings of the  45th Hawaii International Conference on System Sciences (2012).[1]

https://www.computer.org/csdl/proceedings/hicss/2012/4525/00/4525b625.pdf

 

 

Documentation

 

Rough Draft of Denver Art Museum Disk Imaging Procedures (subject to change)

 

{File System information}  

 

For Windows

https://regripper.wordpress.com/

For Mac

https://github.com/bolodev/osxripper

 

{Processor serial number BIOS}

For Microsoft

BIOS [Basic Input Output System interface between hardware and operating system]

http://www.dell.com/support/article/us/en/04/sln284433/what-is-bios-and-how-to-update-the-bios-on-your-dell-system?lang=en

 

https://www.intel.com/content/www/us/en/support/articles/000005547/boards-and-kits/desktop-boards.html

 

{System Reports}

For Mac OS

https://support.apple.com/en-us/HT203001

 

{DFXML of Disk Images}

https://wiki.bitcurator.net/index.php?title=Generating_DFXML_Output

 

{Hardware Validation/Failure}

S.M.A.R.T Status [Self Monitoring Analysis and Reporting Technology] for disk drive health and potential problems

For Windows

http://smartlinux.sourceforge.net/smart/index.php

For Mac

https://www.techwalla.com/articles/how-to-check-a-macs-smart-status

 


 

Other

 

Software Preservation Network

http://www.softwarepreservationnetwork.org/

 

Rendering Matters Report

http://archives.govt.nz/rendering-matters-report-results-research-digital-object-rendering

 

Rendering Matters Report Visual Examples

http://archives.govt.nz/resources/information-management-research/rendering-matters-report-results-research-digital-object-0

 

NESTOR (Network of Expertise in long-term Storage of digital resources in Germany)

http://www.langzeitarchivierung.de/Subsites/nestor/EN/Home/home_node.html

 

Brightsign

https://www.brightsign.biz/

 

Optical drives and media

Opti Drive Control testing

http://www.optidrivecontrol.com/

 

Floppy disks

Description of IBM MFM encoding (very common floppy disc filesystem) standard from National Semiconductor Corporation, 1989:

http://info-coach.fr/atari/hardware/_fd-hard/AN-505.pdf

 

Solid State Drive (SSD) performance test specification from 2017: https://www.backblaze.com/blog/hard-drive-stats-for-2017/

 

Challenges of Removable Media In Digital Preservation” by Eddy Colloton, Resources list. 

 

Margaret Hedstrom, Christopher Lee, Judith Olson, and Clifford Lampe (2006) "The Old Version Flickers More": Digital Preservation from the User's Perspective. The American Archivist: Spring/Summer 2006, Vol. 69, No. 1, pp. 159-187.

https://doi.org/10.17723/aarc.69.1.1765364485n41800