Born-digital Collection Work Flow

Peter Chan, Digital Archivist

Nov. 12, 2010

1

Write Protect!! Diskette / Drive to be Imaged

2

Label All Computer Media

3

Load FTK Imager

4

File – Create Disk Image

5

Logical Drive – Floppy / Physical Drive – Hard Drive

6

“Add” an Image

7

Use Raw (dd) – uncompressed image

8

Use Collection ID as Case No. / Use 3 Digits for Computer Media No.

9

Store Images in Folders Correspond to CM#s and Use CM# as Filename

10

“Tick” Verify images after they are created

11

Verify Imaging Result

12

Store Files in Forensic Lab Folder

13

Folder for Collection and Sub-folders for Images and FTK Case

14

1 Folder for 1 Computer Media Item

15

Audit Trail of Imaging

16

Create Logical Image

17

18

19

20

Use Canon EOS Utility to Capture Disk Label Images

21

Photographic Image of Label

22

Image Names and Storage Location

• Capture images in jpeg format.

• Use computer media # as name of images.

• Put the images in the computer media folders together with the disk/logical images and imaging audit files.

23

Load Forensic Toolkit

24

Create New Case

25

Assign Case Name Correspond to Collection Name

26

Use “All Images of a Directory” at the Network Forensic Lab Folder

27

Images Files Identified

28

Choose Appropriate Time Zone

29

Processing Status of Each Image File

30

Use “Explore” to See the Image Files

31

Highlight Files to be Bookmarked

32

Assign Bookmark Name and “Parent”

33

34

Add Supplementary Files to Bookmarks if Necessary

35

File – Report (to generate report with bookmarks)

36

Highlight “Bookmark” and Choose which bookmark to Report

37

Export files & include links

38

Columns Settings – Add File Type, MD5 Hash

39

Choose Report Output Format

40

Report Shown in Browser

41

Exported Files are Highlighted

42

All Files in the Designated Report Folder

43

Talk to SDR

Details of technical metadata

44