Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Aggregating Temporal Forensic Data Across Archival Digital Media

Aggregating Temporal Forensic Data Across Archival Digital Media

This presentation describes the benefits of aggregating timestamp metadata across multiple floppy disks in a single collection. Presented at the Digital Heritage 2015 conference in Granada, Spain.

Walker Sampson

October 02, 2015
Tweet

More Decks by Walker Sampson

Other Decks in Technology

Transcript

  1. Aggregating Temporal Forensic Data Across Archival Digital Media

  2. Guymager ∙ dcfldd ∙ cdrdao ∙ bulk_extractor ∙ bulk_extractor Viewer

    ∙ fiwalk ∙ The Sleuth Kit ∙ libewf ∙ AFFLIB ∙ pyExifToolGUI ∙ ClamAV / ClamTK ∙ FSlint ∙ sdhash ∙ HFS Utilities ∙ FITS ∙ readpst ∙ recoll ∙ GTK Hash ∙ GHex ∙ Safe Mount
  3. Timeline Data

  4. The Vasulka Collection

  5. Woody Vasulka, Computer studies, Untitled (“DDORISK.jpg”). vasulka.org/Woody/computerstudies/WOODY90/pages/DDORISK.html vasulka.org/Woody/computerstudies/WOODY90/pages/FDSKINS.html Woody Vasulka,

    Computer studies, Untitled (“FDSKINS.jpg”).
  6. File System Events 0 500 1000 1500 2000 1980 1984

    1986 1988 1990 1992 1994 1996 1998 2000 2002 2004 2008 2010 2012 Last modified (HFS) Last written Last accessed Created
  7. Timeline Benefits • Navigation
 • Trends
 • Context

  8. Timeline Complications • Provenance
 • Timestamp Value Variance
 • File

    System Variance
  9. Conclusions • Often “dormant” data
 • Research usually
 not in

    a legal context
 • Builds on existing
 best practice
  10. Thank You! Walker Sampson Digital Archivist University of Colorado Boulder

    walker.sampson@colorado.edu wsampson.wordpress.com