Introduction

...

Archival processing projects that involve digital forensics require a clear understanding of the "flow" of forensic processes that will be repeated until the project is complete. This section of the Digital Forensics Lab Manual describes the basic workflows for various types of digital storage devices.There digital forensics workflows. There are two primary workflows for digital forensics:

Bulk forensic imaging for preservation

...

1. Add item to register of digital storage devices.
   
   
2. Prepare item for forensic imaging.
   
   
3. Use FTK Imager to create forensic disk image of item.
   
   
4. Transfer forensic disk images image to Libraries' digital backlog storage for preservation until further processing.
   
   
5. Delete local copy of forensic disk image after transfer validation.
   
   
6. Update entry in register of digital storage devices.

...

1. Add item to register of digital storage devices.
   
   
2. Prepare item for forensic imaging.
   
   
3. Use FTK Imager to create forensic image of item and create a secondary (i.e., local backup) copy of the forensic image.
   
   
4. Update entry in register of digital storage devices.
   
   
5. Load forensic image(s) into FTKCreate case in FTK.
   
   
6. Select an evidence processing profile.
7. Add forensic image to case.
   
   
8. Run additional analysis processing. Use a combination of tools to identify confidential and personal information.
   
   
9. Create filters as necessary.
   
   
10. Create labels to support archival appraisal decisions. For example: 
    
    
    1. Delete 
    2. Review for deletion
    3. Review for selection
    4. Review for selection (contains PII)
    5. Select for retention
    6. Select for retention (contains PII)
       
Create word list based on selection criteria.
11. 1. 
       
       
12. Create hierarchical set of bookmarks to support archival arrangement:
    
    
    1. Fonds title
       1. Series title
          1. Sub-series title
       2. Series title
          
          
13. Create word list based on archival appraisal guidelines.
    
    
14. Use a combination of filters, searching, and browsing to identify select and select organize records for retention. Use labels and bookmarks to facilitate this process.
    Use a combination of tools to identify confidential and personal information. Use labels and bookmarks to facilitate this process.
    
    
15. Use bookmarks to export files and metadata from FTK.
    
    
    1. Export files option
    2. Report option
       
    Transfer package to
    1. 
       
       
16. Package files into one or more "bags" that conform to the BagIt specification.
    
    
17. Upload bag(s) to the Libraries' ingest storage for transfer .
    
    
18. Transfer bag(s) into digital preservation system.
    
    
19. Process transfer and generate AIPs. 
    
    
20. Delete local backup data and FTK case after successful generation of AIPs.

...