Digital forensics workflow - 5.25 inch floppy disks

Introduction


  • The following workflow involves a 5.25 inch floppy drive connected to a BitCurator workstation using a KryoFlux floppy controller or Device Side Data FC5025 floppy controller 
  • Digitizing 5.25 inch floppy disks requires careful attention to the procedures and equipment handling. Improper handling can damage or destroy the equipment.
  • Some 5.25 inch floppy disks may require conservation treatment before imaging. Data recovery may not be possible. 

Add 5.25 inch floppy disk to register of digital storage devices


  1. Follow procedures to add item to register of digital storage devices.

Prepare 5.25 inch floppy disk for forensic imaging


  1. Determine if the floppy disk will be imaged using the Device Side Data FC5025 floppy controller or the KryoFlux floppy controller. 

  2. Follow setup and installation guide for the FC5025 or the setup and installation guide for the KryoFlux.

Create forensic image


  1. Follow procedures for creating forensic images using Guymager. This involves backing up the forensic images and transferring the images to the digital forensics workstation for further processing and analysis.

Create case in Forensic Toolkit (FTK)


  1. Follow procedures for creating cases in Forensic Toolkit (FTK).

Run additional analysis processing options in Forensic Toolkit (FTK)


  1. Follow procedures for running additional analysis processing options in Forensic Toolkit (FTK).

Conduct archival appraisal


  1. Follow procedures for conducting archival appraisals and selecting electronic records in FTK.

Extract archival files from Forensic Toolkit (FTK) and transfer files to ingest storage


  1. Follow procedures for extracting files from Forensic Toolkit (FTK).

  2. Follow procedures for transferring files to ingest storage.

Delete case in Forensic Toolkit (FTK)


  1. Follow procedures to delete case in Forensic Toolkit (FTK).