Students will be introduced to the process of forensic disk imaging of legacy media.

This is followed by an introduction to tools (like the BitCurator environment) for analyzing these images and file systems, and extracting content and metadata.  

Learning outcomes:

• Forensic imaging of 3.5" and 5.25" floppies;
• Concept of write-blocking;
• Overview of commonly used tools, e.g. FREDs or Forensic Recovery Evidence Devices, Kryoflux, etc.)
• File system analysis and exporting DFXML metadata;
• Extracting and accessing content or deleted files from a disk image;
• Using Bulk Extractor to identify personally identifiable information; 

Should you fail to withdraw 48+ hours in advance, thereby preventing your colleagues on the waitlist from filling in your spot, your library account will be charged $10 per missed workshop. Please note, it is your responsibility to sign next to your name on the attendance sheet for each workshop session. A blank signature spot will result in a penalty charge.

Instructor: Steve Marks, Digital Preservation Librarian at UTL & Jess Whyte, Digital Assets Librarian

Location: The Bissell Building, 140 St. George Street, Second Floor, 224/225.