When an archive receives a paper collection, staff can often recognise the boxes, folders and physical order immediately. A born-digital collection presents a different problem. Records may arrive on external drives, CDs, floppy disks, memory cards or complex directory structures. The storage medium may be failing, timestamps may change during copying and the creator's original context may not be obvious.
Digital forensics provides methods for acquiring, examining and documenting digital evidence. In libraries and archives, those methods can be adapted to preserve integrity and provenance while respecting privacy, rights and the institution's access responsibilities. The goal is not to treat every accession as a criminal investigation. It is to borrow useful practices for handling fragile or complex digital material responsibly.
The historical research: Martin Gengenbach, 2012
Martin J. Gengenbach's 2012 master's paper, “The Way We Do It Here”: Mapping Digital Forensics Workflows in Collecting Institutions, examined how professionals applied digital forensic tools and practices in real collecting environments. Its published summary describes interviews with archivists and curators and considers the benefits and limitations of forensic techniques in managing born-digital content.
The BitCurator historical project record notes that such techniques were useful for capturing and preserving material from media such as hard drives and optical or floppy disks, while the metadata produced was not always straightforward to translate into archival arrangement, description and access.
That distinction is central. Extracting information is not the same as making a collection understandable. A technically complete disk image may still require appraisal, sensitive-data review, description and a practical method for future researchers to use its contents.
For full citation details and routes to an authoritative copy, visit the Gengenbach bibliographic record.
A defensible born-digital intake process
1. Record custody and context
Identify the source, donor or transferring organisation, the date received, the media type and any known restrictions. Record whether the material includes personal information, confidential records or third-party intellectual property. Preserve the original accession notes alongside the digital files.
2. Protect the source
Where appropriate, avoid changing the original medium. Specialist write-blocking methods can reduce the risk of accidental writes during examination. Fragile media or damaged hardware may need qualified handling; repeated DIY attempts can make recovery more difficult.
3. Create a documented acquisition
Choose a copying approach appropriate to the media and institutional requirements. A full disk image can preserve more technical context than selecting individual files, but may capture deleted information and sensitive data beyond what should ultimately be provided to users. Record the method, software versions and any errors.
4. Verify integrity
Calculate cryptographic checksums for acquired files or images and keep them in an acquisition log. Recalculate after transfer to establish whether the bytes have changed. See file formats, metadata and fixity.
5. Describe and appraise
Investigate directory structures, file types, dates, dependencies and duplicates. Separate machine-generated forensic metadata from archival description written to help people understand the collection. Do not assume that the presence of a file means the institution has a right to publish it.
6. Prepare access deliberately
Select appropriate access copies, address restrictions and identify formats requiring emulation or conversion. When an original file cannot be published, a descriptive record may still support discovery without compromising privacy or rights.
Digital forensics is not a replacement for archival judgement
A good process makes decisions explainable. Why was a disk image taken? Which files were excluded? What checks were performed? Which transformations created access copies? Can another person reproduce or audit the work? These are institutional questions as much as technical ones.
Tools can help but cannot establish policy on their own. COPTR offers a way to discover preservation tools by function and content type. Our tools guide discusses how to select and document them rather than treating a particular utility as universally correct.
What does this have to do with website preservation?
A historical website is another form of digital evidence. Its original URLs, timestamps, linked documents and software dependencies may all matter. The most trustworthy restoration records what was recovered, from where, at what time and with which limitations. A reconstructed site should not silently mix original and newly written text.
This is especially relevant to legacy software projects, whose source repositories, release files and documentation are often distributed across different platforms. Our GNU Telephony preservation project record illustrates the questions that arise when a former project portal no longer provides dependable access.
Frequently asked questions
Is digital forensics only for criminal investigations?
No. Many techniques developed for handling digital evidence are useful in archives and research collections, although the purpose, legal basis and workflow are different.
Should an archive always take a full disk image?
Not necessarily. It depends on the content, privacy considerations, hardware condition, available expertise, institutional policy and need to retain filesystem context.
Is the Gengenbach paper hosted by TwoSquares?
No. This article describes the research and links to a separate bibliographic record for known authoritative sources. We do not claim authorship or republication rights.
References and further reading
- BitCurator: Historical post on mapping digital forensics workflows
- Martin Gengenbach's ORCID record
- Library of Congress: 2014 presentation on mapping digital forensics workflows
- COPTR: Community-Owned digital Preservation Tool Registry