June 10, 2010 --Computer forensics techniques—those used in criminal investigations—are increasingly relevant to cultural heritage institutions that collect digital content.

Forensics allow an archivist to prepare an appraisal manifest of the contents of a disk drive, make an authentic copy of a floppy disc to aid in its preservation or audit the integrity of digital content into the future. Scholars may also find tools used in the legal discovery and recovery of files of use in the analysis or reconstruction of electronic manuscripts.

These considerations helped inspire the Maryland Institute for Technology in the Humanities to hold the Computer Forensics and Cultural Heritage meeting (external link) on May 14-15, 2010. The Andrew W. Mellon Foundation funded the meeting in support of a report, entitled "Computer Forensics and Born-Digital Content in Cultural Heritage Collections," to be published by the Council on Library and Information Resources later this year.

More than fifty international participants attended, representing cultural heritage organizations and the computer forensics profession. Matthew Kirschenbaum, co-organizer of the meeting, viewed the event as a groundbreaking opportunity for the two communities to discuss issues, tools and paths forward. "Despite its origins in law enforcement, security and other areas seemingly far removed from the cultural heritage sector, we saw an amazing degree of convergence between the professional forensics community and attendees charged with the stewardship of born digital materials from arts, humanities, and personal archives," he said.

Attendees had the opportunity to hear presentations on research in computer forensics, available tools, and current work and challenges in the appraisal and processing of born-digital collections. Leslie Johnston of the National Digital Information Infrastructure and Preservation Program participated in the closing panel discussion.

The meeting discussed a number of issues and questions:

• Do paper-based archival practices still apply in the appraisal of digital media?
• Identification of content formats; the review/analysis/recovery of data by the collecting institution; and scholarly analysis of files and the review and/or recovery of lost or versioned data.
• How can the community map computer forensic activities to digital preservation, personal archiving and digital archivist training?
• Do archivists need to be experts in all possible technologies that might produce records? How do we deal with the scale of software, operating systems and hardware needed to work with everything we will need? How do we keep up with technology changes?
• What are the differences between the needs of the legal computer forensics community - which needs to present evidence - and the cultural heritage community - needs to tell stories? How do the tools for these activities differ? Should the digital preservation community be developing tools or re-developing/developing open source tools that are aimed at this community?
• Mobile device forensics is an area of activity that may require its own study.
• There was discussion about making creators aware of issues in creating more easily archived and preserved files. The potential downside is that this could potentially change the creator’s creative process.
• How do we potentially capture the full context of an individual’s life? Context in the small will come to us – computers, hard drives, discs – but how can we, or should we, capture personal digital content that is in the cloud?
• The report rightly covers high level challenges and issues of trustworthiness, authenticity, cost models and ethics. There is also a need to document best practices and procedures.
• The most important thing we can get from the computer forensics community is not necessarily the tools, but the procedures for analysis and presentation of evidence.