the Digital Forensics for Archivists course offered by the Society of American Archivists (SAA) at the University of Michigan.
The focus of this course is the application of forensic techniques to archival work. Digital forensics (or computer forensics) is “the process of identifying, preserving, analyzing, and presenting digital evidence in a manner that is legally acceptable” (Rodney McKemmish 1999). It is used to discover digital data, recover deleted, encrypted, or damaged file information, monitor live activity and detect violations of policies.
Archivists (and records managers) may be very good at dealing with paper, but may not have as much experience with processing and making available digital content that comes in the form of floppy disks, CDs, and hard drives. The field of digital forensics is very concerned with the same principles as archivists, including provenance, original order, and chain of custody, to apply to criminal and civil investigations. By applying the techniques, archivists are able to identify, extract, and document information from digital media about how it was created without altering the content. It also focuses on finding sensitive or personally identifiable information that may need to be redacted or protected from public access.