Digital Forensics and Preservation

Abstract

The Digital Preservation Coalition (DPC) is an advocate and catalyst for digital preservation, ensuring our members can deliver resilient long-term access to digital content and services. It is a not-forprofit membership organization whose primary objective is to raise awareness of the importance of the preservation of digital material and the attendant strategic, cultural and technological issues. It supports its members through knowledge exchange, capacity building, assurance, advocacy and partnership. The DPC's vision is to make our digital memory accessible tomorrow. The DPC Technology Watch Reports identify, delineate, monitor and address topics that have a major bearing on ensuring our collected digital memory will be available tomorrow. They provide an advanced introduction in order to support those charged with ensuring a robust digital memory, and they are of general interest to a wide and international audience with interests in computing, information management, collections management and technology. The reports are commissioned after consultation among DPC members about shared priorities and challenges; they are commissioned from experts; and they are thoroughly scrutinized by peers before being released. The authors are asked to provide reports that are informed, current, concise and balanced; that lower the barriers to participation in digital preservation; and that they are of wide utility. The reports are a distinctive and lasting contribution to the dissemination of good practice in digital preservation. This report was written by Jeremy Leighton John, a specialist in the theory and practice of digital forensics in the context of personal, cultural and scientific archives. The report is published by the DPC in association with Charles Beagrie Ltd. Neil Beagrie, Director of Consultancy at Charles Beagrie Ltd, was commissioned to act as principal investigator for, and managing editor of this Series in 2011. He has been further supported by an Editorial Board drawn from DPC members and peer reviewers who comment on text prior to release:

A Framework for Concurrent Contact-Tracing and Digital Evidence Analysis in Heterogeneous Environments

“…Eoghan, [ 19 ] defines digital evidence, as any data stored or transmitted using electronic devices that could support or refute the theory of how an offence occurred and further addresses the critical elements of the offence in terms of the intent and alibi. In another study, John [ 20 ] defines digital forensics as the use of scientifically derived and proven methods toward the validation, identification, interpretation, documentation and presentation of digital evidence derived from digital sources, such as mobile devices, computers and networks, to facilitate an investigation or for the reconstruction of events involving crime, data recovery, cybercrime, fraud, and intellectual property theft. This definition focuses on digital forensics as a method for the investigation of events involving data in digital format, and it emphasises the use of scientific methods.…”

PRECEPT: a framework for ethical digital forensics investigations

“…During investigation, bookmark private information that is irrelevant to the investigation so that it is not included in any report. Examples are personal credit card numbers, personal passport numbers, and national insurance numbers (John, 2012;Dehghantanha and Franke, 2014).…”

From time theft to time stamps: mapping the development of digital forensics from law enforcement to archival authority

“…Legal theory, computer security and information assurance, and computer science (systems architecture and computer history models) have all driven the development of digital forensics. Several writers, however, look beyond digital forensics' traditional partners to find similarities and mutual affordances in other disciplines: information theory (Hama and Pollitt 1996), records management (Irons 2006), archival diplomatics (Duranti 2009;Cohen 2015), and archival science (Kirschenbaum et al 2010;Duranti and Endicott-Popovsky 2010;John 2012;Dietrich and Adelstein 2015).…”