Instructor: Jess Whyte, Digital Preservation Intake Coordinator Librarian, University of Toronto Libraries

This workshop will introduce participants to the process of forensic disk imaging of legacy media (e.g. 3.5" and 5.25" floppy disks). This will be followed by a demonstration of and introduction to software tools (e.g. the BitCurator environment and FTK Imager) for analyzing these disk images, and extracting content and metadata.

Learning outcomes:

• Forensic imaging of 3.5" and 5.25" floppies;
• Concept of write-blocking;
• Overview of commonly used hardware, e.g. FREDs or Forensic Recovery Evidence Devices, Kryoflux, write blockers
• Extracting and accessing content or deleted files from a disk image;
• Using Bulk Extractor to identify personally identifiable information;
• Methods for file system analysis and exporting DFXML metadata; 

No computer necessary, but if you'd like to follow along with the demonstrations, you can download and install FTK Imager [1] and/or a Bitcurator virtual machine [2] on your personal laptop.

[1] http://marketing.accessdata.com/ftkimager3.2.0, PC only

[2] https://wiki.bitcurator.net/index.php?title=BitCurator_Environment_Releases 

Cancellation Policy:

• Cancellation by registrant 7 days prior to the event: Full refund
• Cancellation by registrant one week to 48 hours prior to the event: Refund, less 20% cancellation charge to cover administrative cost
• Cancellation by registrant less than 48 hours prior to the event: No refund
• Registrant did not attend event without any notification: No refund
• In situations where circumstances may have been unforeseen (e.g. death in the family, or hospitalization), a full refund will be offered, if a request is made in writing to TAAG.