Digital Forensics Lab Initiative

The RIT Archives seeks to establish an efficient, scalable, and cost-effective model for identifying and assessing endangered media at the point of acquisition, converting and preserving the content to ensure future access.

We define "endangered media" as formats which have become, or are on the road to becoming, obsolete. They need specific hardware or players in order to access the information, the medium already wasn’t meant to last forever, or improper storage or use have already led these formats to being unusable. These can include digital media, audiovisual media, and more.

To that end, we propose the development of a Digital Forensics Lab, which can be utilized by the RIT Archives and members of the RIT campus to access content from increasingly obsolete media, migrate the digital files to more contemporary formats, and provide long-term digital preservation when appropriate. We plan to stabilize the existing file formats and migrate files to the most up-to-date version that is computer-readable. (As a rule, platform-independent, nonproprietary, well-supported open formats are preferred.) This will allow us to identify, process, and analyze digital evidence through the use of validated tools and preservation workflows. Digital evidence is information or data of value stored on, received by, or transmitted by an electronic device.

Priority media formats for the RIT Archives at this time include 5¼” floppy disks, 3½” floppy disks, Iomega Zip disks, and CD-ROMs, with a future goal to also build capacity for data tapes and other digital media carriers. Long-term, a FRED (Forensic Recovery of Evidence Device) workstation would assist in securing, saving, and analyzing data from external hard drives and other media carriers.

Successful development of the Digital Forensics Lab would result in increased access to RIT’s digital history, as well as experiential learning opportunities for students interested in archives and computer science. To get involved, please contact us at ritarchive@rit.edu.

Please note: Physical documents, still images, audio-recordings, and video-recordings held on analog formats and carriers (such as audiocassettes, U-matic tapes, Betacam tapes, and VHS tapes) are out of scope for this project.

Workplan

Phase 1: Acquire initial equipment (May-October 2024)
Phase 2: Assemble Digital Forensics Lab and test equipment (October-December 2024)
Phase 3: Usage by RIT Archives staff and RIT campus members (January 2025-onward)
Phase 4: Digital preservation tasks and capacity building (ongoing)

Initial Equipment Needed

Here's where we need your help! Do you have any old (working) equipment in a supply closet or in storage? Please contact us at ritarchive@rit.edu -- we'd be happy to collect it for use in our Digital Forensics Lab. Right now, our initial equipment request list includes:

5¼” floppy disk drive (Quantity: 2)
USB 5¼” floppy controller (Quantity: 2)
Disk drive external enclosure and power supply (Quantity: 2)
Y-splitter for disk driver power connector (Quantity: 2)
KryoFlux drive with license and software (Quantity: 1)
Applesauce unit (Quantity: 1)
Mac Mini (for use with Applesauce; Quantity: 1)

As of September, we have already received two 3½” floppy disk drives, Iomega Zip disk drives, and a Jaz disk drive. Many thanks to Jim P. and Denis D.!

Long-Term Equipment Goals

After getting the lab up and running with our Initial Equipment list, we'd like to outfit it with additional hardware and supplies in order to access even more digital media carriers, such as data tapes, Syquest cartridges, and external hard drives.

CD/DVD autoloader/ripper
Data tape cassette players (various)
Syquest cartridge drive
FRED (Forensic Recovery of Evidence Device) computer
LTO tape drivers for FRED computer
Uninterruptible Power Supply