1. Born-digital Collection Work
Flow
Peter Chan, Digital Archivist
Nov. 12, 2010
1

2. Write Protect!!
Diskette / Drive to be Imaged
2

3. Label All Computer Media
3

4. Load FTK Imager
4

5. File – Create Disk Image
5

6. Logical Drive – Floppy /
Physical Drive – Hard Drive
6

7. “Add” an Image
7

8. Use Raw (dd) – uncompressed image
8

9. Use Collection ID as Case No. /
Use 3 Digits for Computer Media No.
9

10. Store Images in Folders Correspond to
CM#s and Use CM# as Filename
10

11. “Tick” Verify images after they are
created
11

12. Verify Imaging Result
12

13. Store Files in Forensic Lab Folder
13

14. Folder for Collection and Sub-folders
for Images and FTK Case
14

15. 1 Folder for 1 Computer Media Item
15

16. Audit Trail of Imaging
16

17. Create Logical Image
17

18. 18

19. 19

20. 20

21. Use Canon EOS Utility to Capture Disk
Label Images
21

22. Photographic Image of Label
22

23. Image Names and Storage Location
• Capture images in jpeg format.
• Use computer media # as name of images.
• Put the images in the computer media folders
together with the disk/logical images and
imaging audit files.
23

24. Load Forensic Toolkit
24

25. Create New Case
25

26. Assign Case Name Correspond to
Collection Name
26

27. Use “All Images of a Directory” at the
Network Forensic Lab Folder
27

28. Images Files Identified
28

29. Choose Appropriate Time Zone
29

30. Processing Status of Each Image File
30

31. Use “Explore” to See the Image Files
31

32. Highlight Files to be Bookmarked
32

33. Assign Bookmark Name and “Parent”
33

34. 34

35. Add Supplementary Files to
Bookmarks if Necessary
35

36. File – Report (to generate report with
bookmarks)
36

37. Highlight “Bookmark” and Choose
which bookmark to Report
37

38. Export files & include links
38

39. Columns Settings – Add File Type, MD5
Hash
39

40. Choose Report Output Format
40

41. Report Shown in Browser
41

42. Exported Files are Highlighted
42

43. All Files in the Designated Report
Folder
43

44. Talk to SDR
Details of technical metadata
44