Forensic imaging steps for 1.1 - Revision history

Sallain at 21:51, 11 February 2020

2020-02-11T21:51:40Z

Mdemeo: Note more completed tasks

2013-11-01T16:51:38Z

Note more completed tasks

Mdemeo: Document completed tasks

2013-10-30T21:58:00Z

Document completed tasks

Mdemeo: Add category

2013-10-21T22:20:56Z

Add category

Mdemeo: Add version header

2013-10-21T22:17:47Z

Add version header

Mdemeo: Created page with "Archivematica 1.0 has changed the way that several processes work, which has changed the scope of what's necessary to implement for forensic disk imaging. This document outlin..."

2013-10-21T22:16:40Z

Created page with "Archivematica 1.0 has changed the way that several processes work, which has changed the scope of what's necessary to implement for forensic disk imaging. This document outlin..."

New page

Archivematica 1.0 has changed the way that several processes work, which has changed the scope of what's necessary to implement for forensic disk imaging. This document outlines the mandatory steps that still need to be completed for forensic imaging in 1.1, and some additional steps that would let Archivematica generalize the functionality into the standard transfer.

== Necessary improvements ==

=== Disk image imaging metadata must be able to be added ===

Forensic image transfers need to provide the ability to include some [[Digital forensics image ingest#Metadata_requirements|metadata at the beginning of the transfer]].

This is partially implemented and needs to be rebased onto the 1.0 branch.

=== File identification commands must recognize disk images ===

Since the new extraction model is based on the FPR, and hence requires file identification, it will be necessary to ensure the identification microservices can identify disk images in order to allow them to be extracted.

=== Forensic tools must be packaged ===

=== Disk image extraction commands must be added to the FPR ===

=== Extracted package deletion must be optional ===

Currently, whether or not extracted packages will be retained after decompression is hardcoded in the package extraction script, as it was in the old extraction code. (The current behaviour is to always delete the package after decompression.) This must be made optional via user choice in the UI, and should be exposed as a persistent option in the processing configuration.

=== Users should be offered the choice of whether to extract packages ===

This must be made optional via user choice in the UI, and should be exposed as a persistent option in the processing configuration.

=== New "Examine Contents" microservice must be added ===

This step [[Digital forensics image ingest#Detail|runs the bulk_extractor tool]] and indexes the output to allow for later visualization and examination.

=== New characterization scripts must be written for fiwalk ===

It's previously been suggested that Archivematica use [[Digital forensics image ingest#fiwalk|Mark Matienzo's fiwalk configuration that uses FIDO]] but this may no longer be necessary now that FIDO is implemented as a general identification tool - extracted contents will always be identifiable using FIDO if the user selects that as their identification tool.

== Potential improvements ==

=== Alternate characterization tools should be implemented ===

Disk image characterization should be [[Digital forensics image ingest#Detail|done with fiwalk]].

Currently the "characterize and extract metadata" step always uses FITS, but in 1.0 the groundwork was laid for allowing this to be controllable using the FPR instead. If this is completed, then we can simply write FPR rules to control characterization of disk images.

=== Provide robust identification fallbacks using additional microservice(s) ===

Currently identification happens using a single tool; if identification fails, the file will not be identified. We provide a single case fallback in the scripts that handle file identification and FIDO. Providing a more robust fallback would be desirable - e.g., by allowing individual files to fall back to other IDTools if identification fails. This would allow alternate tools to provide identification results for things that FIDO currently can't identify, such as disk images, without needing to clutter the existing scripts.

=== Recursive package extraction ===

The current package extraction code extracts in one pass. If a package contains additional packages that Archivematica can extract, they currently won't be extracted. The code should be updated in order to allow extraction of nested packages - for instance ZIP files containing other ZIPs; tarballs in uncommon compression formats (such as .tar.xz); and disk images containing compressed archives.

@@ Line 1: / Line 1: @@
 [[Main Page]] > [[Development]] > [[:Category:Development documentation|Development documentation]] > [[Digital forensics image ingest]] > Forensic imaging steps for 1.1
 [[Category:Development documentation]]
 Archivematica 1.0 has changed the way that several processes work, which has changed the scope of what's necessary to implement for forensic disk imaging. This document outlines the mandatory steps that still need to be completed for forensic imaging in 1.1, and some additional steps that would let Archivematica generalize the functionality into the standard transfer.

@@ Line 24: / Line 24: @@
 Being tracked in https://projects.artefactual.com/issues/5843
-=== Extracted package deletion must be optional ===
+=== <strike> Extracted package deletion must be optional </strike> ===
 Currently, whether or not extracted packages will be retained after decompression is hardcoded in the package extraction script, as it was in the old extraction code. (The current behaviour is to always delete the package after decompression.) This must be made optional via user choice in the UI, and should be exposed as a persistent option in the processing configuration.
-=== Users should be offered the choice of whether to extract packages ===
+Being tracked in https://projects.artefactual.com/issues/5894
 This must be made optional via user choice in the UI, and should be exposed as a persistent option in the processing configuration.
 === <strike> New "Examine Contents" microservice must be added </strike> ===

← Older revision		Revision as of 22:20, 21 October 2013
Line 1:		Line 1:
	[[Main Page]] > [[Development]] > [[:Category:Development documentation\|Development documentation]] > [[Digital forensics image ingest]] > Forensic imaging steps for 1.1		[[Main Page]] > [[Development]] > [[:Category:Development documentation\|Development documentation]] > [[Digital forensics image ingest]] > Forensic imaging steps for 1.1
		+	[[Category:Development documentation]]

	Archivematica 1.0 has changed the way that several processes work, which has changed the scope of what's necessary to implement for forensic disk imaging. This document outlines the mandatory steps that still need to be completed for forensic imaging in 1.1, and some additional steps that would let Archivematica generalize the functionality into the standard transfer.		Archivematica 1.0 has changed the way that several processes work, which has changed the scope of what's necessary to implement for forensic disk imaging. This document outlines the mandatory steps that still need to be completed for forensic imaging in 1.1, and some additional steps that would let Archivematica generalize the functionality into the standard transfer.

← Older revision		Revision as of 22:17, 21 October 2013
Line 1:		Line 1:
		+	[[Main Page]] > [[Development]] > [[:Category:Development documentation\|Development documentation]] > [[Digital forensics image ingest]] > Forensic imaging steps for 1.1
		+
	Archivematica 1.0 has changed the way that several processes work, which has changed the scope of what's necessary to implement for forensic disk imaging. This document outlines the mandatory steps that still need to be completed for forensic imaging in 1.1, and some additional steps that would let Archivematica generalize the functionality into the standard transfer.		Archivematica 1.0 has changed the way that several processes work, which has changed the scope of what's necessary to implement for forensic disk imaging. This document outlines the mandatory steps that still need to be completed for forensic imaging in 1.1, and some additional steps that would let Archivematica generalize the functionality into the standard transfer.

@@ Line 18: / Line 18: @@
 === Forensic tools must be packaged ===
-=== Disk image extraction commands must be added to the FPR ===
+=== <strike> Disk image extraction commands must be added to the FPR </strike> ===
 === Extracted package deletion must be optional ===
@@ Line 28: / Line 32: @@
 This must be made optional via user choice in the UI, and should be exposed as a persistent option in the processing configuration.
-=== New "Examine Contents" microservice must be added ===
+=== <strike> New "Examine Contents" microservice must be added </strike> ===
 This step [[Digital forensics image ingest#Detail|runs the bulk_extractor tool]] and indexes the output to allow for later visualization and examination.
-=== New characterization scripts must be written for fiwalk ===
+=== <strike> New characterization scripts must be written for fiwalk </strike> ===
 It's previously been suggested that Archivematica use [[Digital forensics image ingest#fiwalk|Mark Matienzo's fiwalk configuration that uses FIDO]] but this may no longer be necessary now that FIDO is implemented as a general identification tool - extracted contents will always be identifiable using FIDO if the user selects that as their identification tool.
@@ Line 38: / Line 46: @@
 == Potential improvements ==
-=== Alternate characterization tools should be implemented ===
+=== <strike> Alternate characterization tools should be implemented </strike> ===
 Disk image characterization should be [[Digital forensics image ingest#Detail|done with fiwalk]].