gengenbach-forensic-workflows-2012

conforms to the Digital Forensics XML (DFXML) metadata schema. 102 The DFXML file
and a copy of the disk image are then packaged using the BagIt object packaging
specification developed by the Library of Congress and California Digital Library. 103 The
BagIt package allows the disk image and any associated metadata to be packaged as part
of the same “bag,” enabling higher-level description and a manifest of the bag contents to
be archived in Yale University Libraries digital storage, the Rescue Repository.
The Rescue Repository is a library-wide managed storage environment
specifically for the digital materials acquired and ingested by each collection in Yale
University Libraries. 104 Within the Rescue Repository, files are verified and validated by
JSTOR/Harvard Object Validation Environment (JHOVE), and ingests are monitored
through ingest activity logs by a nightly reporting script. 105 The Rescue Repository is a
“dark archive,” in that it does not allow public access to materials, but only internally to
those with proper permissions—mostly the administrators of that material from each of
the collections with the ability to ingest into the Repository.
For this reason, the Beinecke has provided an alternative method of access by
copying the disk image before it is added to a BagIt package. This access disk image
copy is maintained on separate network storage, and may be subject to further processing
with a robust forensic analysis tool, the Forensic Toolkit (FTK). 106 This tool is used for
arrangement and description, and to define the levels of access available to the user.
Accessible material is then provided to the user on a secure access station in the Beinecke
102 See Appendix D, “fiwalk” and “Digital Forensics XML.”
103 See Appendix D, “BagIt.”
104 “Yale University Rescue Repository: About the Rescue Repository,” Yale University Library: Integrated
Systems and Programming Group http://www.library.yale.edu/ito/RRweb/AboutRescueRepository.html
(accessed July 2012).
105 Ibid.
106 Note that this is a different program from FTK Imager. For more information, see Appendix D, “Forensic
Toolkit (FTK).”
30