File system
No awareness
Different things
sfcfajmiift...
4JIW
archives either stored on digital media such as floppy disks, CDs,
flash drives, and computers; transferred via a network; or accessed
via a file sharing service such as Dropbox. In this article I will
focus on content that arrives on disks, flash drives, computers,
and other types of digital media.
Information is organized on digital media in accordance with
a file system such as FAT (File Allocation Table; MS-DOS), NTFS
(New Technology File System; Windows), or HFS+ (Hierarchical
File System Plus; Apple).3 The file system on a computer or a
removable storage medium like a disk determines, among other
things, the number of characters allowed in file names, how the
files are stored, and allowable file size. For example, the
maximum allowed file size on a USB drive formatted as FAT32
is 4 gigabytes, but if the drive were reformatted as NTFS, you
would be able to use it to store a much larger file. The file
system is also where deleted files are stored and unallocated
(or unused) space is represented. In other words, when you
copy the contents of a computer or disk in such a way that the
file system is captured, you are also acquiring deleted files, any
file fragments residing in unallocated space, and other types of
files not immediately apparent to the average computer user.
Disk imaging is a method of copying the contents of a piece of
digital media.4 A raw, or forensic, disk image captures an entire
bit-for-bit copy of a storage medium or device; it captures file
system information and deleted files in the root directory, as
well as any files and fragments stored in unallocated (or
unused) space. In other words, a forensic disk image captures
Stieglitz's entire office, including his waste basket. A logical disk
image is more targeted: it captures specific directories and
folders rather than the entire file system, and thus does not
include deleted files or unallocated space. To continue the office
metaphor, a curator or archivist could use a logical image to
capture only the contents of a drawer (or computer directory)
labeled 'photos intended for archive.' There are advantages and
disadvantages to both types of image file.5
Unfortunately, most people who transfer their disks and
computers to archival repositories aren't aware of the existence
of deleted files and temporary files. In fact, few people
remember anything at all about the contents of their older
digital media - a problem compounded by a lack of access to
the machines and drives necessary to access obsolete disk
formats. In other words, archival repositories receive computers
and other media that contain not only files that an individual
has forgotten about, but also files that she moved to the
Recycle Bin with the intention of deleting later, or files that
she actually deleted but may still be recoverable from the file
system. Software such as FTK Imager, which was developed for
use by forensic investigators, can reveal the presence of
deleted, partial, and hidden files in disk images.6
Figure 1 shows a screenshot of a USB drive viewed in FTK
Imager, which is a no-cost imaging tool developed by Access-
Data.7 The files with icons marked with a red 'X' are deleted
files not visible in a typical directory view.
The presence and potential recoverability of such files raises
interesting questions about an archival repository's ethical
obligations when working with born-digital materials. Does
a repository have an ethical obligation to an individual who
donates digital media? Should a repository consider the interests
of researchers and the shape of the historical record when
deciding which born-digital materials to capture, preserve for
the long-term, and make available to researchers?
These questions become more nuanced when we consider the
fact that capturing content and providing access to it are two
different things. For example, a repository might decide to
capture forensic disk images of all digital media for preservation
purposes, but implement an access policy that restricts disk
images as well as deleted, hidden, and partial files from being
made available to researchers. But should a repository promise
not to provide access to certain types of files if it doesn't have
a system in place to manage restrictions at the file level?
The arguments for restricting access to deleted files are easier to
make in the abstract. This past summer I provided a researcher
with access to an American writer's born-digital files in the
Beinecke's reading room. Several of the disk images contained
deleted files; in accordance with policies the Beinecke is in the
process of drafting, I exported access copies of only the files that
had been intentionally kept on the disks, skipping over all of the
deleted, hidden, and partial files. Because this writer's deleted
and partial files contained draft fragments from several of her
works, the decision not to provide access to these particular
types of files felt significant. What if the writer's deleted files
contained information that might have changed the trajectory
of the researcher's work? Are these particular deleted drafts
represented elsewhere in the born-digital or paper portions of
this writer's collection? As of this writing, I don't know the
answers to these questions.
Figure 2 provides an example of recoverable content from a
deleted file. In this screen shot, FTK Imager is the program being
used to preview the contents of the disk image; file-viewing
software called QuickViewPlus renders the contents of the
selected file, as well as metadata.8
Han*
1 Type
1 totrtfedfied
-_TWH ■PMOTHWf
12
He So*
■Perran^Vïtiivii
Hcguli Ht
5/4/20 |40;OS:...
j Pes
12
He Slack
44
He
1/20/2314 9: ?S
7)
I/Jl/3014 1ft 1-
■5) WCJtaw IJTen^lowv,
Begda'Hc
J/I0/»145;»,„
«M OI55B1T ATIOH
3,047
Fie
i/Zl/2014B:17.
xin-DtsisUTiOfj-»...
U>
He Sack
rijTV.Jt -p«rfor4*<ftv*ig.
01
fieaüfiie
-vim 14
14
FIc3m4
k 1 TVift f'PTvWArzrv. «b,
41
He
14,®U 12:54
41
GjegJv He
5/6/2014
41 TV.f! -P&ianaAriry.Tic
41
Repiaf He
516/20:41:»:...
-PïWiUUtevw*.
41
Fit
4Jtv.H fpwuUiifnin.
41
teg
IM3H4
41
ftegtiv He
SB.'»H 1:35:...
41
fcetjJa Fie
5/6/2014 fcjfe*,
fjjiv.s AmuUfdtvfig.
59
B.t&iit He
5/6/2014 1:4ft..,
frraiullntr.iig.
■teuifrHc
SB/30141:44;..,
fillVAfcTHnélArthiiij.
40
RepJ* He
SB/20141:47:..,
CO
ftepia He
SB/20141:4ft,,,
Figure 1. Deleted files from my own USB drive as seen in FTK Imager.
nummer 3 201 5 23
