MARA 284-11
Seminar in Archives & Records Management
Topic: Digital Forensics For Archivists: An introduction
Fall 2017 Syllabus

Mr. Michael G. Olson
Other contact information: cell phone (831) 975-8173
Office Location/Hours: Virtual office hours by appointment.

Syllabus Links
Canvas Login and Tutorials
iSchool eBookstore

Canvas Information: Courses will be available beginning August 23rd, 6 am PDT unless you are taking an intensive or a one-unit or two-unit class that starts on a different day. In that case, the class will open on the first day that the class meets.

You will be enrolled into the Canvas site automatically.

Course Description

This seminar will introduce the unique properties of born-digital records and explore the role of digital forensics in archival record management. Discover forensic tools and processes used by archivists to identify and extract collections from computer storage media (e.g. floppy disks, hard drives, thumb drives, CDs) and from cloud based services. Explore how born-digital records introduce unique ethical and legal issues and through tutorials and hands on exercises gain a foundational understanding of how digital forensics can be applied in archives.

Course Requirements


Lectures, discussions, assignments, and rubrics will be posted to the Canvas course management system. Links to additional materials will be provided in Canvas as well.

Grading will be based on a total accumulation of possible 100 points, distributed as follows:

  • Class Participation and Discussion - 30 points (30% of final grade).
    • Participation in weekly class discussions.
    • Due: Weekly.
    • Supports CLOs #1-3 and Core Competencies A, D, G.
  • Blog - 15 points (15% of final grade).
    • Write a blog post that describes how and why you would apply digital forensics tools to a born-digital collection.
    • Due September 5, 11:59 PM.
    • Supports CLOs #2, 3 and Core Comps A, D.
  • Quiz - 15 points (15% of final grade).
    • Multiple choice and short answer.
    • Due September 12, 11:59 PM.
    • Supports CLOs #1-3 and Core Competencies A, D, G.
  • Class project or essay - 40 points (40% of final grade).
    • Essay OR practical assignment using BitCurator.
    • Due September 19, 11:59 PM.
    • Supports CLOs #1-3 and Core Competencies A, D, G.

Late assignments will not be accepted after 5 days past the due date. Late assignments submitted after the assignment deadline will receive a 10% point reduction for each day up to 5 days based on the total point value of the assignment. No points will be awarded after 5 days late.

Discussion board postings will not be accepted for credit after the module's discussion has ended on Tuesdays at 11:59 PM.

All course materials must be completed by the last day of the class.

NOTE: Students should provide their initial discussion board posts by the first Saturday of each module by 11:59 PM (Pacific Time), to leave ample time for follow-up discussion. Please participate early and actively in the required discussions.

Details for all of the discussions and assignments will be provided in Canvas.

Assignments Due
Unless otherwise noted, each module begins on Wednesday and ends on Tuesday. Assignments will be due by 11:59 PM (Pacific Time) on the due date.

Course Topics

Lesson Topics

Week 1: Aug. 23 - Aug 29

Introduction to Digital Forensics

  • Introduction to information systems/born-digital records
  • Sources of born-digital materials 
  • Digital Forensics
Week 2: Aug. 30 - Sept. 5

Forensic Tools for Archivists

  • Forensic hardware
  • Disk imaging - types of capture
  • Forensic software
  • BitCurator
Week 3: Sept. 6 - Sept. 12

Born-Digital Archives and Forensics Tools Part I

  • Personally Identifiable Information
  • Legal issues and ethics
  • Scanners
  • Demo/tutorial setting up a BitCurator environment
  • Demo/tutorial of disk capture using BitCurator Guymager
Week 4: Sept. 13 - Sept. 19

Forensic Tools Part II and Forensic Futures

  • Guest Lecture and Discussion on Futures
    • Nicholas Taylor, Web Archiving Service Manager, Stanford Libraries
  • Bulk Extractor
  • Discussion of culminating assignment


Course Workload Expectations

Success in this course is based on the expectation that students will spend, for each unit of credit, a minimum of forty-five hours over the length of the course (normally 3 hours per unit per week with 1 of the hours used for lecture) for instruction or preparation/studying or course related activities.

Course Workload Expectations

Success in this course is based on the expectation that students will spend, for each unit of credit, a minimum of forty-five hours over the length of the course (normally 3 hours per unit per week with 1 of the hours used for lecture) for instruction or preparation/studying or course related activities including but not limited to internships, labs, clinical practica. Other course structures will have equivalent workload expectations as described in the syllabus.

Instructional time may include but is not limited to:
Working on posted modules or lessons prepared by the instructor; discussion forum interactions with the instructor and/or other students; making presentations and getting feedback from the instructor; attending office hours or other synchronous sessions with the instructor.

Student time outside of class:
In any seven-day period, a student is expected to be academically engaged through submitting an academic assignment; taking an exam or an interactive tutorial, or computer-assisted instruction; building websites, blogs, databases, social media presentations; attending a study group;contributing to an academic online discussion; writing papers; reading articles; conducting research; engaging in small group work.

Course Prerequisites

MARA 284 - Digital Forensics for Archivists has no prerequisite requirements

Course Learning Outcomes

Upon successful completion of the course, students will be able to:

  1. Identify the legal and ethical issues that apply to born-digital archives.
  2. Apply digital forensics tools to a collection of born-digital records.
  3. Articulate how data is stored on computer storage media and how digital forensic methods support archival practices.

Core Competencies (Program Learning Outcomes)

MARA 284 supports the following core competencies:

  1. A Articulate the ethics and values of archivists, records managers, and/or information professionals and discuss their role in social memory and organizational accountability.
  2. D Apply basic concepts and principles to identify, evaluate, select, organize, maintain, and provide access to physical and digital information assets.
  3. G Describe the legal requirements and ethical principles involved in managing physical and digital information assets and the information professional#s role in institutional compliance and risk management.


Required Textbooks:

  • AIMS Work Group (2012). AIMS born-digital collections: An inter-institutional model for stewardship. Available free PDF from PUBLISHERarrow gif indicating link outside sjsu domain
  • EMC Education Services, (Ed.). (2012). Information storage and management: Storing, managing, and protecting digital information in classic, virtualized, and cloud environments. John Wiley & Sons. Available free eBook through King Libaryarrow gif indicating link outside sjsu domain
  • John, J. L. (2012). Digital forensics and preservation DPC technology watch report. Digital Preservation Coalition in association with Charles Beagrie Ltd. Available through Free Online Download Availablearrow gif indicating link outside sjsu domain
  • Kirschenbaum, M. G., Ovenden, R., Redwine, G., & Donahue, R. (2010). Digital forensics and born-digital content in cultural heritage collections. Council on Library and Information Resources. Available as free PDF download: CLIR Publication # 149 or to purchase at: CLIR Online.arrow gif indicating link outside sjsu domain
  • Wilsey, L., Skirvin, R., Chan, P., & Edwards, G. (2013). Journal of Western Archives. Available through Free Online Downloadarrow gif indicating link outside sjsu domain

Grading Scale

The standard SJSU School of Information Grading Scale is utilized for all iSchool courses:

97 to 100 A
94 to 96 A minus
91 to 93 B plus
88 to 90 B
85 to 87 B minus
82 to 84 C plus
79 to 81 C
76 to 78 C minus
73 to 75 D plus
70 to 72 D
67 to 69 D minus
Below 67 F


In order to provide consistent guidelines for assessment for graduate level work in the School, these terms are applied to letter grades:

  • C represents Adequate work; a grade of "C" counts for credit for the course;
  • B represents Good work; a grade of "B" clearly meets the standards for graduate level work or undergraduate (for BS-ISDA);
    For core courses in the MLIS program (not MARA, Informatics, BS-ISDA) — INFO 200, INFO 202, INFO 204 — the iSchool requires that students earn a B in the course. If the grade is less than B (B- or lower) after the first attempt you will be placed on administrative probation. You must repeat the class if you wish to stay in the program. If - on the second attempt - you do not pass the class with a grade of B or better (not B- but B) you will be disqualified.
  • A represents Exceptional work; a grade of "A" will be assigned for outstanding work only.

Graduate Students are advised that it is their responsibility to maintain a 3.0 Grade Point Average (GPA). Undergraduates must maintain a 2.0 Grade Point Average (GPA).

University Policies

Per University Policy S16-9, university-wide policy information relevant to all courses, such as academic integrity, accommodations, etc. will be available on Office of Graduate and Undergraduate Programs' Syllabus Information web page at: Make sure to visit this page, review and be familiar with these university policies and resources.

In order to request an accommodation in a class please contact the Accessible Education Center and register via the MyAEC portal.

icon showing link leads to the PDF file viewer known as Acrobat Reader Download Adobe Acrobat Reader to access PDF files.

More accessibility resources.