MARA 284-11
Seminar in Archives & Records Management
Topic: Digital Forensics For Archivists: An introduction
Fall 2018 Syllabus

Mr. Michael G. Olson
Other contact information: cell phone (831) 975-8173
Office Location/Hours: Virtual office hours by appointment.

Syllabus Links
Canvas Login and Tutorials
iSchool eBookstore

Canvas Information: Courses will be available beginning August 21st at 6 am PT unless you are taking an intensive or one-unit or two-unit class that starts on a different day. In that case, the class will open on the first day that the class meets.

You will be enrolled into the Canvas site automatically.

Course Description

This seminar will introduce the unique properties of born-digital records and explore the role of digital forensics in archival record management. Discover forensic tools and processes used by archivists to identify and extract collections from computer storage media (e.g. floppy disks, hard drives, thumb drives, CDs) and from cloud-based services. Explore how born-digital records introduce unique ethical and legal issues and through tutorials and hands-on exercises gain a foundational understanding of how digital forensics can be applied in archives.

Course Requirements


Lectures, discussions, assignments, and rubrics will be posted to the Canvas course management system. Links to additional materials will be provided in Canvas as well.

Grading will be based on a total accumulation of possible 100 points, distributed as follows:

  • Class Participation and Discussion - 30 points (30% of final grade).
    • Participation in weekly class discussions.
    • Due: Weekly.
    • Supports CLOs #1-3 and Core Competencies A, D, G.
  • Blog - 10 points (10% of final grade).
    • Write a blog post that describes how and why you would apply digital forensics tools to a born-digital collection.
    • Supports CLOs #2, 3 and Core Comps A, D.
  • Quiz - 10 points (10% of final grade).
    • Multiple choice and short answer.
    • Supports CLOs #1-3 and Core Competencies A, D, G.
  • Assignment - 10 Points (10% of final grade).
    • Small practical assignment OR short answer on disk imaging.
    • Supports CLOs 2-3 # and Core Competancy D.
  • Class project or essay - 40 points (40% of final grade).
    • Essay OR practical assignment using BitCurator.
    • Due September 19, 11:59 PM.
    • Supports CLOs #1-3 and Core Competencies A, D, G.

Late assignments will not be accepted after 5 days past the due date. Late assignments submitted after the assignment deadline will receive a 10% point reduction for each day up to 5 days based on the total point value of the assignment. No points will be awarded after 5 days late.

Discussion board postings will not be accepted for credit after the module's discussion has ended on Sunday at 11:59 PM.

All course materials must be completed by the last day of the class.

NOTE: Students should provide their initial discussion board posts by the first Wednesday of each module by 11:59 PM (Pacific Time), to leave ample time for follow-up discussion. Please participate early and actively in the required discussions.

Details for all of the discussions and assignments will be provided in Canvas.

Assignments Due
Unless otherwise noted, each module begins on Monday and ends on Sunday. Assignments will be due by 11:59 PM (Pacific Time) on the due date.

Course Topics

Lesson Topics

Week 1: Oct 15 - Oct 21

Introduction to Digital Forensics

  • Welcome and seminar overview
  • Information systems/born-digital records
  • Carriers of born-digital materials 
Week 2: Oct 22 - Oct 28

Forensic Hardware and Software

  • Forensic hardware
  • Disk imaging - types of capture
  • Forensic software communities
Week 3: Oct 29 - Nov 4

Digital Forensics and Preservation

  • Disk image formats
  • Metadata
  • File format identification
Week 4: Nov 5 - Nov 11


  • Community and governence
  • Introduction to the software
  • Installing the software, demos, and tutorials
Week 5: Nov 12 - Nov 18

Ethics and Legal Frameworks

  • Personally Identifiable Information (PII)
  • Data Governance models
  • Guest lecture: Processing and PII
Week 6: Nov 19 - Nov 25

Forensic Software - advanced features

  • Bulk Extractor, scanners, and data carving tools
  • Demo/tutorial of disk capture
Week 7: Nov 26 - Dec 2

Forensics and Archival Technologies

  • Email
  • Web Archiving
  • Emulation
Week 8: Dec 3 - Dec 9 Forensic Futures
  • New projects and trends
  • Discussion of culminating assignment

Course Workload Expectations

Success in this course is based on the expectation that students will spend, for each unit of credit, a minimum of forty-five hours over the length of the course (normally 3 hours per unit per week with 1 of the hours used for lecture) for instruction or preparation/studying or course related activities including but not limited to internships, labs, clinical practica. Other course structures will have equivalent workload expectations as described in the syllabus.

Instructional time may include but is not limited to:
Working on posted modules or lessons prepared by the instructor; discussion forum interactions with the instructor and/or other students; making presentations and getting feedback from the instructor; attending office hours or other synchronous sessions with the instructor.

Student time outside of class:
In any seven-day period, a student is expected to be academically engaged through submitting an academic assignment; taking an exam or an interactive tutorial, or computer-assisted instruction; building websites, blogs, databases, social media presentations; attending a study group;contributing to an academic online discussion; writing papers; reading articles; conducting research; engaging in small group work.

Course Prerequisites

MARA 284 has no prequisite requirements.

Course Learning Outcomes

Upon successful completion of the course, students will be able to:

  1. Identify the legal and ethical issues that apply to born-digital archives.
  2. Apply digital forensics tools to a collection of born-digital records.
  3. Articulate how data is stored on computer storage media and how digital forensic methods support archival practices.

Core Competencies (Program Learning Outcomes)

MARA 284 supports the following core competencies:

  1. A Articulate the ethics and values of archivists, records managers, and/or information professionals and discuss their role in social memory and organizational accountability.
  2. D Apply basic concepts and principles to identify, evaluate, select, organize, maintain, and provide access to physical and digital information assets.
  3. G Describe the legal requirements and ethical principles involved in managing physical and digital information assets and the information professional#s role in institutional compliance and risk management.


Required Textbooks:

  • AIMS Work Group (2012). AIMS born-digital collections: An inter-institutional model for stewardship. Available free PDF from PUBLISHERarrow gif indicating link outside sjsu domain
  • EMC Education Services, (Ed.). (2012). Information storage and management: Storing, managing, and protecting digital information in classic, virtualized, and cloud environments. John Wiley & Sons. Available free eBook through King Libaryarrow gif indicating link outside sjsu domain
  • Kirschenbaum, M. G., Ovenden, R., Redwine, G., & Donahue, R. (2010). Digital forensics and born-digital content in cultural heritage collections. Council on Library and Information Resources. Available as free PDF download: CLIR Publication # 149 or to purchase at: CLIR Online.arrow gif indicating link outside sjsu domain
  • Whitman, M. E., & Mattord, H. J. (2018). Principles of information security (6th ed.). Cengage. Available through Amazon: 1337102067arrow gif indicating link outside sjsu domain
  • Wilsey, L., Skirvin, R., Chan, P., & Edwards, G. (2013). Journal of Western Archives. Available through Free Online Downloadarrow gif indicating link outside sjsu domain

Recommended Textbooks:

  • John, J. L. (2012). Digital forensics and preservation DPC technology watch report. Digital Preservation Coalition in association with Charles Beagrie Ltd. Available through Free Online Download Availablearrow gif indicating link outside sjsu domain
  • Oachs, P., & Watters, A. (2016). Health information management: Concepts, principles and practice (5th ed.). AHIMA Press. Available through Amazon: 1584265140arrow gif indicating link outside sjsu domain
  • Shein, C. (2014). From accession to access: A born-digital materials case study. Journal of Western Archives. Available through Free Online Downloadarrow gif indicating link outside sjsu domain

Grading Scale

The standard SJSU School of Information Grading Scale is utilized for all iSchool courses:

97 to 100 A
94 to 96 A minus
91 to 93 B plus
88 to 90 B
85 to 87 B minus
82 to 84 C plus
79 to 81 C
76 to 78 C minus
73 to 75 D plus
70 to 72 D
67 to 69 D minus
Below 67 F


In order to provide consistent guidelines for assessment for graduate level work in the School, these terms are applied to letter grades:

  • C represents Adequate work; a grade of "C" counts for credit for the course;
  • B represents Good work; a grade of "B" clearly meets the standards for graduate level work or undergraduate (for BS-ISDA);
    For core courses in the MLIS program (not MARA, Informatics, BS-ISDA) — INFO 200, INFO 202, INFO 204 — the iSchool requires that students earn a B in the course. If the grade is less than B (B- or lower) after the first attempt you will be placed on administrative probation. You must repeat the class if you wish to stay in the program. If - on the second attempt - you do not pass the class with a grade of B or better (not B- but B) you will be disqualified.
  • A represents Exceptional work; a grade of "A" will be assigned for outstanding work only.

Graduate Students are advised that it is their responsibility to maintain a 3.0 Grade Point Average (GPA). Undergraduates must maintain a 2.0 Grade Point Average (GPA).

University Policies

Per University Policy S16-9, university-wide policy information relevant to all courses, such as academic integrity, accommodations, etc. will be available on Office of Graduate and Undergraduate Programs' Syllabus Information web page at: Make sure to visit this page, review and be familiar with these university policies and resources.

In order to request an accommodation in a class please contact the Accessible Education Center and register via the MyAEC portal.

icon showing link leads to the PDF file viewer known as Acrobat Reader Download Adobe Acrobat Reader to access PDF files.

More accessibility resources.