MARA 284-11 (2-Units)
Seminar in Archives & Records Management
Topic: Digital Forensics For Archivists: An introduction
Fall 2020 Syllabus

Mr. Michael G. Olson
Other contact information: cell phone (831) 975-8173
Office Location/Hours: Virtual office hours by appointment.

Syllabus Links
Canvas Login and Tutorials
iSchool eBookstore

Canvas Information: Courses will be available beginning August 19th at 6 am PT unless you are taking an intensive or one-unit or two-unit class that starts on a different day. In that case, the class will open on the first day that the class meets.

This 2-unit course runs from August 19th - October 14th. It will be available on Canvas on August 19th.

You will be enrolled into the Canvas site automatically.

Course Description

This seminar will introduce the unique properties of born-digital records and explore the role of digital forensics in archival record management. Discover forensic tools and processes used by archivists to identify and extract collections from computer storage media (e.g. floppy disks, hard drives, thumb drives, CDs) and from cloud-based services. Explore how born-digital records introduce unique ethical and legal issues and through tutorials and hands-on exercises gain a foundational understanding of how digital forensics can be applied in archives.

Course Requirements


Lectures, discussions, assignments, and rubrics will be posted to the Canvas course management system. Links to additional materials will be provided in Canvas as well.

Grading will be based on a total accumulation of possible 100 points, distributed as follows:

  • Class Participation and Discussion - 30 points (30% of final grade).
    • Participation in weekly class discussions.
    • Due: Weekly.
    • Supports CLOs #1-3 and Core Competencies A, D, G.
  • Blog - 10 points (10% of final grade).
    • Write a blog post or processing plan that describes how and why you would apply digital forensics tools to a born-digital collection.
    • Due August 25, 2019 @ 11:59 PM.
    • Supports CLOs #23 and Core Comps A, D.
  • Quiz - 10 points (10% of final grade).
    • Multiple choice and short answer.
    • Due September 8, 2019 @ 11:59 PM. 
    • Supports CLOs #1-3 and Core Competencies A, D, G.
  • Assignment - 10 Points (10% of final grade).
    • Small practical assignment OR short answer on disk imaging.
    • Due September 29, 2019 @ 11:59 PM.
    • Supports CLOs 2-3 # and Core Competancy D.
  • Class project or essay - 40 points (40% of final grade).
    • Essay OR practical assignment using BitCurator.
    • Due October 16th, 2019 @ 11:59 PM.
    • Supports CLOs #1-3 and Core Competencies A, D, G.

Late assignments will not be accepted after 5 days past the due date. Late assignments submitted after the assignment deadline will receive a 10% point reduction for each day up to 5 days based on the total point value of the assignment. No points will be awarded after 5 days late.

Discussion board postings will not be accepted for credit after the module's discussion has ended on Tuesday at 11:59 PM.

All course materials must be completed by the last day of the class.

NOTE: Students should provide their initial discussion board posts by the first Saturday of each module by 11:59 PM (Pacific Time), to leave ample time for follow-up discussion. Please participate early and actively in the required discussions.

Details for all of the discussions and assignments will be provided in Canvas.

Assignments Due
Unless otherwise noted, each module begins on Wednesday and ends on the following Tuesday. Assignments will be due by 11:59 PM (Pacific Time) on the due date.

Course Topics

Lesson Topics

Week 1: August 19 - August 25

Introduction to Digital Forensics

  • Welcome and seminar overview
  • Information systems/born-digital records
  • Carriers of born-digital materials 
Week 2: August 26 - September 1

Forensic Hardware and Software

  • Forensic hardware
  • Disk imaging - types of capture
  • Forensic software communities
Week 3: September 2 - September 8

Digital Forensics and Preservation

  • Disk image formats
  • Metadata
  • File format identification
Week 4: September 9 - September 15


  • Community and governence
  • Introduction to the software
  • Installing the software, demos, and tutorials
Week 5: September 16 - September 22

Ethics and Legal Frameworks

  • Personally Identifiable Information (PII)
  • Data Governance models
  • Guest lecture: Processing and PII
Week 6: September 23 - September 29

Forensic Software - advanced features

  • Bulk Extractor, scanners, and data carving tools
  • Demo/tutorial of disk capture
Week 7: September 30 - October 6

Forensics and Archival Technologies

  • Emulation
  • Email
Week 8: October 7 - October 13 Forensic Futures
  • New projects and trends
  • Discussion of culminating assignment

Course Workload Expectations

Success in this course is based on the expectation that students will spend, for each unit of credit, a minimum of forty-five hours over the length of the course (normally 3 hours per unit per week with 1 of the hours used for lecture) for instruction or preparation/studying or course related activities including but not limited to internships, labs, clinical practica. Other course structures will have equivalent workload expectations as described in the syllabus.

Instructional time may include but is not limited to:
Working on posted modules or lessons prepared by the instructor; discussion forum interactions with the instructor and/or other students; making presentations and getting feedback from the instructor; attending office hours or other synchronous sessions with the instructor.

Student time outside of class:
In any seven-day period, a student is expected to be academically engaged through submitting an academic assignment; taking an exam or an interactive tutorial, or computer-assisted instruction; building websites, blogs, databases, social media presentations; attending a study group;contributing to an academic online discussion; writing papers; reading articles; conducting research; engaging in small group work.

Course Prerequisites

MARA 284 - Digital Forensics for Archivists (2 units) has no prerequisite requirements. 

Course Learning Outcomes

Upon successful completion of the course, students will be able to:

  1. Identify the legal and ethical issues that apply to born-digital archives.
  2. Apply digital forensics tools to a collection of born-digital records.
  3. Articulate how data is stored on computer storage media and how digital forensic methods support archival practices.

Core Competencies (Program Learning Outcomes)

MARA 284 supports the following core competencies:

  1. A Articulate the ethics and values of archivists, records managers, and/or information professionals and discuss their role in social memory and organizational accountability.
  2. D Apply basic concepts and principles to identify, evaluate, select, organize, maintain, and provide access to physical and digital information assets.
  3. G Describe the legal requirements and ethical principles involved in managing physical and digital information assets and the information professional#s role in institutional compliance and risk management.


Required Textbooks:

  • AIMS Work Group (2012). AIMS born-digital collections: An inter-institutional model for stewardship.. Available free PDF from PUBLISHERarrow gif indicating link outside sjsu domain
  • Kirschenbaum, M. G., Ovenden, R., Redwine, G., & Donahue, R. (2010). Digital forensics and born-digital content in cultural heritage collections. Washington, DC: Council on Library and Information Resources. Available as free PDF download: CLIR Publication # 149 or to purchase at: CLIR Online.arrow gif indicating link outside sjsu domain
  • Whitman, M. E., & Mattord, H. J. (2018). Principles of information security (6th ed.). Boston, MA: Cengage Learning. Available through Amazon: 1337102067arrow gif indicating link outside sjsu domain
  • Wilsey, L., Skirvin, R., Chan, P., & Edwards, G. (2013). . Journal of Western Archives. Available through Free Online Downloadarrow gif indicating link outside sjsu domain

Recommended Textbooks:

  • John, J. L. (2012). Digital forensics and preservation DPC technology watch report. Digital Preservation Coalition in association with Charles Beagrie Ltd. . Available through Free Online Download Availablearrow gif indicating link outside sjsu domain

Grading Scale

The standard SJSU School of Information Grading Scale is utilized for all iSchool courses:

97 to 100 A
94 to 96 A minus
91 to 93 B plus
88 to 90 B
85 to 87 B minus
82 to 84 C plus
79 to 81 C
76 to 78 C minus
73 to 75 D plus
70 to 72 D
67 to 69 D minus
Below 67 F


In order to provide consistent guidelines for assessment for graduate level work in the School, these terms are applied to letter grades:

  • C represents Adequate work; a grade of "C" counts for credit for the course;
  • B represents Good work; a grade of "B" clearly meets the standards for graduate level work;
    For core courses in the MLIS program (not MARA or Informatics) — INFO 200, INFO 202, INFO 204 — the iSchool requires that students earn a B in the course. If the grade is less than B (B- or lower) after the first attempt you will be placed on administrative probation. You must repeat the class if you wish to stay in the program. If - on the second attempt - you do not pass the class with a grade of B or better (not B- but B) you will be disqualified.
  • A represents Exceptional work; a grade of "A" will be assigned for outstanding work only.

Students are advised that it is their responsibility to maintain a 3.0 Grade Point Average (GPA).

University Policies

Per University Policy S16-9, university-wide policy information relevant to all courses, such as academic integrity, accommodations, etc. will be available on Office of Graduate and Undergraduate Programs' Syllabus Information web page at: Make sure to visit this page, review and be familiar with these university policies and resources.

In order to request an accommodation in a class please contact the Accessible Education Center and register via the MyAEC portal.

icon showing link leads to the PDF file viewer known as Acrobat Reader Download Adobe Acrobat Reader to access PDF files.

More accessibility resources.