MARA 284-11 (3-Units)
Seminar in Archives & Records Management
Topic: Digital Forensics For Archivists: An introduction
Fall 2021 Syllabus

Mr. Michael G. Olson
Other contact information: cell phone (831) 975-8173
Office Location/Hours: Virtual office hours by appointment.

Syllabus Links
Canvas Login and Tutorials
iSchool eBookstore

Canvas Information: Courses will be available beginning August 19th at 6 am PT unless you are taking an intensive or one-unit or two-unit class that starts on a different day. In that case, the class will open on the first day that the class meets.

You will be enrolled into the Canvas site automatically.

Course Description

This seminar will introduce the unique properties of born-digital records and explore the role of digital forensics in archival record management. Discover forensic tools and processes used by archivists to identify and extract collections from computer storage media (e.g. floppy disks, hard drives, thumb drives, CDs) and from cloud-based services. Explore how born-digital records introduce unique ethical and legal issues and through tutorials and hands-on exercises gain a foundational understanding of how digital forensics can be applied in archives.  

Course Requirements


Lectures, discussions, assignments, and rubrics will be posted to the Canvas course management system. Links to additional materials will be provided in Canvas as well.

Grading will be based on a total accumulation of possible 100 points, distributed as follows:

  • Class Participation and Discussion - 30 points (30% of final grade).
    • Participation in weekly class discussions.
    • Due: Weekly.
    • Supports CLOs #1-3 and Core Competencies A, D, G.
  • Blog / Processing plan - 10 points (10% of final grade).
    • Blog post or processing plan.
    • Due August 29, 2021 @ 11:59 PM.
    • Supports CLOs #23 and Core Comps A, D.
  • Assignment 1 - 10 points (10% of final grade).
    • Multiple choice and short answer.
    • Due October 3, 2021 @ 11:59 PM. 
    • Supports CLOs #1-3 and Core Competencies A, D, G.
  • Assignment 2 - 10 Points (10% of final grade).
    • Small practical assignment OR short answer on disk imaging.
    • Due October 24, 2021 @ 11:59 PM.
    • Supports CLOs 2-3 # and Core Competancy D.
  • Class project or essay - 40 points (40% of final grade).
    • Essay OR practical assignment using BitCurator or Emulation
    • Due Sunday, November 14, 2021 @ 11:59 PM.
    • Supports CLOs #1-3 and Core Competencies A, D, G.

Late assignments will not be accepted after 5 days past the due date. Late assignments submitted after the assignment deadline will receive a 10% point reduction for each day up to 5 days based on the total point value of the assignment. No points will be awarded after 5 days late.

Discussion board postings will not be accepted for credit after the module's discussion has ended on Sunday at 11:59 PM.

All course materials except the final assignment must be completed by the last day of the class.  The due date for the final culminating assignment is November 14th, 2021.  

NOTE: Students should provide their initial discussion board posts by the first Saturday of each module by 11:59 PM (Pacific Time), to leave ample time for follow-up discussion. Please participate early and actively in the required discussions.  

Details for all of the discussions and assignments will be provided in Canvas.

Assignments Due
Unless otherwise noted, each module begins on Monday and ends on the following Sunday.  This seminar will start on on Wednesday August 19th with an overview of the seminar.. Assignments are due by 11:59 PM (Pacific Time) on the due date.

Course Topics

Lesson Topics

Week 1: August 19 - August 22

Introduction to Digital Forensics

  • Welcome and seminar overview
Week 2: August 23 - August 29

Born-Digital Archival Materials

  • Fundamentals of computer systems
  • Carriers of born-digital data
  • Disk images 
  • Assignment: Blog submission / short essay
Week 3: August 30 - September 5

Forensic Hardware and Software

  • Forensic hardware
  • Disk imaging - types of capture
  • Forensic software communities
Week 4: September 6 - September 12

Digital Forensics and Preservation

  • Disk image formats
  • Metadata
  • File format identification
Week 5: September 13 - September 19


  • Community and governence
  • Introduction to the software
  • Installing the software, demos, and tutorials
Week 6: September 20 - September 26

Ethics and Legal Frameworks

  • Personally Identifiable Information (PII)
  • Data Governance models
  • Guest lecture: Processing and PII
Week 7: September 27 - October 3

Forensic Tools 1

  • Bulk Extractor, scanners, and data carving tools
  • Demo / tutorial of disk capture using tools
  • Assignment #1: Create a disk image / short essay
Week 8: October 4 - October 10

Forensic Tools 2

  • Introduction to command line forensic tools
  • Demo/tutorial of DCFLDD 
Week 9: October 11 - October 17

Emulation Fundamentals

  • Emulation and its use in the archive
  • Fair use of emulation environments / software
Week 10: October 18 - October 24

Emulation in Action

  • Oracle Virtual Box and emulation
  • Emulation as a Service
  • Assignment #2: Create an emulation environment / short essay
Week 11: October 25 - October 31


  • Email and Archives
  • Email preservation / access solutions
Week 12: November 1 - November 7 Forensic Futures
  • Born-digital scholarly works
  • Culminating Assignment due November 14.

Course Workload Expectations

Success in this course is based on the expectation that students will spend, for each unit of credit, a minimum of forty-five hours over the length of the course (normally 3 hours per unit per week with 1 of the hours used for lecture) for instruction or preparation/studying or course related activities including but not limited to internships, labs, clinical practica. Other course structures will have equivalent workload expectations as described in the syllabus.

Instructional time may include but is not limited to:
Working on posted modules or lessons prepared by the instructor; discussion forum interactions with the instructor and/or other students; making presentations and getting feedback from the instructor; attending office hours or other synchronous sessions with the instructor.

Student time outside of class:
In any seven-day period, a student is expected to be academically engaged through submitting an academic assignment; taking an exam or an interactive tutorial, or computer-assisted instruction; building websites, blogs, databases, social media presentations; attending a study group;contributing to an academic online discussion; writing papers; reading articles; conducting research; engaging in small group work.

Course Prerequisites

MARA 284 has no prequisite requirements.

Course Learning Outcomes

Upon successful completion of the course, students will be able to:

  1. Identify the legal and ethical issues that apply to born-digital archives.
  2. Apply digital forensics tools to a collection of born-digital records.
  3. Articulate how data is stored on computer storage media and how digital forensic methods support archival practices.

Core Competencies (Program Learning Outcomes)

MARA 284 supports the following core competencies:

  1. A Articulate the ethics and values of archivists, records managers, and/or information professionals and discuss their role in social memory and organizational accountability.
  2. D Apply basic concepts and principles to identify, evaluate, select, organize, maintain, and provide access to physical and digital information assets.
  3. G Describe the legal requirements and ethical principles involved in managing physical and digital information assets and the information professional#s role in institutional compliance and risk management.


Required Textbooks:

  • AIMS Work Group (2012). AIMS born-digital collections: An inter-institutional model for stewardship. Available free PDF from PUBLISHERarrow gif indicating link outside sjsu domain
  • EMC Education Services, (Ed.). (2012). Information storage and management: Storing, managing, and protecting digital information in classic, virtualized, and cloud environments. John Wiley & Sons. Available free eBook through King Libaryarrow gif indicating link outside sjsu domain
  • John, J. L. (2012). Digital forensics and preservation DPC technology watch report. Digital Preservation Coalition in association with Charles Beagrie Ltd. Available through Free Online Download Availablearrow gif indicating link outside sjsu domain
  • Kirschenbaum, M. G., Ovenden, R., Redwine, G., & Donahue, R. (2010). Digital forensics and born-digital content in cultural heritage collections. Council on Library and Information Resources. Available as free PDF download: CLIR Publication # 149 or to purchase at: CLIR Online.arrow gif indicating link outside sjsu domain
  • Shein, C. (2014). From accession to access: A born-digital materials case study. Journal of Western Archives. Available through Free Online Downloadarrow gif indicating link outside sjsu domain

Grading Scale

The standard SJSU School of Information Grading Scale is utilized for all iSchool courses:

97 to 100 A
94 to 96 A minus
91 to 93 B plus
88 to 90 B
85 to 87 B minus
82 to 84 C plus
79 to 81 C
76 to 78 C minus
73 to 75 D plus
70 to 72 D
67 to 69 D minus
Below 67 F


In order to provide consistent guidelines for assessment for graduate level work in the School, these terms are applied to letter grades:

  • C represents Adequate work; a grade of "C" counts for credit for the course;
  • B represents Good work; a grade of "B" clearly meets the standards for graduate level work or undergraduate (for BS-ISDA);
    For core courses in the MLIS program (not MARA, Informatics, BS-ISDA) — INFO 200, INFO 202, INFO 204 — the iSchool requires that students earn a B in the course. If the grade is less than B (B- or lower) after the first attempt you will be placed on administrative probation. You must repeat the class if you wish to stay in the program. If - on the second attempt - you do not pass the class with a grade of B or better (not B- but B) you will be disqualified.
  • A represents Exceptional work; a grade of "A" will be assigned for outstanding work only.

Graduate Students are advised that it is their responsibility to maintain a 3.0 Grade Point Average (GPA). Undergraduates must maintain a 2.0 Grade Point Average (GPA).

University Policies

Per University Policy S16-9, university-wide policy information relevant to all courses, such as academic integrity, accommodations, etc. will be available on Office of Graduate and Undergraduate Programs' Syllabus Information web page at: Make sure to visit this page, review and be familiar with these university policies and resources.

In order to request an accommodation in a class please contact the Accessible Education Center and register via the MyAEC portal.

icon showing link leads to the PDF file viewer known as Acrobat Reader Download Adobe Acrobat Reader to access PDF files.

More accessibility resources.