Background

Computer forensics is an applied field originating in law enforcement, security, and national defense. It is concerned with recovering, authenticating, and analyzing data in digital formats to the standard of admissibility in a legal setting. While its purview may have once been narrow and specialized (nabbing black hat hackers or white collar “cybercriminals”), the increasing ubiquity of computers and electronic devices means computer forensics is now employed in a wide variety of cases and circumstances. The floppy disk used to pinpoint the identity of the “BTK Killer” and the GPS device carried by the Washington DC sniper duo—which yielded critical trial evidence—are two recent, high-profile examples. Computer forensics is also now routinely employed in counter-terrorism and military intelligence.

While such activities may seem (happily) far removed from the concerns of the cultural heritage sector, the methods and tools developed by forensics experts represent a novel approach to key issues and challenges in the archives community. Libraries, special collections, and other repositories increasingly receive computer storage media (and sometimes entire computers) as part of their acquisition of “papers” from contemporary artists, writers, musicians, government officials, politicians, scholars, and other public figures. Cell phones, e-readers, and other data-rich devices will surely follow. The same forensics software that indexes a criminal suspect’s hard drive allows the archivist to prepare a comprehensive manifest of the electronic files a donor has turned over for accession; the same hardware that allows the forensics specialist to create an algorithmically authenticated “image” of a file system allows the archivist to ensure the integrity of digital content once committed to an institutional repository; the same data recovery procedures that allow the specialist to discover, recover, and present as trial evidence an “erased” file may allow a scholar to reconstruct a lost or inadvertently deleted version of an electronic manuscript—and do so with enough confidence to stake reputation and career.

Computer forensics therefore offers archivists and patrons new tools, new methodologies, and new capabilities. Yet as even this brief description must suggest, computer forensics does not impact archival practice solely at level of procedures and tools. Its methods and outcomes raise important legal, ethical, and qualitative questions about the nature of the cultural record, the boundaries between public and private knowledge, and the role and responsibility of donor, archivist, and the public in a new technological era.

The organizers of this meeting, Matthew Kirschenbaum, Richard Ovenden, and Gabriela Redwine, are preparing a report exploring the field of computer forensics in relation to born-digital cultural heritage materials, to be published by the Council of Library and Information Resources (CLIR). The report will be entitled Computer Forensics and Born-Digital Content in Cultural Heritage Collections. This meeting is being held for the specific purpose of commenting on a draft version of the report before its final publication, as well as to serve as the catalyst for increased contact between expert personnel these two otherwise seemingly disparate fields, thereby leading to more regular occasions for knowledge exchange as well as, where appropriate, the development of shared research agendas.