Looking "...beyond the magic to the mechanism."
Looking at an "'opaque technology,' whereby people take the computer at 'interface value'"
What, after all, is being collected?
"Errors typically occur at the juncture between analog and digital states, such as when a drive's magnetoresistive head assigns binary symbolic value to the voltage differentials it has registered, or when an e-mail message is reconstituted from independent data packets moving across the TCP/IP layer of the Internet, itself dependent on fiber-optic cables and other hardwired technologies. All forms of modern digital technology incorporate hyper-redundant error-checking routines that serve to sustain an illusion of immateriality by detecting error and correcting it, reviving the quality of the signal, like old-fashioned telegraph relays, such that any degradation suffered during a subsequent interval of transmission will not fall beyond whatever tolerances of symbolic integrity exist past which the original value of the signal (or identity of the symbol) cannot be reconstituted." (p.12, emphasis mine)
Kirschenbaum, Matthew G. Mechanisms: New Media and the Forensic Imagination. Cambridge, MA: MIT Press, 2008.
Where and how does a computer store information?
Carrier, Brian. File System Forensic Analysis. Boston, MA: Addison-Wesley, 2005.
Farmer, Dan, and Wietse Venema. Forensic Discovery. Upper Saddle River, NJ: Addison-Wesley, 2005. Figure 3.2: Simplified structure of the UNIX file system
Not just what you see when you open a file in its native application.
Listed roughly in order to difficulty of identification & retrieval.
Garfinkel, Simson L., and Abhi Shelat. "Remembrance of Data Passed: A Study of Disk Sanitization Practices." IEEE Security and Privacy 1 (2003): 17-27.
Layers of Protocols...
A communications protocol is a system of digital message formats and rules for exchanging those messages in or between computing systems and in telecommunications.
Use one of the following TreeMap applications:
We will have small-group discussions about your results.