Levels of Representation (How it works)

INLS 525: Managing Electronic Records

Week 3 (1/29)

Digital Materiality of Digital Culture

Which matters (more) to an Archivist?

Looking "...beyond the magic to the mechanism."

Looking at an "'opaque technology,' whereby people take the computer at 'interface value'"

What, after all, is being collected?

How Computers Remember

Bits will be Bits (But not for Long)

"Errors typically occur at the juncture between analog and digital states, such as when a drive's magnetoresistive head assigns binary symbolic value to the voltage differentials it has registered, or when an e-mail message is reconstituted from independent data packets moving across the TCP/IP layer of the Internet, itself dependent on fiber-optic cables and other hardwired technologies. All forms of modern digital technology incorporate hyper-redundant error-checking routines that serve to sustain an illusion of immateriality by detecting error and correcting it, reviving the quality of the signal, like old-fashioned telegraph relays, such that any degradation suffered during a subsequent interval of transmission will not fall beyond whatever tolerances of symbolic integrity exist past which the original value of the signal (or identity of the symbol) cannot be reconstituted." (p.12, emphasis mine)

Kirschenbaum, Matthew G. Mechanisms: New Media and the Forensic Imagination. Cambridge, MA: MIT Press, 2008.

Where and how does a computer store information?

Motivations for Storage Hierarchy

Tiered Storage


How Disks Work

Low-Level – Sectors and Clusters



File Slack

File slack description

Carrier, Brian. File System Forensic Analysis. Boston, MA: Addison-Wesley, 2005.

Magnetic Disk (e.g. Hard Drive or Floppy)

Hard Drive structure.

Optical Media - CD-ROM

Optical media layers.

Volumes and Partitions

File System

File System Examples

Microsoft: FAT & NTFS


Example of FAT16's structure

Mikhail, Ranish. “Partitioning Primer.” August 5, 1998.

What "Deletion" Does

Filename's first character is marked hxE5; FAT pointers to clusters are marked "free" in turn. The actual clusters are untouched.

Duong, Duc. "I/O devices and File systems." Vietnam OpenCourseWare. November 18, 2008.


File Systems for Unix

Directory list -> inode metadata -> blocks

Farmer, Dan, and Wietse Venema. Forensic Discovery. Upper Saddle River, NJ: Addison-Wesley, 2005. Figure 3.2: Simplified structure of the UNIX file system

"Archive" Formats - Portable File Systems

Linux filesystem hierarchy

Linuxconfig.org – Filesytem Basics.

Temporary Data Locations

Configuration & Log Files

Examine a Flash Drive

Right-click the drive letter and select "Properties."

Note the file system says "FAT"

Go up to "Tools" and select "Folder Options...".

Note the "Show hidden files and folders" option which is off by default.

Now you will see two new files and two new folders listed with "ghost" icons.

CMD directory listing.

CMD directory listing using "/a" flag

Spotlight directory

Files with "._" are Mac resource fork entries.

Hex view of resource fork.

Another hex view of a resource fork.

Forms of “Hidden Data”

Not just what you see when you open a file in its native application.

Listed roughly in order to difficulty of identification & retrieval.

Sanitization Taxonomy

Sanitization Taxonomy levels 0-5

Garfinkel, Simson L., and Abhi Shelat. "Remembrance of Data Passed: A Study of Disk Sanitization Practices." IEEE Security and Privacy 1 (2003): 17-27.

How Computers Communicate

Layers of Protocols...

A communications protocol is a system of digital message formats and rules for exchanging those messages in or between computing systems and in telecommunications.

Request a Webpage

Mini-Assignment 3

Examine the files on your own computer.

Use one of the following TreeMap applications:

We will have small-group discussions about your results.