![digital forensics procedures windows vs linux mac os digital forensics procedures windows vs linux mac os](https://cdn.educba.com/academy/wp-content/uploads/2018/06/Linux-vs-Windows-1-1.png)
#Digital forensics procedures windows vs linux mac os software#
In addition to drives of the requisite size (typically 3.5″ and 5.25″), one also needs a controller (circuitry to control the drive) and appropriate software to run the imaging process. In most cases, the right tools make imaging disks relatively straightforward. In this my approach differs not at all from standard digital forensics methodology. Write blocking is critical in the imaging process in order to prevent inadvertent alterations to the source media. This has the benefit of minimizing the handling of the original floppy media, and provides a baseline known good state to control for inadvertent changes that could be introduced by subsequent manipulation of the contents. Any further manipulation of the disk contents (such as content extraction) is done from a copy of the disk image. The first step in any kind of data recovery from floppy media is to create a disk image, a sector by sector copy of the entire disk, including the parts of the disk not normally seen by users (boot sector, file table, sector numbering, data marked deleted but not yet overwritten). Tools developed by the software preservation and retro-computing communities are generally far more useful as the cases described below will illustrate. While forensic techniques are still, broadly speaking, applicable, in most cases it does not make sense to apply tools developed by the digital forensics community to the problem of data retrieval from floppy disks. The observation “Forensic techniques and tools will not eliminate the problems presented by older media, but they can make certain parts of the preservation process more efficient and more secure” points in the direction my argument will take, but I would argue it does not sufficiently stress the distinction between forensic tools and forensic techniques. We should not therefore expect to approach the very small amounts of boutique data found on floppy disks with the same tools we use to wrangle the vast amounts of content on newer hard drives. Far more than in our own time, digital information from the 1980s was deeply enmeshed in the particular platforms, operating systems and applications that created it. While the volumes of data were often miniscule by contemporary standards, a wide range of computing systems developed by competing vendors implemented proprietary technologies up and down the stack, from disk encodings to file systems to applications and their associated file formats. In the 1980s however these conditions were reversed. The major challenge is managing the sheer volume of data that is stored on modern systems. Relative to earlier eras, today we enjoy a high level of standardization in our computing environments and routinely expect digital content to be intelligible across multiple platforms. I would argue instead that floppy disks from the 1980s are a separate problem domain requiring specialized tools from outside the digital forensics community. As evidenced by disk imaging toolkits such as those found in Archivematica and BitCurator much of our current practice reflects the assumption that tools derived from the domain of digital forensics can productively be applied to all types of digital media, from 1980s floppy disks through contemporary hard drives. While my main reason for writing this paper is the hope that my methods may prove useful to others confronted with similar problems, these case studies are also intended to support a larger argument. The researchers’ interests were best served by simple file recovery, sometimes involving format conversion, while materials destined for archival preservation required a more structured and consistent process. The different requirements of these use cases also affected the processes employed to retrieve information. Specifically, this paper describes the tools and techniques I have used to recover content saved to 5.25″ and 3.5″ floppy media from the following systems:įloppy disks were sourced by way of donations to our Archives, from materials in the Library collection, and from researchers seeking to access materials on early computing media from their own collections. Disks from different sources exhibited many unique characteristics and required specialized processing to extract the content in a usable form. In the context of several projects completed over the past two years I have recovered data from approximately 500 floppy disks.
![digital forensics procedures windows vs linux mac os digital forensics procedures windows vs linux mac os](https://gigabytekingdom.com/wp-content/uploads/2021/10/Windows-vs-Mac-vs-Linux.jpg)
In this paper I will discuss tools and techniques I have employed to retrieve content on floppy disks from various 8- and 16-bit computer systems dating from the 1980s. John Durno, University of Victoria Libraries Introduction