Page Comparison

When pulling files for patron requests, you may occasionally come across corrupted or incomplete disk images. These are disk images with blank file trees, file trees containing only program files (see image below), or disk images that, when analyzed in Disk Image Processor, output error/"Cannot read DFXML" messages. Be especially aware of CDs from the company RitzPic or that say they have an extent of "12 digital files, 10 MB." If you come across these CDs, scroll down to Part II - Overwritten Content.

Image Added

Part I - Corrupted or Erroneous Disk Images
These disks can have multiple things wrong with them. The following guide is not an exhaustive list, but rather steps that have previously successfully recovered missing information.

1. "Error Reading DFXML File"
   1. Some disk images appear fine, but when analyzed in Disk Image Processor come back with the message "Error Reading DFXML File." If this is the case, mount the disk image in FTK Imager and/or Autopsy to verify whether the disk image successfully extracted the content. If the files are present on the disk image but analysis continues to give an error message, mount the disk image in FTK Imager (if not already). Go to Step 3 of Part II - Overwritten Content and follow the steps to extract and analyze the files.
2. Incomplete Disk Images
   1. If a disk image shows only program files but you believe there should be collection material present, mount the disk in FTK Imager. Expanding the Evidence Tree will reveal the disk's file structure and any files present.
   2. If this attempt is unsuccessful, mount the disk in Autopsy. Analyze the disk to see if any more files appear.
   3. If this does not work, it is likely that the disk has degraded and lost all/some of its content. Feel free to come back to the disk at a later date/if you learn any new information. If it is a floppy disk, it may need to be imaged in the Kryoflux. Read the Guide to Using the Kryoflux and reach out to the Harry Ransom Center for further assistance.

Part II - Overwritten Content

...

2. If the disk image has only program/company files as in the example above, you will need to extract the files directly from the CD. Load the CD using the external CD drive and open it in FTK Imager.

...

3. When the disk is mounted, expand the file tree to view the files. You should see a "Session/Track 1" and "Session/Track 2." Track 1 will be the company generic files picked up in the disk image, and Track 2 will be the original content you want to extract.

...

7. The program will create analysis files for the folder just like Disk Image Processor creates for a disk image. When the output is complete, analyze it for malware, PII, and generated metadata.

       i. The "date modified" field will now show the date you extracted the files. For a more accurate date range in the finding aid, you can amend this to show the most recent date in the file tree.

8. Once modifications have been made, if necessary, copy the _files folder to the AIP destination (i.e., TOSHIBA EXT>2017009_02>2017009_02_252) for the files to be bagged. Replace any documentation with the correct information.

...