Researching file formats 9: Digital Forensics XML

This blog post is part of a series on file formats research. See this introduction post for more information.

Update: The official format definition is now online here: Digital Forensics XML. Comments welcome directly to the Library of Congress.

Digital Forensics XML, XML for your digital forensics.

This had me thinking about BitCurator, which is a toolkit that had several years of public funding, and some institutional tie-in, but now has a community group and I wasn’t sure about what the sustainability model for the project was? There’s a consortium, but is the membership model sustainable?

So while working on this format, I spent a lot of time thinking about the fragility of grant-funded projects that don’t have a clear path to financial sustainability, to the intense instability of links (y’know, linkrot) and general web maintenance concerns. I don’t want to imply that any of the (often always wonderful) people working on these efforts are to blame; it’s just a massive amount of work that doesn’t receive a lot of attention or acknowledgement, and it’s often a very slow build-up over time. Hardly the first person to have these thoughts, just what’s been on my mind as I receive bounce-back emails or hit broken URLs with no direct replacement or backup copy.

I’m a bit worried about this google doc, because gdocs are really sensitive to being randomly deleted from someone who doesn’t realize its useful and then disappear from the web. (It wasn’t on wayback until I manually chose for it to be captured)

(Hereis a version that you can copy and save to your own gdrive, if you’re interested.)

I also don’t know the date on this doc, or if it’s still useful/applicable. This was true for a lot of the content produced in-the-moment about DFXML or BitCurator.

There was also a good amount of information on the Forensics Wiki, which seems to have gone under …gone under… a renovation, with the new site here. There’s still a good bit from what’s captured that is available (which is probably a lot). This only fueled my muddled thoughts around what disappears not through a death but just through not being able to be found.

Final unrelated thought: This talk from Alex Nelson, “Enumerating and Analyzing Storage Data with DFXML”, from 2015 is both educational and entertaining.