Shariq Murtuza

Robin Verma

Jayaprakash Govindaraj

Gaurav Gupta

A TOOL FOR EXTRACTING STATIC AND VOLATILE FORENSIC ARTIFACTS OF WINDOWS 8.x APPS

Keywords: Windows forensics, Windows Metro apps, forensic timelines

Microsoft Windows 8 introduced lightweight sandboxed applications called "apps" that provide a full range of functionality on top of touchenabled displays. Apps offer a wide range of functionality, including media editing, file sharing, Internet surfing, cloud service usage, online social media activities and audio/video streaming for the Windows 8 and 8.1 operating systems. The use of these apps produces much more forensically-relevant information compared with conventional application programs. This chapter describes MetroExtractor, a tool that gathers static and volatile forensic artifacts produced by Windows apps. The volatile artifacts are extracted from the hibernation and swap files available on storage media. MetroExtractor creates a timeline of user activities and the associated data based on the collected artifacts. The tool appears to be the first implementation for extracting forensicallysound static and volatile Windows 8 app artifacts from a system hard disk.

Introduction

Microsoft Windows dominates the world's desktop operating system market with a 91% share as of 2014 [START_REF]NetMarketShare, Desktop operating system market share[END_REF]. Windows 8 (launched in October 2012) and Windows 8.1 (launched in October 2013) have market shares of 6.29% and 6.35% respectively. During the initial period after the launch of Windows 8, there was not much migration to the operating system. However, sales of Windows 8 received a push when touch-screen laptops and monitors became available. Windows 8.1 brought enhanced user interaction and better software integration, which further increased sales. Although, Windows 7 still has about 50% market share, the situation is expected to change in 2015 when Microsoft terminates its mainstream support [START_REF]Windows Lifecycle Fact Sheet[END_REF], encouraging users to upgrade to Windows 8 or 8.1 (Windows 8.x).

Windows 8 introduced lightweight application programs called "apps" that work across a variety of computing devices, including desktops, laptops, tablets and smartphones; Microsoft chose touch screens to be the default user interaction medium for all the devices. The apps are more task-oriented compared with full-fledged application programs. For example, there are dedicated apps for checking news and weather, making restaurant reservations, managing finances, accessing online social networks, shopping online and logging health and fitness information. The use of these apps produces much more forensically-relevant information than full-fledged application programs. From the digital forensics perspective, Windows 8.x is similar to Windows 7 in that most forensic artifact extraction methods for application program data that work on Windows 7 can also be used on Windows 8.x. However, the apps, which are exclusive to Windows 8.x, are responsible for the primary difference between Windows 8.x and Windows 7 forensics.

The apps that come bundled with the operating system are called native apps; the remaining apps are downloaded from the Windows app store by the user. The static artifacts of an app mainly include its data and associated metadata stored on the relatively static hard disk drive. These artifacts are available in the local folders and related registry entries of the app. The volatile artifacts of an app include the RAM space allocated to it in physical memory. The hibernation file contains volatile artifacts of apps, desktop applications and other processes in the form of a compressed and encoded dump of the physical memory that contains their most recent running states. The RAM space of an app that is written to the hibernation file contains valuable volatile forensic artifacts that are not present in the app's local folders or registry entries. For example, a Facebook app's RAM space contains news feeds, comments, notifications and likes that cannot be extracted via static analysis. The RAM slack space in the hibernation file can also have archival artifacts pertaining to apps. Similarly, the swap file in Windows 8.x may also contain volatile artifacts related to apps; however, this is limited by the physical memory size and the frequency of the RAM freeing up process. The private data of running apps is flushed to the swap file during a memory crunch [START_REF] Karagounis | Reclaiming Memory from Metro Style Apps, Microsoft Developer Network[END_REF], which transfers the volatile contents of the apps to the hard disk. Small physical memory size tends to increase the frequency of RAM freeing up and, consequently, the chances of finding forensic artifacts related to apps.

This chapter describes the design and implementation of the MetroExtractor tool that collects static and volatile artifacts of Windows 8.x apps. The static artifacts are extracted from the hard disk drive and volatile artifacts from the hibernation and swap files present on a Windows 8.x installation disk. The MetroExtractor tool also creates a combined timeline for the static and volatile artifacts collected for a particular app. The tool was tested on the Facebook and Twitter social network apps and the Dropbox and OneDrive cloud data storage apps. The integrity of the results was verified by comparing the findings with a live RAM capture made at the same time. A survey of the literature indicates that MetroExtractor is the first tool capable of extracting forensically-sound static and volatile Windows 8.x app artifacts from a system hard disk.

Related Work

This section briefly discusses Windows 8 forensics and the forensic analysis of apps.

Windows 8 Forensics

This work focuses on the collection of forensically-relevant static and volatile Windows 8.x app artifacts from a hard disk. Johnson [START_REF] Johnson | Journey into Windows 8 recovery artifacts[END_REF] has investigated the feature of Windows 8.0 and subsequent versions that helps the users to easily refresh or reset their workstations. He has shown that a user can use these options to restore the original system settings by keeping the user files, removing everything else and reinstalling Windows. However, he did not consider the extraction of volatile data from the hard disk drive.

Thompson [START_REF] Thomson | Windows 8 Forensic Guide[END_REF] has performed similar work, primarily analyzing the app folder structure and the operation of basic apps. His research also investigated the artifacts generated by apps. This work takes a step further by incorporating Thompson's findings in the analysis of app artifacts found in the hibernation and swap files. Thompson also examined Windows 8 registry files in order to collect artifacts. However, the work was done using Windows 8 Consumer Preview and, thus, the results may not be directly applicable to Windows 8. [START_REF] Beverly | Forensic carving of network packets and associated data structures[END_REF] Dija et al. [START_REF] Dija | Towards retrieving live forensic artifacts in offline forensics[END_REF] have investigated the extraction of volatile artifacts from the hibernation file. Their work concentrates on application programs that can be searched for in the hibernation file; however, it does not consider Windows 8.x apps and the associated page and swap files. Mr-dovic and Huseinovic [START_REF] Mrdovic | Forensic analysis of encrypted volumes using hibernation files[END_REF] have recovered encryption keys from a physical memory dump with a hibernation file as the source. Gupta and Mehte [START_REF] Gupta | Forensic analysis of Sandboxie artifacts[END_REF] have conducted similar work on the Sandboxie application in a non-encrypted system.

Forensic Analysis of Apps

This work analyzes some of the common Windows 8.x apps so that correlation techniques can be used to obtain data about online social network activities related to a particular user and/or account. The analysis focuses on the cache of the targeted app and its local information from the corresponding SQLite 3 database. The hibernation, page and swap files are also examined to gather physical memory remnants of the app in the event that the local artifacts of the app were tampered with or deleted.

Iqbal et al. [START_REF] Iqbal | Windows Surface RT tablet forensics[END_REF] have investigated the Surface tablet with a standard Windows 8 RT installation. However, their work is limited to Windows 8 RT and covers only the Surface tablet, which, compared with Windows 8.x, is restricted in terms of its hardware and operating system functionality. Iqbal et al. have also discussed techniques for obtaining RAM dumps from Windows 7 phones.

Carvey [START_REF] Carvey | Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for Windows 8[END_REF] has described the procedures that should be followed during an incident response involving a Windows 8.0 device. He has also identified Windows 8 artifacts that can be extracted. Additionally, he stresses the importance of the hibernation file and the fact that malware and other data can remain resident in the file even after anti-virus software and other temporary space cleaners have been employed.

Quick and Choo [START_REF] Quick | Digital droplets: Microsoft SkyDrive forensic data remnants[END_REF][START_REF] Quick | Dropbox analysis: Data remnants on user machines[END_REF][START_REF] Quick | Google Drive: Forensic analysis of data remnants[END_REF] discuss methods for extracting artifacts related to the use of SkyDrive, Dropbox and Google Drive. The remnants gathered include user-related information and files. Quick and Choo [START_REF] Quick | Dropbox analysis: Data remnants on user machines[END_REF] have also analyzed RAM captures and local sources for the Dropbox application, but they did not consider the fact that the hibernation file may contain sensitive data related to the application. Similarly, Wong et al. [START_REF] Wong | Facebook Forensics, Valkyrie-X Security Research Group[END_REF] have focused on finding Facebook artifacts from web browsers and RAM dumps. Beverly et al. [START_REF] Beverly | Forensic carving of network packets and associated data structures[END_REF] have proposed a methodology for extracting network packet data from a hibernation file and using the data in network forensic investigations.

Background

This section discusses the hibernation and swap files, and static and volatile artifacts in Windows 8.x systems.

Hibernation File

Windows 8.x apps are lightweight programs that run on limited resources while providing well-defined functionality to users. User activity information and other data collected by an app is lucrative from a forensic perspective. For example, a map app typically retains all the user queries, including the places searched, routes explored and user location (if a laptop was used). The apps store their data and activity information in their respective local folders and registry entries on the hard disk. However, some of the information is not written back to the hard disk and remains in the app's RAM space when it executes. For example, the Facebook app's RAM space contains news feeds, comments and likes that are not written back to the app's local folders on disk. However, the availability of this extra information in RAM space depends on the type of app and its design.

Experiments were conducted on the hibernation file (hiberfil.sys), a large file about the size of the physical memory of the system. The file is overwritten by the RAM contents. At the time of writing the RAM contents to the file, the operating system compresses and encodes the data. Windows 8.x uses the Xpress algorithm for compression and the Huffman and LZ algorithms for encoding [START_REF] Hale Ligh | The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux and Mac Memory[END_REF]. This speeds up the process of writing to and reading from the hibernation file during the shutdown and restart operations. The encoded content of the hibernation file can be converted back to a RAM dump (i.e., in a data format exactly similar to the RAM) using the MoonSols tool [START_REF] Moonsols | MoonSols Windows Memory Toolkit[END_REF]. Although Volatility can be used to convert an encoded hibernation file to a RAM dump, MoonSols was found to produce an error-free output at a faster rate. A hibernation file also contains archival data in slack space that is the result of previous writes. The amount of archival data present in a hibernation file depends on the size of the file and the frequency of writes. A general rule of thumb is that the larger the hibernation file, the greater the chances of finding app artifacts related to earlier sessions.

Swap File

According to the official MSDN blog [START_REF] Karagounis | Reclaiming Memory from Metro Style Apps, Microsoft Developer Network[END_REF], the runtime design of Windows 8 enables it to suspend an app when it is minimized by a user. The suspended apps do not use the processor as soon they are not in active use. When Windows 8 Metro apps are suspended, the RAM space allocated to them remains untouched. When there is a memory crunch, the operating system flushes all the memory of the suspended apps to a swap file. The memory dump stored in the swap file can be brought back to the RAM later without terminating the apps [START_REF] Karagounis | Reclaiming Memory from Metro Style Apps, Microsoft Developer Network[END_REF]. Morrison [START_REF] Morrison | Windows 8/Windows Server 2012: The New Swap File[END_REF] states that the mechanism of writing the private RAM space of a suspended app to the swap file on disk until it resumes is analogous to the hibernation of an app. Note that the swap file contains the flushed-out private memory dump of an app during a memory crunch, so it does not necessarily hold the last used instance of the app. Hence, the swap file generally provides a random memory snapshot of an app.

Static vs. Volatile Artifacts

Although the static artifacts of an app on disk give useful insights into user activity and data, the volatile artifacts from the hibernation and swap files are also required to completely reconstruct the sequence of events in a digital forensic case. The importance of collecting static and volatile artifacts of Windows 8.x apps is clarified using two example scenarios. The two scenarios assume that the hibernation file on the system disk cannot be touched by the user because it is inaccessible to all user level apps, applications and processes on a running Windows 8.x system.

Unintentional Deletion of Forensic Artifacts: Assume that a user installs a Windows 8.x app that clears the cache of apps that are already installed on the system. The user has no intention of modifying any evidence related to the pre-installed apps; instead, the user merely wishes to free up some storage space. In this case, the static artifacts are deleted from the system, but can be recovered using forensic tools. However, there is a good chance they are overwritten over time and are unrecoverable. Volatile artifacts in the hibernation and swap files may retain the same archival data that was deleted from the static collection. Additionally, certain forensic artifacts are only present in the volatile space. Therefore, collecting volatile artifacts from the hibernation and swap files is as just important as collecting static artifacts from the disk.

Intentional Deletion and Anti-Forensics: In the second scenario, the user employs anti-forensics to securely delete or tamper with the static artifacts of an app. If the user securely deletes the static artifacts of the app, the artifacts cannot be recovered using conventional forensic tools. If the user tampers with the static artifacts, then there is the possibility that a forensic tool could find traces of the tampering, but there is a good chance that the traces would have been overwritten over time. However, the volatile artifacts in the hibernation and swap files may still have the same archival data that was in the static space.

The two scenarios demonstrate that collecting volatile artifacts from the hibernation and swap files is as worthwhile as collecting artifacts from static space.

Experimental Methodology

Windows Metro app static data is present on disk in the form of databases and app registry files. It is important to emphasize that not all the data displayed by the Metro app is stored on disk as database files. Some artifacts are present only in volatile memory. These include, in the case of the Facebook app, the user's news feed, posts made or viewed by the user and the comments made about posts. This data, which is fetched via the Facebook API, is stored in volatile memory and is not reflected on the disk. For example, a user may post a status update on his wall and may decide to delete the post some time later. If such posts were to be reflected on the disk, then errors would exist. Some chat applications require that the recipient should get a message even if it was deleted by the sender. Such activities are, therefore, reflected on the disk. For these reasons, a complete forensic picture may only be available if an investigator considers both static and volatile artifacts. Tools such as Privacy Eraser and other Windows 8 cache cleaners such as Modern UI Apps Cleaner enable users to clean the cache, cookies, Internet history files and other temporary app files from Windows 8 apps folders. This cleaning results in the loss of potential static evidence from the disk.

The MetroExtractor tool described in this chapter gathers static and volatile forensic artifacts of Windows apps. It incorporates a graphical user interface front-end written in Java; its back-end activities are implemented by a collection of shell scripts. MetroExtractor collects static artifacts, arranges them according to their timestamps and presents a timeline of activities. The tool then extracts the hibernation file from the hard disk/dd image/user-provided image or E01 file, and converts it to the corresponding RAM dump using the MoonSols memory toolkit. Volatility is then used to extract app-specific memory chunks from the RAM dump. The next step is to extract timestamped data from the chunks. The data is usually present in the form of a JSON file that is received by the (Facebook) app as a response to the API request that it sent. The JSON file is received and parsed by the Facebook app and displayed. The file contains user data such as chats, notifications, image links, textual content and, most importantly, timestamps (Unix epoch timestamps). The JSON data is extracted using regular expressions and is then classified as chats, notifications, posts, etc. on the basis of vari-able names. The timestamps are then extracted and plotted on a timeline. Finally, the artifacts obtained via the static and volatile analyses are incorporated in the timeline and displayed to the investigator.

The experiments involved the following steps:

1. An app was launched and allowed to load completely and display the data.

2.

A RAM dump was created using the MoonSols DumpIt program.

3.

The system was made to hibernate.

4.

The hibernation file was extracted using a Linux Live CD.

Figure 1 presents the experimental methodology. A RAM dump was obtained just before the system was made to hibernate. This was done to ensure that the RAM content and the content stored in the hibernation file would be as similar as possible to the RAM dump. Two different dumps (one from RAM and the other from the hibernation file) were obtained to verify the findings and if the hibernation file could be used for forensic analysis with the same credibility as the RAM dump. The time difference between taking the RAM dump and hibernating the system was minimized. The app specific memory chunks that were extracted from RAM memory were found to have comparable sizes. The difference in sizes (if present) was never more than 100 MB. The size difference was most likely due to the hibernation file containing some RAM slack.

The MoonSols memory toolkit was then used to convert the hibernation file to a RAM dump. The Volatility Framework could also have been used for this task, but experimentation revealed that MoonSols performs faster conversions. Next, Volatility was used to inspect the RAM dump created from the hibernation file. After obtaining the extracted memory, Foremost was used to perform string searches on the memory dump.

As mentioned above, the back-end functionality of the MetroExtractor tool is implemented by a collection of shell scripts. MoonSols is only used to convert the hibernation file to a RAM dump. MetroExtractor runs on a Linux system or a Windows platform with Cygwin installed. It takes as input a dd image, ewf file or a hard disk. The tool first converts the hibernation file to an equivalent RAM dump using MoonSols. The RAM dump is then processed by MetroExtractor using the Volatility API to extract the process memory space for the required app. The memory chunk of the app is then processed and classified by MetroExtractor as a chat, comment, notification, etc. Note that the Facebook API responses are in a form specific to JSON with variable names (used for activity classification) and timestamps. The timestamps are exported into a CSV file along with the corresponding activity.

The MetroExtractor tool also collects static app artifacts from disk. The data is stored in databases from which timestamps are extracted and a timeline plotted. The static and volatile timelines are then merged. Merging the two timelines gives insights about activities that were performed simultaneously, such as commenting and chatting while receiving a notification. The unified timeline representation provides a compre-hensive picture of user activities. The timeline is displayed by opening the CSV file using spreadsheet software.

Facebook App: The experiment began by launching the Facebook app and allowing it to load all the content. After this, the RAM dump was made and the system was put in hibernation. The RAM dumps were then processed using the Foremost tool.

Twitter App: A similar procedure was followed for the Twitter app. The app was launched and allowed to load the content. After the content was loaded and the app was stable, the RAM dump was made using DumpIt. Following this, the system was put in hibernation, the hibernation file was extracted and the process described above was performed.

One Drive App: By default, documents saved to OneDrive are not downloaded from the cloud; instead, they are downloaded only if requested by users or if users explicitly specify that they should be made available offline. While conducting experiments on OneDrive, it was discovered that the Skydrive.exe service always runs in the background in order to synchronize all the data files. Sample files were created and stored in the OneDrive folder. Like the Windows 8 Dropbox app, the Windows 8 Modern app for OneDrive is not designed for synchronization, only for viewing the online stored files. Whenever a file is opened using the app, it is downloaded to temporary storage and then displayed. The files are synchronized by the background service Skydrive.exe. Whenever the app was used, it started with the process name FileManagerexe. In due course, this process spawned itself as a child process. A similar procedure was followed with the child process.

Dropbox App: The Dropbox Windows 8 app was launched. Dumps were made of the RAM and the hibernation file.

OneNote App: The OneNote Windows 8 app was launched. Dumps were made of the RAM and the hibernation file.

Experimental Results

During the experiments, app-specific memory chunks were extracted from the RAM dumps. A similar procedure was followed with the hibernation files after converting them to RAM dumps using the MoonSols memory toolkit. This section presents the experimental results and com- pares the results obtained from the RAM dumps and the hibernation files.

Facebook

Table 1 presents the results for the Facebook app. It was possible to extract the images displayed in the user's Facebook feed. Chat messages were found along with user activity and user profile data such as the Facebook profile ID, JSON data pertaining to conversations, timestamps, etc. All the results were verified except for Facebook notifications because the notifications were displayed for a very short time during the live RAM capture. In addition to these artifacts, it was possible to find previous chat messages in the dumps, because the Facebook app was loading them to show the user his chat history. Static artifacts were extracted from the on-disk app databases. These databases contained many details, including the friends list, notifications and chat content.

A timeline was created from the static artifacts, mainly the notification and chat timestamps. The static timeline was merged with the volatile timeline (Figure 2), yielding vital activity clues such as notifications that arrived during chats, when they occurred and the individuals with whom the user was chatting during specific time windows. were collected. Microsoft OneNote organizes and stores data in the form of pages called Notebooks. Foremost was able to recover all the images that were pasted in the Notebooks along with the text content. A hex editor revealed an XML structure similar to Office documents. The creator's Live ID and the creation time of the notes were found in the XML structure.

Performance

The primary time consuming activities of MetroExtractor are the conversion of a hibernation file to the corresponding RAM dump and the extraction of the individual process memory chunks from the RAM dump. Table 3 shows the average time (over ten replications) taken by the tool to process artifacts for a particular app.

Finally, it is useful to compare the performance of bulk extractor [START_REF] Garfinkel | Digital media triage with bulk data analysis and bulk extractor[END_REF] and MetroExtractor. bulk extractor tool works by scanning a disk without parsing the file system structure. MetroExtractor, on the other hand, uses the file system structure to locate active files and extract the corresponding artifacts. Both the tools attempt to find the maximum amount of evidence in the input disk or image. The bulk extractor tool extracts all possible artifacts, including information from other applications. However, the current version of MetroExtractor finds artifacts only for Windows 8 Metro apps. MetroExtractor generates timelines using the timestamps of the collected artifacts whereas bulk extractor simply lists all the evidence present without correlating it or arranging it in chronological order.

Conclusions

The MetroExtractor tool described in this chapter gathers forensic artifacts related to Windows 8 and 8.1 Metro apps. Static artifacts from the local app folders and registry entries along with volatile artifacts extracted from the hibernation and swap files are mapped to a single timeline to provide comprehensive reconstructions of events. The tool was tested on the Facebook and Twitter apps and the OneDrive and Dropbox cloud data storage apps. The integrity of the methodology was verified experimentally by comparing the results from a live RAM capture with those from a hibernation file written to disk at the same time. A survey of the literature indicates that MetroExtractor is the first tool capable of extracting forensically-sound static and volatile Windows 8.x app artifacts from a system disk.

MetroExtractor considers only active hibernation files. Because the Windows 8.x disk optimization options are enabled by default, some portions of a hibernation file may be defragmented. Since the Windows operating system corrupts the beginning of the hibernation file every time the system reboots, a defragmentation operation can cause portions of the corrupted file to be found in the slack space [START_REF] Beverly | Forensic carving of network packets and associated data structures[END_REF].

Future research will focus on developing similar tools for Microsoft Windows phones and tablet devices. Also, research will attempt to analyze synced data that moves between devices.

Figure 1 .

 1 Figure 1. Experimental methodology.

Table 1 .

 1 Hibernation file artifacts with live RAM capture (social network apps).

	Apps	Hibernation File Data Live RAM Data	Result
	Facebook Username, profile ID, pro-	Username, profile ID,	The	findings
		file info JSON, profile pic	profile info	JSON,	were	verified
		URL, other images, chat	profile pic URL, other	to a large ex-
		messages, Facebook feed	images, chat messages,	tent, the only
		status, login email id and	Facebook feed status,	exceptions were
		trending items.	login email id, trending	the news feed,
			items, news feed, com-	comments, no-
			ments,	notifications	tifications and
			and likes.			likes.
	Twitter	Twitter handle, profile	Twitter handle, profile	The hibernation
		JSON, profile pic URL,	JSON, profile pic URL,	file is as good
		tweets at the current in-	tweets at the current	as the live RAM
		stant, embedded pictures,	instant, embedded pic-	capture.
		direct messages and email	tures, direct messages
		id. The data was present	and email id. The data
		in the form of JSON.	was present in the form
			of JSON.

Table 3 .

 3 Average time taken by MetroExtractor to process data.

	Processor	System	Operating	Time
		Configuration System
	Intel Core2Duo HDD: 320 GB;	Ubuntu 12.04 LTS 32 min.
	(2.2 GHz)	RAM: 4 GB	(32 bit)
	Intel Core i5	HDD: 320 GB;	Ubuntu 12.04 LTS 21 min.
	(2.8 GHz)	RAM: 4 GB	(64 bit)

Creating the combined timeline is important because the static and volatile artifacts complement each other. User activities can be verified from the combined timeline. Activities such as chats and friend requests were easily verified from the static artifacts. Many new insights were gained when the static timeline was combined with the volatile timeline. These included the images that were viewed (carved from the dump using Foremost), the verification of the chat history and the comments posted by the user, and the correlation of posts from other users in the user's home page feed. The hibernation file is as good as the live RAM capture.

OneDrive File list, user name and id (profile and email), SHA1 hash, DTS, sharing level, UID and file sizes.

All this data was also found in the RAM with no other artifacts being present.

The hibernation file is as good as the live RAM capture.

Other Apps

Other apps, including Twitter, Dropbox and OneDrive, have common artifacts in their static and volatile spaces. Tables 1 and2 present the results.

In the case of Windows 8 OneNote, the app was started and allowed to synchronize. Following this, the hibernation file and live RAM dump


Fred Cohen

A TALE OF TWO TRACES -DIPLOMATICS AND FORENSICS

Keywords: Questioned documents, archival science, diplomatics, digital forensics

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In October 2013, a house was up for sale and, during the closing period, a dispute arose about square footage that could have stopped the sale or substantially changed the terms of the sale. The issue was ultimately resolved by examining documents from city and county digital archives of born-analog data. This is referred to as Case 1.

In an unrelated legal dispute, two ex-partners were in stark disagreement about whether one of the partners took on a competitive business while the partnership was still operating, and thus acted in bad faith. The issue was brought to light because of the content of a web page depicted on the Wayback Machine of archive.org, which is asserted to be an archive of Internet websites over historical time frames (mid 1990s). This is referred to as Case 2.

The issues in these cases are not new. In fact, they are very old and, by looking back to the history of archives, diplomatics and related aspects of records management, insight may be gained about the future of these fields.

Causality as a Foundation of Science

Foundational to science is the notion of causality. Cause (C) acts through (→) mechanisms (m) to produce effects (E): C→ m E. This is the basic assumption of science as a whole as well as scientific evidence in the narrow sense of legally admissible evidence. Noteworthy are the notions that correlation is not causality and that effect does not imply cause [START_REF] Cohen | Digital Forensic Evidence Examination[END_REF]. In order to create a scientific hypothesis about a legal matter, a hypothesis of a mechanism by which cause produced effect must be formed, with the effect being the traces found and the cause being a hypothesized act of interest to the case.

Diplomatics

The field of diplomatics is often reported as being founded in 1681, when the renowned French philologist Mabillon [START_REF] Mabillon | De Re Diplomatica[END_REF] published the results of an analysis of approximately 200 documents divided into categories and examined with regard to material, ink, language, script, punctuation, abbreviations, formulas, subscripts, seals, special signs, chancery notes and so on. He created descriptions to allow the detection of forgeries and identified ground truth based on the recurrence of intrinsic and extrinsic elements in documents from the same time and place [START_REF] Duranti | Diplomatics: New Uses for an Old Science[END_REF]. In modern terminology, and taking some liberties in usage, he used redundancy to test for consistency. Note that this approach is based on correlation, but causality was also present in the form of known chanceries or scriptoria traditions (cause) and capabilities of scribes over the ages (mechanism). In addition, and perhaps more vitally, no ground truth was available for much of this effort because the documents were too old for eyewitnesses and the documentary evidence supporting the claims was in question along with the claims themselves.

Diplomatics provides much of the basis for the admissibility of evidence and the establishment of criteria for evaluating evidence. The field and its principles of application are still used for questioned document analysis. By extension, its principles and many of its methods are in use or have analogous use in digital forensics. The modern and historic reconstruction of causes acting through mechanisms to produce effects forms an experimental basis for diplomatics, except, of course, that accelerated aging and similar methods are approximations or models.

Archival Science and Public Records

The field of archival science emerged over time due to the need to keep reliable public records (e.g., land ownership documents). Ancient record-keeping systems date back as far as history and indeed much of history is based on the records collected and retained by archivists at different administrative bodies. In the legal system, public records are generally admissible for the truth of what they self-indicate and are presumed to be trustworthy (i.e., reliable -a true statement of fact), authentic (not corrupted or tampered with) and accurate (truthful, exact, precise or complete) in the legal system, when they are properly introduced and marked with the appropriate seals, signatures and/or special signs by the legal entities that produced them. While diplomatic analysis may be used to attempt to refute these records and/or to rehabilitate them after attempted refutation, they are generally trusted, and built and maintained in a manner that reasonably justifies the trust. This is, at least, their nature in the analog records space.

The analytical approach is based on a set of redundant acts by independent trusted actors forming a set of archival fonds associated with different archival units, programs or institutions. Fonds are aggregations of documents that originate from the same source. The records and fonds include explicit formal elements designed to provide assurance that the records are authentic, accurate and reliable over their life. This is undertaken by providing a chain of custody in a transparent system of record keeping through redundant information that associate actions related to a record with the record in the context of the fonds, and the fonds in the context of the archives. This is sometimes called the archival bond, which is the relation between a document and the previous and subsequent documents produced in the course of a business matter. Paper records are often annotated over time, marked with stamps, altered by updates and changes, and so on.

Figure 1 shows a (redacted) document provided in response to a request for a legal record related to ownership. The document has a series of writings added over time. The record, in this case, is a dynamic document that has been updated to reflect the officially-authorized changes, as shown by the seals of the officials who carried out the actions. As the record evolves over time, it is retained in a chain of custody and supported by the fonds in which it resides, which reflects the dates of access and other related information. As a legal document, this is considered proof of the facts contained in the document and is inherently regarded as reliable and accurate based on the source, and authentic because it could be proffered to a court as a proper form with the seals intact. This document might have been moved into an archival repository for a period of time and returned to active use later. Such movements would be annotated on the document and/or in the fonds in which it resided over time. The redundant information from the various sources (e.g., transmission from use to the archives and back as signed by parties on each side, placement in the fonds in sequence over time, markings on cover sheets and/or envelopes and/or the documents themselves) can be examined by a diplomatics expert in the context of the methods used by the record-keeping system to make a determination of authenticity or to refute or challenge the presumption of authenticity based on a lack of adequate evidence of (or evidence of inadequate) custody and control.

Digital Records

Many of the methods that made analog records reliable over time have not been translated into the new forms of record keeping in the digital records space. For example, the processes involved in property purchase often required a government-authorized actuary to certify that an individual identified by a government document signed a document in the presence of the notary. But increasingly, a digital system allows a digital signature that is not even created by the individual's own hand. Instead, the self-identified individual agrees electronically over the Internet to adopt a signature form for use in signing documents. The documents are sometimes incorrectly presented (i.e., with incorrect data fields), with the results produced as digital documents reflecting different (and in some cases corrected) content than what was actually presented for signature.

Such record-making and record-keeping systems are potentially very problematic in legal terms, but they are not often challenged. They do not guarantee that what is agreed to is what is presented. They often include and present false information and change it after agreement. They do not provide a copy in the form of the original (identical to the original in all respects but issued after the original), an imitative copy (reproduction of both the form and content of a record) or even a simple copy (transcription of the record content) to the signatories. Moreover, they often do not incorporate an actual signature that is traceable to an individual and that is demonstrably different from other adopted signatures. Documents may be presented differently from how they appeared before (i.e., as a pseudo-original with the pretense of originality), even when and if they are ultimately presented and/or submitted in court as authentic, reliable and accurate.

Nevertheless, these pseudo-original documents are then declared as public records, and from that point forward, they are recognized, treated and presumed as authentic renditions of contracts. They become part of corrupt and inauthentic digital records and eventually make their way into the archived and permanent records of societies. The metadata associated with these records often lacks the fields required by record management systems and archives (if present, they may be incorrect), the mechanisms are not transparent and they not available to the parties to the contracts. Figure 2 shows an example of a presentation made as part of the collection of potential evidence in Case 2. This depiction of a digital record reflects what, in some jurisdictions, is legally admissible as an archival document and may be given the presumption of authenticity, reliability and accuracy. In particular, note that "Resolution Capital" appears with "Advanced Portfolio Management" on the page. This is a depiction that was saved from a screen image of what was seen when one of the parties gathered what he believed to be evidence in support of his case.

Digital Diplomatics

As a field, digital diplomatics currently takes on two meanings. One meaning is the use of digital computing methods to support classical diplomatics. For example, digital methods may be used for word and phrase analysis to detect differences in scribes and to track scribe usage of terms over time in order to date documents more accurately than was feasible using manual techniques. The other meaning is the use of diplomatic methods to authenticate digital documents, which is the meaning of interest in this work. The following quote amply conveys this meaning:

Georges Tessier: "On peut donc avancer que la critique diplomatique est née dans le prétoire ou sur le forum à l'occasion de débats judiciaires ou de controverses politiques ou religieuses, quand le noeud du litige ou de la polémique était constitué par un document ou une série de documents contestés." Cette citation est tirée de L'Histoire et ses méthodes (La Pléiade, 1961) dont Georges Tessier a signé le chapitre Diplomatique [START_REF] Chabin | Impressions, expressions: Le blog de Marie-Anne Chabin[END_REF].

Google Translation: "It can be argued that the diplomatic criticism is born in court or forum on the occasion of judicial proceedings, or political or religious controversy when the crux of the dispute or controversy consisted of a document or series of documents in dispute." This quote is from The History and Methods (The Pleiades, 1961) where Georges Tessier signed the chapter Diplomatics.

In this context, the relevance of digital diplomatics may be reasonably explored relative to digital forensics.

Forensic Science

Forensic science is often cited as coming to clarity through the work of Locard [START_REF] Locard | The analysis of dust traces[END_REF]. Locard identified that, when objects come into contact, they each leave parts (traces) of themselves on each other. The mechanism of objects coming into contact and leaving traces is called "transfer" and, thus, we have the scientific notion of causality fulfilled by contact (cause) acting through transfer (mechanism) to produce effect (traces). Traces may be humanly observable (e.g., chunks of rock or mud) or latent (observable only through the use of tools as in dust and microscopic particles). Locard undertook studies showing layers (e.g., of mud or dust) indicating sequences of places visited (e.g., layers of mud on shoes) when a person transited a city, and associating the transferred traces to locations based on unique properties (e.g., strands of a particular wool from the only factory that produced it in the city).

As forensic science has moved forward, many methods have been developed based on the concept of transfer. Methods, such as tool mark analysis, have also been developed from the earlier diplomatics area.

Digital Forensics

As digital systems came into widespread use, the legal system had to deal with evidence in the form of traces of activities within and between digital systems. The study of digital traces relative to the legal system was identified as digital forensics. However, as in the case of digital diplomatics, another meaning is used. Specifically, digital forensics is also used to describe activities associated with the investigations of eve-nts in the digital arena, a much broader field that is closely related to detection and response regimens in computer security.

As a fundamental notion, it has recently been recognized that digital evidence is still trace evidence, is almost always latent in nature and is not transfer evidence. Rather than being transferred in the sense of Locard, digital evidence is formed from traces produced by the mechanisms of operating digital systems, typically as stored states from finite state machines that transform state and input into the next state and output.

Using the term of art from diplomatics, "digital traces" are produced by transmission rather than transfer. In the digital arena, transmission producing traces is typically also transmission in the sense of electromagnetic, optical, sonic or other emission and reception of signals. Specifically, events in one context produce signals that are sensed in another context and memorialized in the form of optical patterns, configurations of particles, magnetic orientation or whatever traces are supported by the transmission or fixation media.

Additionally, in the digital arena, the latent nature of evidence is such that a copy in the form of an original almost never occurs. Instead, a sequence of bits represented in a fixed form in/on a medium may be reproduced (at the bit level), while presentation in a human-readable form is normally an imperfect reflection of the original documentary form. For example, when the information associated with a digital record (e.g., financial transaction) is originated, the form of entry (e.g., web-based entry of a purchase form) is typically very different from the form of transmission (e.g., series of datagrams sent over the Internet as waveforms in transmission media), storage (e.g., sequence of bits in a database storage area of a disk drive or in a positive feedback loop in active memory) and presentation (e.g., line item in a bank statement or entry in a spreadsheet downloaded by an accountant from the financial institution and used for tax purposes). These notions are not widely recognized or stated in digital forensics today, even though they are always present.

The notions of authenticity, accuracy and reliability are always at issue in the digital forensics arena relative to the classical notions of documentary form. The notion that using methods such as cryptographic checksums to verify the lack of alteration of a bit sequence does not even begin to address the issues of authenticity of a record in presentation and reliability in the sense of relationship to original writing or any sort of ground truth. Causality works differently.

In the following sections, distinctions, if they exist, are identified using classical diplomatics, classical forensics, digital forensics and digital diplomatics in the realm of questioned document examination. In par-allel with this exposition, the case studies are examined in detail. These cases are not large or important on their own, but instead reflect the many everyday legal issues that naturally occur in human interactions and sit at the heart of how people interact with the legal issues faced in these areas. Finally, the cases are resolved and the conclusions are presented.

This work views questioned digital document examination as the fusion of diplomatics and forensics. It may reasonably be called digital diplomatics and/or questioned digital documents without reasonable differentiation. Indeed, the reconciliation of diplomatics and forensics in this arena is a historic merger and unification of the individual concepts and fields of study.

Digital Diplomatics and Forensics

This section presents the background of the two cases and discusses document admission and related information regarding records.

Case 1 Background

Case 1 involved a dispute over the square footage of a house. The seller claimed the square footage specified when the house was purchased and as reflected in the taxes paid over the duration of ownership and for some unknown period prior to the purchase. The buyer, a civil engineer, upon assessment, noted a different square footage in the inspector's report and proceeded to do an independent measurement, which produced a third square footage result.

If left unsettled or settled in various ways, this situation could lead to charges of fraud, damage to reputation, tens of thousands of dollars difference in the sales price, retroactive tax readjustment and delayedclosure or non-closure of the sale. None of these situations were in the interest of the parties and the settlement of the dispute rested on documentary evidence in the form of records from various sources, including the prior sale documentation, tax documentation and city and county records related to remodeling, permits and inspections. The measurements themselves were also at issue because different measurements (e.g., inside dimensions, outside dimensions, livable space and permitted use areas) are based on different definitions in different overlaid jurisdictions (e.g., taxation, county building and city building).

Case 2 Background

Case 2 involved a dispute between ex-partners in a financial venture. The business failed and each partner went his own way seeking to start a new financial venture, with the ownership of the domain name remaining with one of the partners. Several years later, upon viewing what was believed to be an image of the prior website using the Wayback Machine at archive.org, the partner who did not retain control of the website was unhappy to discover that, according to the displayed content, resources belonging to the previous business were used to advertise the new business prior to the termination of the partnership. This led to charges of misappropriation of resources, customers and business from the partnership and failure to faithfully fulfill fiduciary and other duties as a partner.

In this case, the dispute was based on the form and appearance of the document (i.e., the depicted website) as seen in the archival site. The depiction was clear as it could be. A date selected by the user and indicated in the URL at the top of the web browser page showed content from the prior business simultaneously displayed in a single web page with material from the new business. If the depiction reflected reality, there would be little question that a case could be made by the complainant. The only case that could reasonably be made by the accused party was to question the document presented by the archive.

Admitting the Documents

While the subtleties of an Internet archive versus other types of archives and the question of how to resolve seemingly inconsistent information from different official records may be vitally important to the issues at hand in the two cases, there seems to be no question that the documents would normally be admitted in legal proceedings.

The Wayback Machine is an automated storage system while an archive preserves documents. Preservation is a process in which an archivist identifies, authenticates, protects, describes, builds retrieval systems, provides access to and acts to protect the material being archived. The term Internet Archive in the context of the Wayback Machine is a misuse of the term of art, "archive." Of course, humans have trusted archives for centuries and the individuals who operate archive.org have demonstrated excellent marketing skills in using the term.

The legal status of government documents is normally that they are admitted and presumed reliable, authentic and accurate. Thus, the documents supplied in Case 1 operate under this legal presumption.

The Internet Archive is a bit more nebulous in that it is a website operated by a non-profit (i.e., public interest) corporation, much like a museum or other archive. However, this is not what the Wayback Machine is. The Wayback Machine is not like a museum or an archive because there is no curation or assurance of protection and permanent authenticity from the moment of acquisition.

Ancient documents ("ancient" is a term of art) are usually admitted under the presumption that they were not forged in advance in anticipation of some future litigation that could not have been anticipated by an archivist. Disregarding the question of how old is old enough, a strong case can be made that the Wayback Machine was not operating intentionally to create a forgery and no claim was asserted that the information it stored was altered in any nefarious manner. The presumption for such documents is, de facto, also that of being reliable, authentic and accurate, even if this is not based on the same legal or technical footing as public records. Here lies the rub.

Archives that hold public records are normally designed by archivists and record-keeping specialists to reasonably assure trustworthiness. In the paper world, a chain of custody is established by independent and redundant trusted parties. These parties attest to signatures (i.e., seals) that become part of a document as it moves from party to party for signatures; take custody of the document and retain it in a secure location; track it in the fonds through numbering, ordering, cross referencing and other related processes; indicate how, when, from whom and other characteristics as the document is ingested, stored, moved, retrieved, transmitted, examined, copied, migrated and so on; and generally keep records of their activities in a transparent manner and make them available for examination. This all depends on trust in the custodian as an entity who has not altered the records and has not allowed anyone else to do so. This latter requirement -of not allowing others to alter records -is problematic in the Internet because it was not designed for this purpose.

Examination can detect inconsistencies in and between records and fonds and this supports trusting (or challenging) the trustworthiness of the records. But this is not the case for depictions presented by the Wayback Machine. Collections are made at seemingly arbitrary times from subsets of automatically-selected websites. The components that manifest a visualized web page are collected at different times, stored with only a single reference to a collection date and are not attributed or tracked in the many ways that an archive is managed. The Wayback Machine is not a system of records as much as an amateur collection, but it is sometimes treated as if it is a traditional archive.

In the digital world, alteration can happen unintentionally or intentionally, the protection mechanisms of the Wayback Machine are not transparent and the adequacy of the machine and its mechanisms has not been established by a rigorous scientific process. The Wayback Ma-chine does not apparently follow the rigors of archival science or records management and, thus, it should be inherently obvious to an expert in the field that it does not have the same status as public records or archives with regard to maintaining and operating within the standards of care. This is also the case for many other Internet-based sites that assert archival or records status, and this is one of the important reasons why a science needs to be developed in this regard and why diplomatics must be developed as a field to question the stored documents.

The situation is further complicated by the fact that the mechanisms of the Wayback Machine change over time, are not externally documented or transparent, and do not follow widely accepted archival principles. In fact, after the findings discussed here were made public, the Wayback Machine was changed with minimal notice and little apparent transparency. Thus, no external repeatability -a basic requirement of a scientific field -exists for the changes and performing an accurate reconstruction is problematic.

In the legal realm, depending on the bent of the judge and case precedence that may reflect previous mechanisms or poorly tested assertions, depictions that are not accurate, reliable or authentic may ultimately be admitted, presumed trustworthy and treated with a weight similar to that of records maintained by government bodies or real archives.

Related Information on Records

While this situation may appear problematic, the reality of digital records is, in general, quite tenuous compared with other forms of records. Some of the following examples from personal correspondence are informative and some may be recognized as having been reported in the popular media:

A global non-government agency indicated that, in some cases, it holds records where 80% are of unknown type. When asked whether assistance was desired in trace-typing them, the response was that, while it must maintain the records, it had neither the resources nor the desire to type them. The obligation of the nongovernment agency thus stops at proper retention.

Migration of records from system to system over time is necessary to retain the utility of the records because digital systems fail and older systems are no longer available. Moreover, newer systems rarely support all the mechanisms of the older systems.

Conversion is thus part of record migration. The result is that a migrated record is often, at best, an imitative copy, sometimes a simple copy and sometimes a pseudo-original copy. Records may never be viewed as they were initially formed and the loss of utility during conversions is not uncommon. Key parts of the migration problem faced in digital archiving are creating the mechanisms needed to produce copies of the records in one form or another and identifying and recording the nature of the changes associated with conversions and non-original mechanisms in terms of what is depicted and what is no longer depicted. Forensic archives of legal matters often contain large volumes of data in unusable form because they have not been migrated or converted and the original mechanisms and/or contexts may no longer exist to meaningfully reconstruct or use them. Given that legal appeals processes may come many years later, this evidence may no longer be viable if re-examination or retrial are required.

Many modern devices and systems are complex and lack transparency to the point that their operational mechanisms are not discernible. Furthermore, automated patching often results in situations where the exact versions are not available and may be difficult or impossible to accurately reconstruct. Thus, establishing causality in reconstruction may not be accurate, and the task of reconstruction becomes very complex in this light. Some governments have admitted the use of covert methods to alter the apparent operation of mechanisms, making them act in ways unknown even to their manufacturers. This potentially shakes to the core the idea that archives accurately reflect the reality of what took place. The competition to rewrite history and current affairs in the digital realm would seem to present problems for the trustworthiness of digital records for legal purposes. Some nations and other similar entities use digital records to reflect their operations, including without limit, the original writing and official codifications of their laws and legislative history. This includes scanning documents that become part and parcel of the legal constructs of their societies as well as born-digital records.

Recent revelations indicate that scanning devices no longer simply make representations of pixelated color values in digital form with known accuracy and precision limits. Instead, some of the devices read the content of documents and rewrite them, sometimes replacing digits, words, spelling and other elements of content with corrected versions. The very laws codified in statute and used to make decisions about peoples' lives cannot be relied on to accurately reflect the laws as passed, and documents such as financial records may not be accurately recorded for future use such as taxation and levying fines.

It appears that there is a desperate need for a science of questioned digital documents. This field might be reasonably called digital diplomatics, named after the existing diplomatics field that was created for the same purpose in the non-digital realm. Part and parcel of diplomatics was the development of archival science and records management. The same path would seem to be a reasonable trajectory for digital diplomatics leading to and helping guide digital records management, digital archival science, digital records forensics [START_REF] Duranti | From digital diplomatics to digital records forensics[END_REF] and the broader field of digital forensics.

Case Resolution

This section discusses how the cases were resolved.

Case 1

Figure 3 shows the drawing of the property produced after an analysis by a building inspector. The corresponding square footage was calcu- lated as 1,986.22 sq. ft. This is obviously at odds with the overhead image of the house shown in Figure 4. The inspector was looking at the records of livable interior space in city permits, the full details of which were no longer available from the relevant time frames.

The overhead image in Figure 4 is a Google Maps aerial of the house at about the time of sale. Note the substantial difference between the shape in the inspection report and the actual shape in the overhead image. The dispute at this point was whether and to what extent a remodeling of the former garage was properly accounted for in the calculation.

The issue was ultimately settled when county records were retrieved from the county archives. Figure 5 shows the official county report page used for tax calculation, which identifies that a laundry room was counted as livable space in the previous city remodeling document. When this final piece of the puzzle was introduced, the dispute was settled quickly with the final sale square footage matching the original offering and the tax numbers.

Case 2

Case 2 never made it to court. It was settled prior to trial when both sides agreed that the digital records were inadequate to settle the dispute one way or another and that no other records could be demonstrated to resolve the issue more definitively.

Figure 6 shows the timeline of appearances of different elements in the depicted website based only on the dates of the Wayback Machine files associated with the various versions collected by the machine. In this case, the computers and content associated with the original activities were no longer available by the time the legal matter started, so no other provenance information was available. As such, the Wayback Machine content was asserted to be the "best evidence" and was, in fact, the only evidence that supported the asserted claim.

Figure 7 shows the time sequence in different terms. Note that the dates and times are such that there is no date and time at which the second company (APM) can be definitively shown to have simultaneously appeared with the first company (RC). It cannot be proven from this information that the two company names appeared together and it cannot be proven that they did not appear together.

In this particular case, the screen images depicting the simultaneous appearance of both companies (Figure 2) is deceptive in that it appears to support a highly probative fact that is also highly prejudicial. However, while it is certainly prejudicial, it is not actually probative because it cannot be shown to be reliable. Figure 8 shows the image that was used to demonstrate inconsistency. In this contemporaneous example, a website identified as being from 1997 on the Wayback Machine was used to demonstrate the appearance of later content as if it were from a prior time. A newer graphical image that was not previously saved by the Wayback Machine was substituted on the website and, thus, the newer image was depicted on the Wayback Machine as from the earlier date. The example was intended to demonstrate that either the Wayback Machine depicted the events as simultaneous when they were not or that the author could predict the future (or travel in time), including providing future pictures and facts that cannot be predicted with certainty.

While this was an effective demonstration at the time and was recorded as part of the report generation for the case at that time, the operation of the Wayback Machine was subsequently changed to not display images under such conditions.

At this point, a serious challenge is posed to digital diplomatics. Since the Wayback Machine no longer allows demonstrations of these sorts of failures to be easily generated and evidence collected for legal matters from prior dates may have these misleading depictions, a reconstruction path is no longer available to demonstrate that false depictions gathered from before a change may be false. Instead, what remains are potentially probative and highly prejudicial digital traces and no way to demonstrate that they are not probative. Thus, a best evidence argument along with a claim of "generally reliable as business records" or an archival ancient records claim enable such evidence to be admitted unless the digital diplomatics field becomes a part and parcel of digital forensics and such results are accepted by the relevant scientific community.

It may be reasonably shown that, for potential evidence gathered before the date of the change operation, the demonstration in Case 2 is adequate to question the document, and this may be used in conjunction with a more theoretical path, including the more cogent argument about cause and effect in light of timelines. However, all the theoretical points are likely less effective than a simple demonstration of predicting the future.

If the Wayback Machine did not use dates and timestamps as pathnames and store them with reasonable accuracy in some portion of the instances involved, the approach would not work. Indeed, there is no real assurance that the time mechanism of the Wayback Machine is generally reliable or reliable in any given case.

Implications and the Path Forward

This section discusses the broader implications and the path forward.

Implications

The Wayback Machine is just one example of numerous similar challenges faced in the digital evidence arena. If traces are not collected properly along with the related information that forms the archival bond and redundant data about the archives and their operation at the time the traces were identified and collected, by the time a legal matter gets to the point of examination, the information required to question the documents may be gone forever. Rapid changes to Internet sites, lack of transparency, records of past versions and audit information and the proprietary nature of the sites make reconstruction infeasible in many cases. Without such reconstruction, the seemingly probative information admitted as normal business records or under some other similar exception to hearsay may prejudice cases to the point where injustice becomes common.

4.2

The Path Forward

It appears that one of the vital components contained in historic archives and systems of records is missing in the digital arena. This component, which is produced by various elements of records and recordkeeping activities, includes metadata, context, provenance, chain of custody and transparency (i.e., the archival bond), all of them vital to addressing discovery issues in digital evidence cases.

Courts are generally hesitant to allow the collection and analysis of entire systems and mechanisms because of minimization concerns (criminal) and costs (civil) associated with electronic discovery. In the case of very large systems (e.g., Google's Gmail), practicality prevents the examination of the totality of the collection and fonds.

This discussion assumes that the collection tasks necessary for a forensic examination are conducted by a forensic professional (i.e., a diplomatist, examiner or trained digital evidence collector) who is engaged by a party for the matter or is an independent party with appropriate interests. The question then is: What might be reasonably collected and documented to assure proper diplomatic analysis?

While specific details for different circumstances are elusive, some examples of the information reasonable and prudent to forensic use and diplomatic examination include: Dates, times and detailed actions of all activities performed by a collector in the form of contemporaneous notes taken by the collector at a suitable level of granularity. In particular, who did what, with what tools, when and with what results. This should include the ability to reproduce results. For example, if a command line is used, the files should be kept and the commands recorded with the results, and relevant files referenced in the notes or as part of the report as generated. In cases where repeatability is not feasible (e.g., real-time collection of network traffic), records should include details of dropped packets and other similar information as available, and to the extent feasible, redundant records from re-lated mechanisms (e.g., network flow logs from routing equipment during the times of collection).

The documentary forms as observed by users in the various known circumstances, including sample documentary forms from all potentially relevant presentations. These should be in imitative copy form that can be reliably viewed in as near to an identical fashion as the original, and should be entirely contained in the stored form without the need to reference or display external content.

All URLs, sources for all web pages or other content retrieved and observed from systems over which the observer does not have direct control, and depictions in an imitative copy form.

A copy of whatever can be reasonably attained in a computer usable form. For example, in addition to an imitative copy of a spreadsheet as depicted on a screen, the actual spreadsheet should be saved in as close to a copy in the form of the original as feasible.

Records of an archive in which information is stored should be retained to the extent feasible. Ideally, the process would use a transaction system that retains the history of all transactions, but alternatives such as periodic backups with the ability to go back in time for retrieval may be sufficient in some cases. Note that this is potentially problematic with discovery rules.

Elements of the archival bond, such as directory information about storage locations, relationships among records and files, classification codes, sequence numbers, dates and times associated with documents, etc. For example, many practitioners retain files in dated directories with dated filenames such as 2013-11-25 for files received on that day, versions from that day selected for retention, records of retrieved files, etc. Sometimes, a filename may convey the date of the content (e.g., a paper may have a name starting with YYYY-MM-DD-followed by other identifying elements).

Other records from the systems used for the examination process. This includes test results for tools, calibration information for measurement mechanisms, records of activities performed with tools (e.g., records of commands issued to clear a disk before copying content to it), log files retained by systems in normal use and other similar related data.

Transparency information, such as copies of online contracts contained in websites used in a retrieval process, details of how the mechanisms work, documents from relevant manuals and related documentary sources used, and, generally, all considered and/or referenced materials.

Supporting documents for named protocols, methods, tools, programs, etc. For example, when referencing the use of an IP address or URL on first use, the relevant RFC documents should also be collected for clarity and for historical reference and reuse. For example, one might cite www.ietf.org/rfc/rfc791.txt, which details IPv4, as included with the report in a file named rfc791.txt in the considered directory.

Version numbers for everything that is identifiable, including major and minor versions, dates and timestamps and related indicators. These are often useful in settling disputes, but are also often unnecessary to the purpose, particularly in a clear context.

As suggestions, these may be within the range of reasonable and prudent acts, but there remains the problem that they are just suggestions. They are not widely accepted by the digital forensics and digital diplomatics communities, are not comprehensive, do not provide substantial details in a suitable documentary form, are not structured to facilitate meaningful automated use, and if and to the extent they are missing, they do not imply that the traces offered as evidence will not be reliable, authentic and accurate, or will not be admitted, useful, reasonable and appropriate.

Unlike the records management profession, which often has the opportunity to manage records from the "womb to the tomb," the archival and digital forensics communities must usually work with only the residue (archival) or traces (forensics) that are available. But when experts collect evidence (forensics) or participate in records creation (archival), it would seem useful to provide guidance and a standard approach regarding what to collect and retain (and what not to).

It is important to recognize that examiners get what they get. In many cases, there are opportunities for discovery, but in others there are not. Civil matters often involve uncooperative parties who cannot be forced to act against their interests. Criminal matters have similar limitations associated with the right to non-self-incrimination.

The natural course of events does not result in preservation at the point of inception and, as a result of the lack of discipline by those who implement information technology, this leads to situations where certainty is hard to attain. Current metrics do not provide insights into the resulting certainty of analysis and this limits the realistic ability to place likelihoods on the outcomes of examinations.

The best one can currently do is to identify consistency or inconsistency with hypothesized causes and mechanisms based on the available traces and experience. The absence of evidence is not evidence of absence. When no definitive answer exists, one must learn to say so, and as a community, it is necessary to develop the methods of digital diplomatics and records management in order to give a reasonable hope of justice being determinable in disputes.

A path forward is the application of the same criteria used for the inherent presumed trustworthiness of public records. In this approach, the independence and due care charges of public officials combined with redundant methods starting at the initiation of a public record provide the basis for trust in the system. But carrying this to the full spectrum of potential traces that may be introduced in the legal system implies forcing criteria on the private sector that they may be unwilling to accept, perhaps justifiably so. The creation of a standard for assured admissibility could be a motivating factor, but such an approach has rarely succeeded in the past, except for those that already have legal requirements for diligence.

At a minimum, the individuals and organizations entrusted with the retention of public records should create and require the mechanisms necessary to provide the same level of certainty with respect to borndigital public records as for born-analog public records. The notion of public records and archives in the cloud computing environments of today seem, at first glance, to be an oxymoron. However, it may be reasonable to leverage the low cost and high performance of public cloud computing environments for limited purposes such as widespread and rapid access without the same level of surety required in a legal context. A more thorough process could be used for official versions of records, which may almost always be identical to the unofficial versions, thus providing a combination of high surety when needed and accessibility.

Conclusions

This chapter has presented two cases involving very different facts, issues and component parts. The similarity is that the cases both depend on documentary evidence demonstrating questioned document challenges. The difference is that one set of documents is born-analog and the other born-digital.

From a diplomatics perspective, born-analog documents are handled better because of the historical experience in managing them and because they reside in a context that has been worked out over centuries. They involve known causal mechanisms that can be reproduced and ex-amined using stable scientific methods and principles with measurable levels of accuracy.

Born-digital documents demonstrate many of the problems faced in the current context and the discussion has identified many of the challenges faced in digital diplomatics today. The lack of an adequate scientific examination basis is a major challenge, another is the manner in which records and other documents are generated, cared for and produced.

The origination problem is particularly disturbing. The lack of a single identifiable documentary form that persists over the lifetime of a record is a key part of the underlying problem that cannot be solved in the current paradigms of digital systems. While paper documents such as building permit records are continually updated to reflect new information, digital documents, including modern building permit records that do not include an original paper-signed documentary form, do not leave the rich set of residues to examine. Instead, what exists is a collection of potentially distributed digital record components and other bit sequences associated with the fonds, many elements of which are not retained across migrations and do not possess the transparency or consistency across record-keeping systems that is required to examine them in a common structured manner.

An initial set of objective information would be helpful in collecting and analyzing digital traces, but there is little hope of obtaining all this information when the traces are provided by others. The examiner's role in this situation is limited and little can be done about it today.

Born-digital documents have a long way to go. From their inception through their attempted use in court there is a need for improvement in the data used to support the traces that are found. Consistency analysis holds hope, but there is often too little data to allow determinations of external consistency and the process is fundamentally one of refutation instead of the demonstration of adequacy. Absent guidance on adequacy, examiners are left with an unlimited open-ended challenge of creating enough threads to weave a cloth that opposition experts cannot tear asunder.

It is, therefore, important to start building a standard of adequacy based on the historical diplomatics discipline and its application in forming the concepts of archival science and the basis for trust in public records. A good starting point is to apply the elements of independent actors responsible only for proper record keeping and with no foreknowledge of any particular case acting in a reasonable and prudent manner with adequate redundancy against accidental failures to assure that records are reliable, authentic and accurate.

Figure 1 .

 1 Figure 1. Case 1 example.

Figure 2 .

 2 Figure 2. Case 2 example.

Figure 3 .

 3 Figure 3. Inspector's version of the house.

Figure 4 .

 4 Figure 4. Overhead image of the house.

Figure 5 .

 5 Figure 5. Archived county records.

Figure 6 .

 6 Figure 6. Time sequence of the website.

Figure 7 .

 7 Figure 7. Depiction areas with the histories detailed.

Figure 8 .

 8 Figure 8. Image used to demonstrate inconsistency.