Thursday, December 15, 2011

Catching up

A few things you might have missed:
  • Late last month, President Obama issued a memorandum directing each federal government agency to perform a comprehensive review of its records management program and then prepare a report for the Archivist of the United States and the Director of the Office of Management and Budget that outlines its plans to maintain and improve its program, "particularly with respect to managing electronic records, including email and social media, deploying cloud based services or storage solutions, and meeting other records challenges." These reports are due on 27 March 2012.
  • Paper records created during an internal military investigation of a November 2005 massacre of civilians in the Iraqi city of Haditha were slated for destruction. However, the records, many of them marked as being secret, ended up in trailers purchased by a local businessman, who hauled the trailers to a Baghdad junkyard. Several weeks ago, a New York Times reporter covering the American withdrawal from Iraq inadvertently found them there. At present, it is unclear whether the military will open an investigation into the handling of these records.
  • After a legal review, the Massachusetts State Archives has decided to open approximately 460 boxes of paper records of former Governor and current Presidential candidate Mitt Romney to researchers. Staff will review the files prior to disclosure and either remove or redact legally restricted information. The repository initially restricted access to the records as a result of a court ruling stating that gubernatorial records were exempt from the state's freedom of information law. As you'll recall, during the last days of the Romney administration, all of the files on its e-mail servers were deleted, several high-ranking officials were allowed to purchase the state-owned hard drives they used, and leased computer equipment was replaced.
  • The administration of South Carolina Governor Nikki Haley routinely deletes internal e-mails. The administration claims that it does so in order to free up storage space on its server, but Erik Emerson, Director of the state's Department of Archives and History, asserts that it violates state records laws.
  • OccupyArchive is George Mason University's Roy Rosenzweig Center for the History of New Media effort to capture digital items documenting Occupy Wall Street and other Occupy movements throughout the world. As Rosenzweig Center director Sharon Leon notes, they're "documenting a post-print movement" -- something that archivists must do if they want to ensure a complete and accurate documentary record.
  • Finally, on a lighter note, here's why we need to caution teens about sexting: sooner or later, their sexts will be all over the Internet for everyone to read.

Wednesday, December 14, 2011

Barry Landau: motion to suppress

Yesterday, attorneys representing Barry Landau, the collector accused of stealing and selling records held by the Maryland Historical Society, the Historical Society of Pennsylvania, the Connecticut Historical Society, and the Franklin D. Roosevelt Presidential Library, filed a motion to suppress all evidence found during a search of Landau's Manhattan apartment. Judging from its content, it seems likely that Landau's attorneys plan to argue that Landau's companion, Jason James Savedoff, who pled guilty to the charges against him on 20 September 2011, committed all of the crimes of which Landau is accused.

Given that Saveoff physically possessed all the stolen materials recovered after he and Landau were arrested at the Maryland Historical Society in July 2011 and is cooperating with prosecutors, I'm not particularly surprised by this line of argument. Do I think it's a good one? Emphatically, no -- by all accounts, Landau is a seasoned researcher and Savedoff was new to the ways of archival research -- but I won't be sitting on the jury that determines Landau's guilt or innocence.

The copy of the motion that appears below was downloaded from Public Access to Electronic Court Records (PACER). I am posting it here so that interested archivists can read it. Downloaded PACER documents may be freely distributed, so please feel free to share it with others.

At present, Landau's trial is currently scheduled to begin on 13 February 2012 and is expected to last 5-6 days.
Barry H. Landau Motion to Suppress 2011-12-13

Thanks to "anonymous archivist" for drawing my attention to the filing of this motion.

Tuesday, December 6, 2011

Salvage and recovery of water-damaged solid-state electronic media

In the wake of tropical storms Irene and Lee, I've done some research into how to salvage and recover data housed on flood-damaged electronic media. There are some great, media-specific resources out there:
However, at present, information about how to salvage and recover data housed on solid-state media such as flash drives and digital camera and smartphone memory cards and solid-state devices such as portable music players (sometimes used to record audio), tablet devices, and computers with solid-state drives (e.g., MacBook Airs) isn't readily available. As a result, I contacted several vendors who specialize in recovering data from electronic media and devices damaged in floods, fires, and other disasters and asked for their advice. What follows is an initial summary of these conversations. I hope that it fills a gap in the existing professional literature -- and that no one who reads this blog ever has cause to make use of the following advice.

First, a few general guidelines:
  • Restoring data from backups is always easier and cheaper than recovering data housed on damaged electronic media. Back up your data!
  • A good disaster management plan will reduce the risk that your media will be damaged. For more information about developing such plans, consult the New York State Archives publication Preparing for the Worst: Managing Records Disasters.
  • Floods and burst pipes aren't the only water-based disasters. First responders use water to fight fire and to keep down dust from collapsed structures. If your media is burned or crushed and wet, treat it as water-damaged.
  • In some instances, you may have no choice but to try to recover data from damaged media. Backups may be incomplete or become corrupt, and sometimes records created immediately before disaster strikes (e.g., photographs documenting a crime scene) are so valuable that the time and expense associated with recovery is warranted.
  • When disaster strikes, salvage damaged media and stabilize it long enough to determine whether your backups are complete and intact. If your backups are complete and readable or the records on the damaged media are less than essential, don't attempt to recover the data stored on the damaged media; however, as noted below, the cost of attempting to recover non-essential data from water-damaged flash drives and memory cards is so low that you might want to give recovery a shot. If the records are essential and backups don’t exist, are incomplete, or have been corrupted, attempt to recover the data housed on the damaged media.
  • Actions suitable for water-damaged paper records may destroy electronic media. Although solid-state media should be air- or rice-dried (see below), some types of electronic media (e.g., hard drives) should be kept wet. Freeze- or vacuum-drying or using heat to speed air drying will likely destroy most forms of electronic media, and using heat to speed air-drying may also damage or destroy media.
  • Protect yourself. Before you enter a flooded area, consult with emergency personnel and make sure that it's safe to enter. Contaminated water and live electricity -- keep in mind that uninterruptible power supplies attached to hardware may be live well after the power goes off -- pose serious safety risks, and noxious gases can build up, particularly in basements. Wear appropriate protective gear.
  • Be prepared to document the disaster. If you need to file an insurance claim, your insurer will likely want photographs illustrating the extent of the damage. If the disaster is small (e.g., you drop a thumb drive housing important records into a cup of coffee), you may want pictures for your own records. If you're an archivist, records manager, or conservator, you may also want images to incorporate into presentations, publications, or other training materials. You may also need to take notes about the scope of the disaster and the location of hardware and media (first responders sometimes disconnect stuff and move it around).
Now, down to the nitty-gritty of salvaging and recovering water-damaged solid-state media and devices. If you're confronted with water-damaged solid-state media or devices, the following guidelines will maximize your chances of recovering your data.

Before you begin your initial salvage and stabilization effort, make sure you have the appropriate supplies on hand. For solid-state media and device(s), you'll need, at minimum, some clean, dry, lint-free cotton cloths (in a pinch, old bedsheets or garments will do) and some gallon- or quart-sized zippered plastic storage bags. Odd as it may seem, you may also want to have some uncooked white rice on hand.

Salvage and stabilization of flash drives and memory cards
  • Remove memory cards from devices and disconnect drives from powered-down hardware.
  • Wipe off any surface dirt and water with a clean, dry, lint-free cloth and then air-dry the media as soon as possible: place the media on a clean, dry, lint-free cotton cloth and prop it up in a way that speeds drainage.
  • You may use fans and dehumidifiers to facilitate the drying process.
Salvage and stabilization of solid-state devices (e.g., cell phones, tablet devices, computers with solid-state drives)
  • Unplug or remove the battery as soon as possible and gently shake the device to remove water lodged in ports and other openings.
  • Wipe off surface dirt and water with a clean, dry, lint-free cotton cloth and then air-dry or "rice-dry" the device. To air dry the device, place it on a clean, dry, lint-free cotton cloth and prop it up in a way that facilitates drainage. You may use fans and dehumidifiers to speed the process. To rice-dry the device, place it in a zippered plastic storage bag and then fill the bag with uncooked white rice. If you must retain the device for more than 2-3 days, replace the rice to reduce the risk of mold growth. (FYI, this "rice-dry" technique may also bring water-damaged cell phones or digital cameras back to life . . . but I don't think I would trust such a device in a mission-critical situation.)
After you've salvaged and stabilized the media or device(s), assess whether recovery is warranted. Do you have complete, uncorrupted backups of the records stored on the media or device? If you do, restored the data from the backups and discard your damaged media. If you don't, how valuable are the records? Are they essential to your business operations or a court proceeding? Are they of immense historical (or, in the case of personal files, sentimental) value? How great is the cost of recovering the data? As noted below, the cost of attempting to recover non-essential data from a flash drive or memory card is quite low. The cost of having a vendor recover data from a solid-state device can be quite high. You have to determine whether the value of the records warrants the cost of recovering them.

If you determine that the data is essential and warrants the cost of recovery, you'll need to contract with a vendor that specializes in data recovery work. Many state archives maintain lists of such vendors, and a quick Web search will identify many others.

If the data is non-essential, discard the media or device appropriately; however, if the data is stored on a flash drive or memory card, you may want to try to recover it yourself. Damaged flash drives and memory cards that house legally restricted or sensitive data should be physically destroyed (by a recycling vendor or with a hammer or shredder), and damaged devices that house such data should be sent to a vendor that will destroy their drives and recycle their other components. Damaged media and devices that don't contain such data can probably be recycled by vendors who specialize in processing electronic waste.

Recovering data from flash drives and memory cards
  • If the data is essential, send the drive or card to a qualified disaster recovery vendor.
  • If the data is non-essential, attempt to read the files on the damaged device. If you are successful, copy the files onto new media and discard the damaged media. If you are not successful, admit defeat and discard the media or, if you are attempting to recover data from a memory card, decide whether the purchase of commercial recovery software (prices begin at around $30.00) is warranted.
Recovering data from solid-state devices
  • Air- or rice-dry the device(s) and then send the device(s) to a qualified disaster recovery vendor. These devices are difficult to open and require special handling. Do not attempt to recover the data yourself.
Establish a relationship with your disaster recovery vendor as quickly as possible. Most vendors have 24/7 phone coverage, and they may be able to provide additional stabilization and recovery advice, offer pickup service (particularly in major metropolitan areas), and provide special handling or packing instructions. Moreover, the sooner recovery begins, the greater the chance it will be successful.

The U.S. National Archives and Records Administration has a great list of security and other considerations that should be discussed with prospective vendors and incorporated into service contracts. I have only one thing to add: be honest about the nature of your disaster. If your media or device came into contact with water that may have contained biological or chemical hazards, tell the vendor about it. Vendors have the protective gear and equipment needed to work with contaminated material and they deal with embarrassing situations (e.g., "I dropped my camera in the toilet!") all the time, but they need to know what's coming their way.

As far as sending the media or device(s) to the vendor is concerned, follow the instructions provided by the vendor. However, you will probably be asked to do the following:
  • Place each piece of media and each device into a zippered plastic storage bag.
  • Surround each bagged piece of media or device with bubble wrap.
  • Pack the media or device(s) appropriately.
  • If sending portable media to a vendor, you may be able to use a rigid shipping envelope. You can also use a box at least twice as large as the media.
  • If sending device(s) to a vendor, use a box at least twice as large as the device
  • If using a box, immobilize the media or device(s) with packing material (N.B.: some vendors will request that each piece of media and each device be placed in its own box)
  • Ship to the vendor via overnight delivery service

Disclaimer: I am not liable for any losses or damages resulting from following any of the advice contained within this post.