Before attempting to read or transfer born-digital files from removable physical storage media (such as 3.5-inch or 5.25-inch floppy disks, CD-ROMs/DVDs, Zip disks, USB flash drives, or external hard drives), repositories should establish a controlled acquisition environment and workflow to protect the integrity and authenticity of the original data.

1. Inspect, Inventory, and Photograph Physical Media

• Assign a unique identifier to each piece of physical media and document all handwritten or printed labels (potentially photographing the disk or housing before handling).
• Inspect media for physical damage, mold, dust, or mechanical issues (e.g., bent floppy shutters or degraded magnetic binder) before inserting it into a drive.
• Flip physical write-protect tabs (such as the sliding tab on 3.5-inch microfloppies) to the write-protected position immediately.

2. Assemble Drives, Controllers, and Write-Blockers

• Write-Blocking: Modern operating systems routinely alter file system metadata (such as last-accessed timestamps, hidden index files, or volume journals) the moment a disk is mounted. Always place a hardware write-blocker (e.g., Tableau, WiebeTech, or KryoFlux/FC5025 for floppies) or a verified software write-blocking mount between the source medium and the curation workstation.
• Legacy Media Drives: Maintain working drives for legacy formats (3.5″ USB/internal floppy drives, 5.25″ drives with flux controllers, Iomega Zip drives, optical drives, and IDE/SATA/SCSI bridges).

3. Decide Between Disk Imaging and Logical File Transfer

• Bitstream Disk Imaging (.dd, .raw, .iso, .aff, .E01): Captures a sector-by-sector copy of the entire storage medium, preserving original file system timestamps, directory structures, unallocated space, and deleted files, while allowing future emulation or forensic analysis without touching the fragile physical carrier again.
• Logical File Copying: Copies active files using tools that preserve file attributes and verify cryptographic checksums (e.g., BagIt, Curators Workbench, rsync/robocopy with hash manifests).

4. Generate Checksums and DFXML Metadata

• Calculate cryptographic message digests (MD5, SHA-1, or SHA-256) immediately upon capture to establish baseline fixity.
• Use environments like BitCurator, Guymager, The Sleuth Kit (fiwalk), and bulk_extractor to generate Digital Forensics XML (DFXML) and screen for sensitive or personally identifiable information (PII).

Further Reading & Workflow Studies

• Martin J. Gengenbach (2012), “The Way We Do It Here”: Mapping Digital Forensics Workflows in Collecting Institutions (Full PDF)
• Matthew G. Kirschenbaum, Richard Ovenden, and Gabriela Redwine (2010), Digital Forensics and Born-Digital Content in Cultural Heritage Collections, CLIR Publication 149.
• Ricky Erway (2012), You’ve Got to Walk Before You Can Run: First Steps for Managing Born-Digital Content Received on Physical Media, OCLC Research.
• Return to Acquiring Data from Storage Media Guide Overview