Manuals as Forensic Evidence: Reconstructing Digital Systems and Administrative Practice

Digital Forensics Workshop, Bern

Invited Talk at Digital Forensics Workshop, Bern

Technical manuals are often treated as auxiliary aids for interpreting legacy artefacts. This talk argues they should be read as primary forensic evidence: operational scripts that prescribe architectures, roles, workflows, and permissible actions—thereby enabling reconstruction of both systems and the practices they organised.

I develop this claim through the case of the Swiss Zentrale Ausländerregister (ZAR). Using two documentary snapshots—an early system manual draft in “notebook” form (1976) and a later user manual (revision unknown, 1978)—I show how iterative documentation supports reconstructing core processes such as data entry, validation, and the distribution of labour across offices and the computing centre.

ZAR’s manuals further expose governance ambitions and expansion logics (e.g., adding new characteristics without major rework, and framing the register as an instrument of control).

Finally, I contrast these situated manuals with generic vendor documentation (IBM System/370 Principles of Operation), indispensable for hardware interpretation but largely silent on local practice.