When choosing the components for a forensic workstation there are many elements to consider including hardware, software, and peripherals. However, we cannot simply go to the local big box computer store to buy our forensic workstation.
This week find resources to help one build a forensic workstation. When discussing your findings make sure to explain why you chose the items you put forth.
Please see below example: 600 words or more
Hardware, software, and peripherals are the main tools where a forensic investigator should wisely choose its components in order to accomplish a successful investigation and to prevent any mistakes that can possibly arise.
To do this, speed and data integrity are highly needed when it comes to hardware tools in order to lessen the risk for evidence corruption and modification. LOGICUBE® SF-5000 would be an example of a Forensics Hard Drive Clone Capture System.
The system must support:
IDE.
SCSI.
Hardware based drive duplication.
Remote and network based drive duplication.
Duplication and analysis of these common file system types such as NTFS, FAT16/32, Solaris UFS, BSD UFS, EXT2 (Linux), EXT3 (Linux), HFS & HFS+ (Macintosh), and Swap (Solaris, BSD, and Linux).
Removable media for storage and transportation of evidence and disk images.
The system must have:
Network connectivity.
The ability to validate image and file integrity.
The ability of identifying dates and times that files have been modified, accessed and created.
The ability to create file system activity timelines.
The system must be able to:
Identify deleted files.
Analyze allocated drive space.
Isolate and analyze unallocated drive space.
When planning to buy a forensic workstation, it is imperative to go to a specialized in hardware forensics store in order to build a great workstation.