Scribd
Upload
181 views

Building Basic Computer Forensics Laboratory

This document provides guidance on building a basic computer forensics laboratory. It outlines recommendations for lab space, equipment, software, supplies, training and procedures. Key recommendations include securing adequate space and electricity for forensic workstations and storage. It also recommends hardware write blockers, fast exam computers with large storage, forensic software tools, supplies and training in hardware, software, legal and technical review processes. Procedures should establish chain of custody, examination documentation and reloading exam systems between cases.

Uploaded by

Mukhlis Prasetyo Aji
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
181 views

Building Basic Computer Forensics Laboratory

This document provides guidance on building a basic computer forensics laboratory. It outlines recommendations for lab space, equipment, software, supplies, training and procedures. Key recommendations include securing adequate space and electricity for forensic workstations and storage. It also recommends hardware write blockers, fast exam computers with large storage, forensic software tools, supplies and training in hardware, software, legal and technical review processes. Procedures should establish chain of custody, examination documentation and reloading exam systems between cases.

Uploaded by

Mukhlis Prasetyo Aji
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 18

Building a Basic Computer

Forensics Laboratory

SSA J.P. McDonald


Laboratory Director - PHRCFL
FBI Philadelphia
[email protected]
Topics

• Lab Space
• Equipment Needs
• Software Needs
• Supply needs
• Training
• Procedures
Lab Space

• Secure
• Adequate electricity for equipment
• Adequate cooling, low humidity for
equipment
• Desks/benches for forensic analysis and
administrative work
• Locking rooms, or containers for
evidence, both original and Derivative
• Internet connection
Equipment – Write Blockers

• Hardware write
blockers
– Support all types of
hard drives
– www.wiebetech.com
Equipment – Exam Computers

• Want fastest computers you can afford


with:
– Ram – As much as it will take and you can
afford
– CPU – Quad, or at least duel core CPUs
– Good Graphics card, Sound Card, Speakers
– Fire wire 800, 400
– USB 2
– DVD/CD-RW and DVD/CD-R drives
– Large Monitor
– Printers
Exam Computers

• Currently evaluating
Apple GS5 and Apple
Raid
• Can Tri Boot and run
Apple, windows and
Linux from same
box
Exam Computers - Storage

• 1 Terabyte drives
are here. How much
is that?
– 1 million photos
– 16 days of DVD
quality video
– 1 million minutes of
music
Exam Computers - Storage

• Need to base storage on what is being used by


subjects.
• With 1 TB drives now being sold, would get at
least 10 – 20 TB, or as much as you can
afford.
• If more than 1 examiner, would recommend
buying some type of network storage (NAS,
SAN) note, could also use hard drives
– Possible vendors (many others are out there)
• Apple xraid
• Raid Inc. falcon
• Compellent SAN
Network Equipment

• Network switch,
cabling, network
cards for forensic
work
• Another complete set
for Internet and a
firewall, can be
combined
firewall/router/switch
Equipment – Cell Phones/PDAs

• Each phone and PDA use


different data connectors
and power connectors.
• May consider itips for
power needs.
• Sustain cables for phone
data cables.
• Also will need some type
of signal blocking
enclosure for cell phone
exams, Faraday Bag.
Equipment – Tape Dives

• Tapes come in all types


and sizes
– DLT/SDLT
– DDS/DAT
– LTO
• Used for reading
subject’s tapes and
archiving work product
Forensic Software
• Virus protection
– Symantec
– McAfee
• Forensic Suites
– Encase
– FTK
• FTK
• PRTK
• Registry Viewer
– Ilook
– Black Bag – Apple
• Cell Phones
– Data pilot
– Mobil edit – forensic
– Simmus
– bkforensics
– Software from phone manufacturer
• System Ghosting software
– Symantec – Ghost
• Free Forensic tools www.acesle.org
Supplies

• Administrative – paper, pens ect..


• Forensic
– Cables for devices
– CD-Rs, DVD-Rs, and clamshells for them
– Tapes
– Hard Drives
– Tool Kit
– Flash light
– Plastic static bags and bubble wrap
– Labels – CD/DVD and regular
– Printers cartridges
Training - Minimum
• Computer hardware / Networking
– A+; Net+
• Basic Computer forensics knowledge
– International Association of Computer Investigative Specialists
(IACIS)
– NW3C – BDRA, ADRA (Basic/Advanced Data Recovery)
• Tool Specific Training
– Encase
– FTK
– Ilook
• Legal training – Search Warrants, testifying, computer crime
laws and issues for your country.

™ NOTES:
– The field of computer forensics requires daily learning, technology
changes everyday
– Testing – Each Examiner should take and pass a competency test,
to show they understand both forensic principals as well as tool
use.
Laboratory Policies

• A Laboratory should establish and then follow a set of


policies and procedures to run the lab and for doing
exams in general.
• Basics
– Chain of custody and protection of evidence
• Original Evidence
• Derivative Evidence
• All evidence handled by examiner should be initialed, dated
and case number written with indelible marker on the item
• Chain of Custody (Who, What, When, Where, Why)
– Examination Notes
– Examination Reports
– Review of work done in Lab
• Technical review of examiner’s notes
• Administrative review of Examination Report
Laboratory Guidance

• Scientific Working Group


on Digital Evidence
(SWGDE)
http://ncfs.org/swgde

• American Society of Crime


Laboratory Directors /
Laboratory Accreditation
Board – International
http://www.ascld-lab.org/
Laboratory Procedures -Exams
• Exams should not be done on original evidence, a write
blocker should be attached to the hard drive and a
verified (MD5; SHA1) image made (DD, E01, ect..) with
archiving software (Encase, FTK imager, DD, ect…)
• The examination computer used for the exam should be
reloaded (Symantec Ghost) between exams with a base
load and up to date virus software (Symantec, McAfee)
• Findings (files of interest) should be burned to CD-R, or
DVD-R, and finalized (nothing else can be burned to
disk)
• After exam, image file used for the exam should re
validated to show exam did not corrupt
• All of the examiner’s actions should be in their notes.
The notes should be initialed on each page, pages
numbered 1 of __ , and have case #.
Questions
SSA J.P. McDonald
[email protected]

www.rcfl.gov
www.phrcfl.org

You might also like