Forensic Lab Update

We received the computers for the lab and I already set them up. Now, we need to add a network switch in the room so that each computer can communicate with each other. Once the switch is in place, we can share the hard drives from each computer to allow easy file transfers among the machines.

Although there are three computers, we are only using two monitors. We have the two LCD monitors that came with the new PCs and two huge CRT monitors. However, due to limited space, we removed the CRT monitors from the room. Instead, we are using a KVM switch for two of the computers. We also need to get the forensic server up. I am trying to get all of this set up as soon as possible because it will be put to the test soon!

Some companies in the private sector do some things to impress a client such as running simulated processes on multiple screens. It's all for show. However, the public sector is different. There are no clients to impress. Sometimes, we need to work with what we have and aim for functionality. That's not to say that labs in the public sector are not impressive. I have seen some very nice labs from the state and federal government.

Buying New Systems

Being on a budget, we need to order systems that is capable of handling current and future investigations. On one hand, I have an investigator that wants the best machine possible. On the other, I have my supervisor limiting the amount I can spend. Therefore, I had to balance between the two. We do not need the latest and greatest systems to perform an investigation. At the same time, we cannot hold back on certain specs that we really need.

Instead of getting one big powerful machine, we instead got two mid-level systems. That way we can use both machines for two separate investigations. The machines contains an Intel 1.8GHz Core 2 Duo processor. This allows us to have better multitasking capabilities. Programs like EnCase and FTK 2.0 (not out yet as of this writing) uses threads to perform several functions. For example, with EnCase, we can search for keywords while acquiring another drive. With FTK 2.0, we can run an investigation while indexing a drive (not possible with current versions of FTK). However, in order to do this, the processor must share the work between the two processes. By having two processors, the load for each processor is reduced, speeding up the investigation. Each computer also has 4GB of RAM. If we are processing a lot of data, we do not want to run out of memory and use virtual memory, which would hinder the investigation.

Additional specs include flat panel monitors and a tower case. The flat panel is to save space in our lab. Currently, the CRT monitors take up most of the table. The tower case will allow us to expand the system as needed.

To save a little more, we sent out a bid with these specs and had several resellers try to meet our budget. One was able to and we began processing the order.