Downloaded 67 times
More Related Content
The Forensic Lab
- 1.
- 2. Determining the Physical Requirementsfor a Computer Forensics Lab • Most of your investigation is conducted in a lab • Lab should be secure so evidence is not lost, corrupted, or destroyed • Provide a safe and secure physical environment • Keep inventory control of your assets • Know when to order more supplies
- 3. Identifying Lab SecurityNeeds • Secure facility • Should preserve integrity of evidence data • Minimum requirements • Small room with true floor-to-ceiling walls • Door access with a locking mechanism • Secure container • Visitor’s log • High-risk investigations demand more security than the minimum lab requirements • TEMPEST facilities • Electromagnetic Radiation (EMR) proofed • http://nsi.org/Library/Govt/Nispom.html • TEMPEST facilities are very expensive • You can use low-emanation workstations instead • People working together should have same access level • Brief your staff about security policy
- 4. Using Evidence Containers •Known as evidence lockers • Must be secure so that no unauthorized person can easily access your evidence • Recommendations for securing storage containers: • Locate them in a restricted area • Limited number of authorized people to access the container • Maintain records on who is authorized to access each container • Containers should remain locked when not in use • If a combination locking system is used: • Provide the same level of security for the combination as for the container’s contents • Destroy any previous combinations after setting up a new combination • Allow only authorized personnel to change lock combinations • Change the combination every six months or when required
- 5. • How youconfigure the work area will depend on: • Your budget • Amount of available floor space • Number of computers you assign to each computing investigator • Ideal configuration is to have: • Two forensic workstations • One non-forensic workstation with Internet access • Small labs usually consist of: • One or two forensic workstations • A research computer with Internet access • A workbench (if space allows) • Storage cabinets Determining Layout for Small Digital Forensics Labs
- 6. • Mid-size labsare typically those in a private business • Have more workstations • Should have at least two exits, for safety reasons • Cubicles or separate offices should be part of the layout to reinforce confidentiality • More library space for software and hardware storage Determining Layout for Med-size Digital Forensics Labs
- 7. • State lawenforcement or the FBI usually runs most large or regional digital forensics labs • Have a separate evidence room • One or more custodians might be assigned to manage and control traffic in and out of the evidence room • Should have at least two controlled exits and no windows Determining Layout for Large Digital Forensics Labs
- 8. • Maintain licensedcopies of software like: • Microsoft Office (current and older version) • Quicken • Programming languages (Visual Basic and Visual C++) • Specialized viewers (Quick View) • LibreOffice, OpenOffice, or Apache OpenOffice • Peachtree and QuickBooks accounting applications • Various OS versions including • Windows 95,98,XP,Vista,7,8.1,8.2,10 • Linux Distros • Mac OS 7,8,9,10, etc. • Android • Windows NT, Server 2010, etc. Software • Any lab should have in stock: • IDE cables • Ribbon cables for floppy disks • Extra USB 3.0 or newer cables and SATA cards • SCSI cards, preferably ultrawide • Graphics cards, both PCI and AGP types • Assorted FireWire and USB adapters • Hard disk drives • At least two 2.5-inch Notebook IDE hard drives to standard IDE/ATA or SATA adapter • Computer hand tools Hardware Stocking Labs
- 9. Summary • A digitalforensics lab is where you conduct investigations, store evidence, and do most of your work • Seek to upgrade your skills through training • A lab facility must be physically secure so that evidence is not lost, corrupted, or destroyed • It is harder to plan a computer forensics lab for a police department than for a private organization or corporation. • A forensic workstation needs to have adequate memory, storage, and ports to deal with common types of cases that come through the lab
Editor's Notes
- #3 Determining the Physical Requirements for a Computer Forensics Lab Most of your investigation is conducted in a lab Lab should be secure so evidence is not lost, corrupted, or destroyed Provide a safe and secure physical environment Keep inventory control of your assets Know when to order more supplies
- #4 Identifying Lab Security Needs Secure facility Should preserve integrity of evidence data Minimum requirements Small room with true floor-to-ceiling walls Door access with a locking mechanism Secure container Visitor’s log People working together should have same access level Brief your staff about security policy
- #5 Using Evidence Containers Known as evidence lockers Must be secure so that no unauthorized person can easily access your evidence Recommendations for securing storage containers: Locate them in a restricted area Limited number of authorized people to access the container Maintain records on who is authorized to access each container Containers should remain locked when not in use
- #6 Determining Floor Plans for Digital Forensics Labs Figure 2-2 Small or home-based lab
- #7 Determining Floor Plans for Digital Forensics Labs Figure 2-2 Small or home-based lab
- #8 Determining Floor Plans for Digital Forensics Labs Figure 2-2 Small or home-based lab
- #9 Stocking Hardware Peripherals Any lab should have in stock: IDE cables Ribbon cables for floppy disks Extra USB 3.0 or newer cables and SATA cards SCSI cards, preferably ultrawide Graphics cards, both PCI and AGP types Assorted FireWire and USB adapters Hard disk drives At least two 2.5-inch Notebook IDE hard drives to standard IDE/ATA or SATA adapter Computer hand tools
- #10 Summary A digital forensics lab is where you conduct investigations, store evidence, and do most of your work Seek to upgrade your skills through training A lab facility must be physically secure so that evidence is not lost, corrupted, or destroyed It is harder to plan a computer forensics lab for a police department than for a private organization or corporation