Title: 3. Computer Forensics Hardware Tools
Course: IN 2005 Digital Forensics > Section: Module 7: Chapter 7 - Current Computer Forensics Tools

Computer Forensics Hardware Tools

1. The fact that hardware will eventually fail, so you need to carefully plan for equipment replacement.  Costs you should consider when planning your budget include failures, maintenance fees and anticipated replacements.

Forensic Workstations

1. Types of workstations you can find, including:
  - Stationary
  - Portable
  - Lightweight
2. You need to balance what you need and what your system can handle.
3. The differences in planning the hardware for a computer forensic lab for a police agency and for a private corporation lab.  Clearly the requirements are going to be different.  Private labs need to deal with fewer options than police labs.
4. Building your own workstation is not as difficult as it sounds.
5. The advantages of building your own forensic workstation, including:
  - Customized to your needs
  - Save money
6. The disadvantages of building your own forensic workstation, including:
  - Hard to find support for problems
  - Can become expensive if careless
7. You can buy a forensic workstation from a vendor as an alternative, such as F.R.E.D units and F.I.R.E. IDE.  Having vendor support can save you time and frustration when you have problems.
8. You can always mix and match components to get the capabilities you need for your forensic workstation.

Using a Write-Blocker

1. A write-blocker prevents data writes to a hard disk.
2. Software write-blockers are OS dependant. Hardware options are ideal for GUI forensic tools. They act as a bridge between the suspect drive and the forensic workstation.
3. When you use a write-blocker, you can navigate to the blocked drive with any application, but you cannot write to the drive. A write-blocker discards the written data. However, for the OS, the data copy is successful.
4. Some of the connecting technologies used by write-blockers, including:
  - FireWire
  - USB 2.0
  - SCSI controllers

Recommendations for a Forensic Workstation

1. You should determine where your data acquisitions will take place.
2. Some of the recommendations for a forensic workstation, including:
  - Data acquisition techniques such as: USB 2.0 and FireWire
  - Expansion devices requirements
  - Power supply with battery backup
  - Extra power and data cables
  - External FireWire and USB 2.0 ports
  - Assortment of drive adapter bridges
  - Ergonomic considerations
  - Keyboard and mouse
  - A good video card with at least a 17-inch monitor
  - High-end video card and monitor
3. If you have a limited budget, one option for outfitting your lab is to use high-end game PCs.