Title: 2. Determining the Physical Requirements for a Computer Forensics Lab
Course: IN 2005 Digital Forensics > Section: Module 3: Chapter 3 - Planning for Contingencies

Determining the Physical Requirements for a Computer Forensics Lab

1. Most of the investigative process is performed at a lab.  Therefore, the lab should provide a safe and secure physical environment for you and your evidence.
2. As with any other lab, you should perform inventory controls of your assets.  This will help you know when you need to re-order lab supplies.

Identifying Lab Security Needs

1. A forensics lab is a secure facility with special security requirements oriented to preserve the integrity of the evidence data and the work done there.
2. A list of minimum requirements for a lab
  - Small room with true floor-to-ceiling walls
  - Door access with a locking mechanism
  - Secure container, such as a safe or heavy-duty file cabinet with a quality padlock
  - Visitor’s log listing all people who have accessed your lab
  - Authority and access levels

Conducting High-Risk Investigations

1. High-risk investigations cannot be conducted in regular forensics lab facilities.
2. Some of the characteristics of a TEMPEST lab.  Start by mentioning that the computer emanates electromagnetic radiation that can be picked up by specialized devices up to half-a-mile away, allowing attackers to know exactly what you are doing with your workstation.
3. The use of low-emanation workstations as a less expensive alternative to a TEMPEST lab.

Using Evidence Containers

1. An evidence container must be secure to prevent unauthorized access to the evidence.  Security recommendations include:
  - Restricted area
  - Minimum number of authorized people to access the container
  - Always lock the container when not in use
2. Some of the practices to follow if a combination locking system is used, including:
  - Provide the same level of security for the combination as for the container’s contents
  - Destroy any previous combinations after setting up a new combination
  - Allow only authorized personnel to change lock combinations
  - Change the combination every six months or when required
3. Some of the recommendations if you’re using a keyed padlock, including:
  - Appoint a key custodian
  - Stamp sequential numbers on each duplicate key
  - Maintain a registry listing which key is assigned to which authorized person
  - Conduct a monthly audit
  - Take an inventory of all keys
  - Place keys in a lockable container
  - Maintain the same level of security for keys as for evidence containers
  - Change locks and keys annually
4. An evidence container should be made of steel with an internal cabinet or external padlock.
5. The convenience of having a built-in evidence storage room on your lab and the security measures you should follow building and managing it.
6. Other recommendations like buying a media safe and keeping an updated evidence log.

Overseeing Facility Maintenance

1. The importance of a well-maintained lab to ensure the safety and health of the lab staff members.
2. Some of the considerations for appropriate facility maintenance.  You should mention:
  - Immediately repair damages to walls, ceilings, and floors
  - Implement measures to protect equipment from static electricity
  - Proper disposal of materials

Consider Physical Security Needs

1. Some of the mechanisms you have to enforce your policy:
  - Sign-in logs for visitors
  - Escort all visitors while inside your lab
  - Alert others of the presence of a visitor
  - Install an alarm system
  - Hire guards to protect your premises, especially at night

Auditing a Computer Forensics Lab

1. Regular auditing processes can help you to better enforce security policies.
2. Some of the items your audits should include:
  - Ceiling, floor, roof, and exterior walls of the lab
  - Doors and doors locks
  - Visitor logs
  - Evidence containers logs
  - At the end of every workday, secure any evidence that’s not being processed on a forensic workstation

Determining Floor Plans for Computer Forensics Labs

1. Computer forensics labs come in a variety of setups and arrangements. Use Figures 3-2 through 3-4 to illustrate different computer forensics lab setups based on their sizes.  You should mention characteristics such as:
  - Number of workstations
  - Number of workbenches
  - Working area size
  - Number of exit doors
  - Evidence room description
  - Communications options (phone, Internet, LAN, WAN)