The design of forensic computer workstations

The design of forensic computer workstations

• 1.
  The Design of ForensicComputer Workstations Presented by John Samborski, CEO Ace Computers Ace Computers 575 Lively Blvd. Elk Grove Village, IL 60007-2013 Contact 877-ACECOMP (877-223-2667) www.acecomputers.com
• 2.
  About the presenter JohnSamborski, P.E. is a recognized expert in forensic information technology, with an extensive history of innovation and thought leadership in system integration. Since founding Ace Computers in 1983, he has aggressively pursued the development of custom, cost-effective products and services in concert with well-known industry leaders. He was a founding member of the Intel Premier Board of Advisors in 2002 and was awarded a life-time position. Ace Computers is one of the largest, oldest, and most respected custom technology developers and builders in the U.S. and holds numerous federal and state level contracts.
• 3.
  Evidence … needs tobe extractable from electronically stored information (ESI) sources without corrupting that evidence. Properly designed forensic computer workstations help accomplish that goal.
• 4.
  What is digitalforensics? The acquisition, scientific examination, and analysis of data retrieved from digital devices in such a way that the information can be used in a court of law or for the purposes of the retriever without any disturbance to that evidence.
• 5.
  Designing forensic workstations Inorder to design forensic workstations, the first determination is what types of media need to be forensically read, retrieved from suspect data, and included in the chain of custody.
• 6.
  Evidence and accuracy Oneof the most important steps is to ensure that the evidence has been accurately collected and that there is a clear chain of custody from the scene of the crime, to the investigator, and ultimately to the court.
• 7.
  The workstation’s purpose Anotherkey design decision is the workstation’s purpose: data acquisition, processing, or both. Many systems are multi- purpose and can perform forensic data acquisition and processing equally well.
• 8.
  Processors and speed Otherimportant considerations are the required processing speed, the number of processors, processor cores, and amount of memory anticipated for the data processing. •Systems are available with 1-4 processors and up to 1TB of RAM. •A popular configuration involves two Intel® Xeon® 6-core (each) processors and 256GB of DDR4 memory. •The number of processors and cores per processor should be determined by the system requirements of the software that will run.
• 9.
  The media type Anotherconsideration is the type of media the system needs to acquire data from. Once this is established, the next step is to plan and include write-protected data acquisition methods. The most basic media is a hard drive write-blocked forensic bridge.
• 10.
  Write-blocked forensic bridges Write-blockeddrive-bay mounted forensic bridges are available for all common hard drive types such as IDE, SATA, SAS, SCSI, IEEE1394 (Firewire), USB and with adapters for using 3.5”, 2.5”, and 1.8” size drives. A write-blocked flash media card reader is also useful for forensically reading media cards such as SD cards, CompactFlash, and others; this prevents the addition of anything to the source data.
• 11.
  Read-write considerations A read-onlymedia card reader is best, since it will prevent accidental corruption of the data. A read- write switchable reader can potentially be corrupted, but by using a model that is incapable of writing data, that source of error can be eliminated. It’s simple to add a standard external flash reader/writer to the system. Although it will be obvious to users that this external flash is capable of corrupting data, the internal model should be write-blocked at all times.
• 12.
  Optical media Optical mediais another common source of forensic data. This media is typically not written to without specialized software, so a standard DVD reader/writer or Blu-Ray reader/writer will perform this work adequately.
• 13.
  The storage system Oncethe data can be read in a forensically safe manner, the data needs to be stored on either a target drive, a RAID array, or both. With the storage system defined, the design of the RAID system or the allowance of destination drive bays needs to be specified.
• 14.
  GPU considerations Another decisionis whether graphic processing units (GPUs)--for assistance in breaking passwords--need to be included. Normally, systems are shipped with a single graphics card used for display purposes, but users can also leverage the intense processing power of the GPU for assistance in brute-force password cracking through massively parallelized iterative attempts.
• 15.
  Higher end graphicscards By using a higher-end graphics card or multiple graphics cards, the forensic system can also be used to shorten the time needed to break a password installed on a system or to open up files which have been encrypted.
• 16.
  Password decryption servers Specializedpassword/decryption servers and clusters with multiple GPU optimized systems designed for 24-7 operation are also available, and are frequently used in the federal market by major government and law enforcement agencies.
• 17.
  Ace Computers’ findings AceComputers has benchmarked numerous platforms and found the optimal design and configuration for the optimal operation of the GPU subsystem for password cracking and it is one of our strongest areas of expertise.
• 18.
  The value ofa system integrator There are numerous items to consider when designing a forensic workstation and since the system components change often, it is best to work with a systems integrator that is actively involved in the market.
• 19.
  What the systemintegrator does The systems integrator will know how to optimize the design based on the latest software, hardware, and thermal techniques.
• 20.
  Integrators for governmententities For government agencies, it also makes sense to work with a firm that can custom-design a system to exacting specifications and has popular contracting vehicles available to facilitate the purchase directly without the complications of contracting procedures.
• 21.
  Thank you! Any questions? ContactAce Computers 877-ACECOMP/(877-223-2667) www.acecomputers.com