Notifications
Clear all

Forensic Hardware

11 Posts
6 Users
0 Likes
510 Views
techmerlin
(@techmerlin)
Posts: 62
Trusted Member
Topic starter
 

I am looking at purchasing some forensic duplicating hardware. I am looking at the Logicube SF 5000 or if I can get my hands on one an ICS the Image MASSter Solo-3

Does anyone know of a discount or refurbished dealer for forensic imaging units?

Thanks

 
Posted : 05/09/2005 7:22 am
(@gmarshall139)
Posts: 378
Reputable Member
 

If I were trying to save a few dollars (and it sounds like you are) I would look more towards some of the firewire write blockers, perhaps even the ultrakit from digital intelligence or forensic-computers. I'm not sure what the units you mention are selling for, but the ultrakit is about $1200 and comes with bridges for ide, sata, and scsi drives. You also get an extra one in there to attach your storage drive. If you don't think you'll need the SCSI bridge you can put a kit together individually. I'm starting to see SATA more often now, and I would make sure whatever I used was capable of imaging it without using an adapter that may or may not work all the time. You will also need some sort of mobile computer obviously. A notebook or semi portable small form factor. Also in the interest of saving a little money, build it fast enough so that it is also your analysis machine.

If you still want a stand alone imager take a look at digital intelligence's unit. It sells for $800. (digitalintelligence.com)

 
Posted : 05/09/2005 6:52 pm
(@armresl)
Posts: 1011
Noble Member
 

Don't buy some referbished or used unit. This is a business where we all know that yearly we are going to have to pay for dongle upgrades, hard drives, software upgrades, CLE training, more classes, etc. Don't skimp on the item which will be the most important part of your work.

 
Posted : 05/09/2005 9:34 pm
(@armresl)
Posts: 1011
Noble Member
 

Hi Greg,

I also am seeing more SATA in the field. Dell is making it a preffered option in the configs so if you don't change it a lot of times you will get SATA and I ran into 2 SATA's last week in 2 totally unrelated cases.

 
Posted : 05/09/2005 9:36 pm
andy1500mac
(@andy1500mac)
Posts: 79
Trusted Member
 

Hi all,

I notice Digital Intelligence has a USB write blocker and was wondering how often you are called upon the examine these devices ratio wise vs HDD…

Andrew-

 
Posted : 06/09/2005 1:31 am
(@gmarshall139)
Posts: 378
Reputable Member
 

The smaller USB flash drives I acquire in DOS. If it's a hard drive I would remove it from it's enclosure and acquire it via firewire. I could see it being useful for a camera or other such device. The good thing about that USB blocker is that it will allow you to image any device attached to it. You could put a decent kit together for little money. Buy it, plus an ide-usb2.0 bridge and a SATA-USB2.0 bridge and your set. Maybe even a USB card reader, zip drive, etc. Of course you'll be a bit slower than even firewire 400 acquisitions, and significantly slower than firewire 800.

 
Posted : 06/09/2005 4:18 am
andy1500mac
(@andy1500mac)
Posts: 79
Trusted Member
 

Greg….I wasn't even looking at it from the cost effective angle you suggested. This is a nice alternative for someone like myself getting his feet wet and wanting to start by doing things "by the books" just to develop the right habits..

The wife might divorce me but at least I'll have some cool toys (

Thanks,
Andrew-

 
Posted : 06/09/2005 5:38 am
(@armresl)
Posts: 1011
Noble Member
 

Some clients are worried about voiding the warranty on their Lacie's, external hard drives, etc so that product comes in handy when they absolutely will not let you open up the enclosure to access the drive, and you have to do it in Windows.

Greg makes a good suggestion though.

 
Posted : 06/09/2005 11:51 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

Good point with the Lacie's. As I learned from Alan's unfortunate experiences with the big disks, which are RAID 0 arrays, you would probably prefer to image those together rather than try and put that RAID back together. Much better chance of success.

 
Posted : 07/09/2005 12:15 am
hogfly
(@hogfly)
Posts: 287
Reputable Member
 

The majority of disks I see now are SATA and IDE based. I don't deal much with SCSI because no one really has them unless it's from a server. I ordered 3 tableaus from digital intel. 2 fireflies(SATA & IDE) and the USB write blocker.

gmarshall -
Have you tried the raidreconstructor from runtime.org?
It's interesting that you guys were talking about lacie big disks. I'm having 8 of them dropped off next week for recovery due to various failings. What kind of recovery success has anyone had with them?

 
Posted : 09/09/2005 12:58 am
Page 1 / 2
Share: