Join Us!

Forensic laptop sug...
 
Notifications
Clear all

Forensic laptop suggestion  

  RSS
fraudit
(@fraudit)
Member

Since I have to perform a lot of works on site, not at my office, I need a powerful notebook in order to do so.

I've been using HP elitebook 8560w (i7-2630QM, Quadro M1000, 32GB, 2xHDD - 256 GB SSD + 1 TB HDD), but I'm not very satisfied with it since it's very noisy and generates a lot of heat (well, those two features are connected…) even when not performing power-consuming operations. It's two years old now and I've already had my screen replaced twice, USB 2.0 ports stopped working and the keyboard produces strange squicks (almost from the beginning). Another upsetting thing is that it cannot generate a sharp picture at the same time on its own display and external monitor - the details on one of them are always blurred (the resolution is the same on both displays). I'm also not a big fan of a local HP service, but that's a common thing I believe…

Anyway, I've been thinking on something new. Let's leave the costs aside for a while as I can customize a lot of models to my needs. The problem I'm facing is a common shortage of ports in available models - I'd like to have as many USB 3.0 ports as possible (and as many powered as possible), DisplayPort + VGA connector, eSATA connector. Another thing is the keyboard - with a numeric block necessarily and full-size arrow keys (why there are in 99% some strange ideas with those keys?).

I've found XNOTE P377SM-A (build on a Clevo platform) that is powerful, rich-featured and highly customizable (but it doesn't have DisplayPort…) but I have no experience with this brand. The really powerful config would cost around $ 3,500-4,000 (VAT included - Europe…). Do you have any comments on that model/manufacturer?

Can you come up with another brand / model worth considering as a forensic laptop?

Quote
Posted : 14/05/2014 5:14 pm
jaclaz
(@jaclaz)
Community Legend

NOT what you have asked, mind you 😯 , but maybe of some use.

I don't believe that you are going to do "on-site" work relying on laptop batteries. ?
Or holding your laptop on your actual lap, right?

So, if you have "on-site" a mains connection (and a desk/table/whatever place to rest your apparata), you could think of making a paradigm shift wink and move from "laptop" to "portable".

Modern laptops are actually (IMHO) disguised stoves, they heat like hell, with - usually - insufficient cooling (and a large part of this is because of the senselessly high-power video card, which, unless you do some hardcore gaming in the pauses or you use on-site it's GPU for some serious password cracking you don't really-really need).

So what if you get a decent mini-itx (example)
http//uk.hardware.info/reviews/5144/13-mini-itx-motherboards-for-intel-4th-generation-core-processors
(or even thin-mini-itx) motherboard
http//www.gigabyte.com/microsite/348/images/overview.html
and build yourself an all-in-one (possibly bolted to the back of a 15" or 17" LCD screen) or used as "brick PC"?

I believe you have anyway to carry on site any number of boxes/suitcases (for tools, storage drives, writeblockers, evidence bags/containers/*what not*) so I don't think having a slightly less "portable" portable would be a real issue, but you will save quite a bit of money, have more flexibility and be able to replace components easily.

And there are now very small UPS's, just another "brick" to add.

jaclaz

ReplyQuote
Posted : 14/05/2014 10:39 pm
fraudit
(@fraudit)
Member

Thanks for this, jaclaz! I haven't considered that but it sounds like something to give a thought about!

Certainly I don't rely on batteries, as they get drained way too fast when processing data. I always insist on having a room / desk with the guaranteed power source that is connected to the company / building UPS system (of course my wish is not always fulfilled).

In fact you're right by pointing at portability at the cost of laptop-based solutions. However, many of the manufacturers offer what they call portable workstations, which are in fact elephant-weight & size laptops ) . I don't mind carrying such a beast and don't expect it to weight 2-3 kilos.

Still, the laptop concept seems to work best for me due to ease of transport and minimum care arrangements. This doesn't mean I'm stick to portability in terms of dimensions and/or weight - it's rather the shape.

ReplyQuote
Posted : 14/05/2014 11:16 pm
jaclaz
(@jaclaz)
Community Legend

This doesn't mean I'm stick to portability in terms of dimensions and/or weight - it's rather the shape.

Yep ) , but one can use some fantasy.
From this
http//reddeerdialogue.blogspot.it/2007/03/first-computer.html
to this
http//resource.mmgn.com/Gallery/normal/Commodore-SX-64-1041428.jpg
to this
http//www.recycledgoods.com/product/38780-hm-10397-suitcase-computer-w-screen-&-keyboard
to this 😉
http//eeepc.net/poor-mans-netbook-goes-up-for-bidding-on-ebay/
there is a common evolution trend.

Not really what I had in mind, but simple, cheap and effective
http//englishrussia.com/2009/02/03/the-mobile-computer/

A readily available "portable case" (more on the "brick" PC idea)
http//www.lian-li.com/en/dt_portfolio/pc-tu100/

jaclaz

ReplyQuote
Posted : 15/05/2014 12:41 am
webbo
(@webbo)
New Member

i was in the same situation as yourself, finally obtained a Desktop replacemnt HP Elitebook 8570. Does the job nicely but dont ask me for the spec as i dont have a clue. It has backlit keyboard as well as the number keypad, but only small arrow keys. Good luck.

ReplyQuote
Posted : 03/06/2014 6:38 pm
fraudit
(@fraudit)
Member

Hmmm… I don't think I'll trust HP in the nearest future. roll

Finally I've decided to purchase Dell Precision M4800 (with i7 4900MQ) - it has a rich equipment, including many I/O ports, perfectly working keyboard (well, the test model had…) and two cooling systems which I hope will cope with heat such a best will undoubtedly produce 😉

ReplyQuote
Posted : 04/06/2014 12:09 am
jhup
 jhup
(@jhup)
Community Legend

I just discovered PC part picker.

It is the coolest thing since 0K.

It saved me from some great headaches.

Why Intel, why did you have to change the naming? What was wrong with 186, 296, 386, 486 and so on? What have I done to you to deserve this?cry

ReplyQuote
Posted : 04/06/2014 1:13 am
jaclaz
(@jaclaz)
Community Legend

What have I done to you to deserve this? cry

It is not what you have done.

It is what you have NOT DONE! 😯

If you had (at the right time) kicked (the right) a**es and kicked 'em hard enough, this would not have happened.

You are guilty by omission roll wink .

jaclaz

ReplyQuote
Posted : 05/06/2014 12:41 am
ScotchBroth
(@scotchbroth)
New Member

I use laptops from Malibal.com. eSata, USB 3, Full Keyboard, back lit, You can customize from there.

ReplyQuote
Posted : 05/06/2014 2:17 am
fraudit
(@fraudit)
Member

I use laptops from Malibal.com. eSata, USB 3, Full Keyboard, back lit, You can customize from there.

Hmmm… Looking at their specs and design, I'd bet a couple of dollars they are based on the Clevo platform ) As mentioned earlier, I've considered it but finally decided not to give them a try. I have one company that distributes them in my country, so I was a bit afraid about the service issues.

As some of you know, our devices tend to break when they are urgently needed 😉 Dell offered 3-year warranty, door-to-door and next day service visit. It may not be "the top of the pops" but I believe it's sufficient.

Nevertheless, if anyone uses Dell for computer forensics, I'd be grateful to share your comments and observations.

ReplyQuote
Posted : 05/06/2014 5:17 pm
jaclaz
(@jaclaz)
Community Legend

Huge bump, I know, but maybe (just maybe) this little nice project on kickstarter
https://www.kickstarter.com/projects/710967680/companion-case-make-your-pc-portable?
will allow an alternative for "portable" forensic machines.

jaclaz

ReplyQuote
Posted : 20/06/2016 2:33 pm
EricZimmerman
(@ericzimmerman)
Active Member

XoticPC sells sager machines which rock. used 3 of them in the past 3 years, zero issues, well built, and you can configure whatever you want in it.

i would not get one of the mainstream vendors for forensic work as you will not be able to pick parts, but thats just me.

ReplyQuote
Posted : 20/06/2016 8:26 pm
btforensics
(@btforensics)
New Member

Hi Forensic Focus,

First, I would like to greet everyone a Happy New Year! )

Since it is a new year, it means that there will be a new budget for our company to purchase new stuff that we need for our job )

I did not create a new thread since this thread appears to be the same with my question.

We are looking for new laptops that we can use for digital forensics.

Here are the stuffs that we will be doing with the laptop
Log Reading – IDS Logs, malware logs, firewall Logs, event logs, etc…
Sometimes we read logs around 5GB-10GB in file size

We will also be using the following tools

Harddisk Acquisition Tools
FTK Imager
Encase

Memory Acquisition Tools
Volatility
Redline

VMware Workstation with the following
SIFTTools
This is where we will be using volatility and log2timeline
We also use some other forensic tools built in to SIFT

Windows XP/Windows7 for malware black box testing
Basically this is where we run malware files to check the behavior. It has installed tools for packet sniffing, static analysis, system modification (like drop files, deleted files, registry modification), process monitoring, etc.

Some other stuff that we might do
Installation of cuckoo sandbox

The stuff that we will be doing is not limited to the things that I indicated, we will be doing lots of stuff related with digital forensics so there could be new tools that we need to add in the future.

Here is the basic laptop specification that we have in mind
Operating System Windows 7
Processor I7
RAM 32GB
HDD 4TB
USB 3.0

Any inputs will be appreciated!

Thank you!
btforensics

ReplyQuote
Posted : 06/01/2017 4:14 pm
jaclaz
(@jaclaz)
Community Legend

Here is the basic laptop specification that we have in mind
Operating System Windows 7
Processor I7
RAM 32GB
HDD 4TB
USB 3.0

IMHO you DO NOT want an internal (crappy) 4TB disk, but rather a blazingly FAST SSD 512 Gb or 1 Tb, and of course USB 3.1.
Then have as many external, USB 3/3.1 multi-TB hard disks and/or FAST USB 3.1 SSD's as your budget allow.

jaclaz

ReplyQuote
Posted : 06/01/2017 7:49 pm
Share: