Recommended forensic hardware

Sounds good to me I could use some kit at home..

Greetings,

Sounds good to me. I've bought some decent used stuff through some of the forensic mailing lists but would feel more comfortable posting a "does anyone have" in an area specifically set aside for such things.

-David

I'll second the idea

In lieu of posting in a possible classifieds section, I have decided to sell a number of hardware and software items. May end up doing it via eBay but thought I would check the response here. The items are

1. Digital Intelligence Ultrakit with USB Bridge (T8), SCSI Bridge (T4), SATA Bridge (T3u), IDE Bridge (T5), 2.5" and 1.8" Hard Drive Adapters, Ultrablock Forensic Card Readers (Read Only and Read/Write) plus all cables and adapters etc. All contained in a yellow Pelican case. New Price approx. $1659.00.

2. Encase Forensic Edition V5. Boxed, dongles etc.

3. AccessData UTK 1.61. Boxed, dongles etc.

Would ideally like to sell all together but will consider selling separately.

Lewis Duffy
ACE (AccessData Certified Examiner)

Thanks for all those replies. I've also received a few messages privately which mentioned one or two risks involved with setting up a classifieds forum (very much reflecting my own thoughts on previous occasions) but I think it's worth giving it a go for a while at least.

I'll post a sticky in the new forum with some ground rules shortly but in the meantime, Lewis, perhaps you'd like to repost your own message?

Cheers,

Jamie

Following on from Jonathan's earlier post re. cheap write blockers at the Cool Drives site, does anyone have any experience of the enclosures listed at the following German site

http//www.firewire-revolution.de/catalog/index.php?cPath=59_79

or indeed any experience/knowledge of what appears to be the original manufacturer

http//www.ioi.com.tw/products/prodcat_specialty.aspx?ProdCatID=103&SubCatID=1000

I hadn't heard of them until this evening but some items (e.g. FW2ATA525-MR1-WP) seem to be fairly cheap compared to other manufacturers' devices.

Following on from Jonathan's earlier post re. cheap write blockers at the Cool Drives site, does anyone have any experience of the enclosures listed at the following German site

http//www.firewire-revolution.de/catalog/index.php?cPath=59_79

or indeed any experience/knowledge of what appears to be the original manufacturer

http//www.ioi.com.tw/products/prodcat_specialty.aspx?ProdCatID=103&SubCatID=1000

I hadn't heard of them until this evening but some items (e.g. FW2ATA525-MR1-WP) seem to be fairly cheap compared to other manufacturers' devices.

Very interesting find Jamie. I don't think there's much to lose by buying one of these, testing it it in a variety of situations and then testing it again on a regular basis for it's write-blocking capability. That's more than most people do with their FastBlocs, Talons, etc! wink

Following on from Jonathan's earlier post re. cheap write blockers at the Cool Drives site, does anyone have any experience of the enclosures listed at the following German site

http//www.firewire-revolution.de/catalog/index.php?cPath=59_79

or indeed any experience/knowledge of what appears to be the original manufacturer

http//www.ioi.com.tw/products/prodcat_specialty.aspx?ProdCatID=103&SubCatID=1000

I bought one of these enclosures (USB version) a few months ago and it works fine. The only problem is that they're not very strong. A lot of parts are plastic and I'm not confident they're going to last years being used everyday… However, for someone meticulous with a limited budget, it can be a good buy…

I have also used IOI's "simple" FW writeblocker for some years and I'm very happy about it. I ran some tests about its write blocking capabilities, and although the tests were not extensive, they were fully satisfactory to me. They sell at 50-60 euros in France…

http//www.ioi.com.tw/products/proddetail.aspx?ProdID=1010006

No power supply with these, though, and so I use the power supply of an external HDD enclosure or, to save time, I even plug the write blocker directly inside the examined computer case, using its power supply…

Thanks both. I think this brings up the interesting question of how we (as practitioners) test the write blocking capability of new devices both to satisfy ourselves that they work as advertised and to be able to show that in court.

For the sake of argument, let's imagine that we *need* to use one of these IOI products (if we want to be specific we'll say it's the FW2ATA525-MR1-WP already mentioned) but it's not a device you've used or tested before, it hasn't been used in a court case in your area and you have only the manufacturer's word that it works properly. What methodology are you going to employ to test it in some formal sense?

For some food for thought, James Lyle's 2006 paper "A strategy for testing hardware write block devices" makes good reading.

The thought just crossed my mind that we should probably add evidence bags/tape to this section. Recommendations welcome!