The perfect lab would be one without people in suits and ties worrying more about paperwork than actual work, which would leave the techies and forensics people to do their thing instead of worrying about complete bullshit.
lol
Bitter much?
Love your responses and very glad that I could get some of that frustration out.. )
But on a serious note, I just want to get the knowledge floating..
Some info on what is your perfect choice would be.
Thanks for the serious ones here..
But on a serious note, I just want to get the knowledge floating..
Some info on what is your perfect choice would be.
Seriously your parameters are so broad it would be difficult to respond with anything more than complete fantasy.
Is this a lab for me when I retire? A lab for 2 or 3 examiners? For 5 to 10 working for a small LE agency? For 20 examiners and 80 eDiscovery attorneys/paralegals? Other?
Fantasy within some budget? Straight dead box or does it need to cover IR/Live Response/eDiscovery?
The number/types of servers and workstations (and anything else) I'd include in the spec would depend substantially on the anticipated team size and case types I was dealing with. One thing I'd certainly add would be a backup system.
Rather than WinHex I'd get X-Ways worth it for the extra capabilities.
Depending on the case types I'm dealing with I'd probably get Internet Evidence Finder and NetAnalysis.
Rather than 2x Cellebrite units I'd get 1x Cellebrite and 1x XRY to give myself more options.I'd get Tableau and Wiebetech write-blockers plus a full set of available adapters for each. TBH you could go all-Tableau or all-Wiebetech without issues it's certainly not as strong a recommendation as that of getting two mobile forensics tools.
I wouldn't buy dedicated disk copying devices, but that's just me.
This x10. I know it's not financially feasible for small-to-mid sized law enforcement agencies to have multiple mobile extraction devices; however, if you work with other local agencies in your area and coordinate a solution to where each agency has different mobile tools it would help out a lot.
I'd add large duel monitors to each workstation. Too much information on the screen w/ FTK/Cellebrite PA/Encase/ETC to not be able to spread it out on your monitor.
And this may be stating the obvious, but office work space is important too!
3 Dedicated working stations - i7 + 16 GB of Ram + 128 GB SSD
…
AD FTK Enterprise
AD has published some fairly strong recommendations on how to build a system to run FTK well. You may want to compare your design with that.