Your preferred laptop for forensics use?
I've always been curious as to what the community here uses as a mobile forensics platform. Do you prefer something more thin and mobile? Or bulky and fast? How often would you need to rely on the laptop instead of having the desktop lab available? ECC Ram or the traditional route to help prevent data loss? The only one I've seen so far is a forensics consultant with a T430s work issued.
Let me know what you guys use, many thanks!
Used to use an Apple Macbook Pro. There was a time where those laptops were well equipped with many ports and the possibility triaging Mac OS X computer natively was a definite advantage.
Now, Macbook Pros suck for computer forensic work (IMHO). They only have Thunderbolt and USB ports on board, everything else has to be plugged in. They have no optical media reader, eSata, firewire, Gigabit Ethernet built-in. They don't have ExpressCard solts anymore. You can't upgrade RAM anymore and current model ship with a max of 16 GB. Apple is also often behind other manufacturers in the chipset they are using.
The laptop I'm currently using is a Lenovo Thinkpad W540. It's great. Does not come with too many "crapware" compared to other manufacturers. Can ship with up to 32 GB of RAM, lots of ports, ExpressCard slot for added connectivity, lots of storage options. The only thing I don't like is the trackpad, but using a mouse solves this problem…
I think the W540 is discontinued and has been replaced with the W541.
Do you find the W540 to be heavy for you? It sounds wonderful so far from your description.
We are working with Thinkpads T61p and are more than content with them! It was the predecessor of the W500-Series, which PM_SQ metioned.
If I had to replace it by today I would for shure go with the W541! It comes with a 3K Screen which can be pretty useful while working with forensic tools. You can choose to instert a second harddrive instead of the optical drive and you even have a free M.2-slot if you do not need a LTE/HSDPA-Modem. Thunderbolt and USB3 is built-in, every other connections can be realised through ExpressCards. And it even has a redesigned TrackPad with dedicated TrackPoint-buttons.
Sounds like 15 inch thinkpads are the forensic standards so far? I guess I'll be investing into a used Wxxx series to be like you guys, are DVD drives outphased even on the field now?
are DVD drives outphased even on the field now?
I think it depends on the kind of cases you have to deal with. If you deal more with incident response, there might be less chances you encounter DVDs in the field. But if you deal with child porn cases, a DVD drive is still a must have.
Personally, I like to be prepared for (almost) anything when I go in the field. So I'm not ready to let go of my DVD drive yet.
sager laptops from xoticpc.com
JFYI a past discussion on the same topic
In a perfect world, there would probably be something *like* a Novena;
for digital forensics use.
MacBook Pro still. Yes there are more powerful Wintel machines out there with more ports but as long as you have USB3 you can cope with most things. Add in a TB port and you can attach more things although other interfaces are rarely needed as write blockers connect via USB3 and they cope with the connectivity of the drive. Plus all the phone leads connect via USB anyway. We find that having MacOS as an option is a bigger boon than more ports or more than 16GB RAM.