Forensic Network
Our plan is to have a forensic network separate from the agency's network. The forensic network should not have any connection to the Internet. This is to prevent any chance of outside access to the evidence. We have three forensic machines and one forensic server. The forensic server will be used to store the case files and images we acquire. It is still best to work on the images locally. Therefore, we would copy the images to our local machines, examine the data, and then upload the case files and report to the server. This has many advantages. First, instead of storing different cases on each forensic machine, we have one centralized location. This allows each machine to have access to all cases from the server. Second, we can archive each case more easily. The standard cables we use are cat5e. For faster access, we may switch to fiber optic, but this is more expensive.
We want to make the lab more efficient for investigators and let them focus only on examinations. They do not need to worry about running out of space or backing up the evidence. The agency's IT staff or forensic technicians can take care of this. If the forensic server is located in the data center, it can be maintained accordingly.
For convenience, it would be nice to have a machine with internet connection next to the forensic machines so that the investigator can use the Internet for reference, get software updates (and transfer it to a forensic machine to install), look for assistance on forums, and check emails.
One more thing I like to do is to remote into the other forensic machines from my forensic machine, and do work on each one from one location. Then I can easily check up on each, without having to get up and look at each screen.
Post a Comment