<\/p>\n
<\/span>A FORENSIC WORKSTATION<\/span><\/h2>\nChoosing a workstation configuration is an important step. The effectiveness of digital examiners depends on the way the workstation is configured.<\/p>\n
However, we want to pay special attention to one point: the workstation should work as quietly as possible. Imagine an open space where several powerful computers are installed, each of which makes a noise like a server. The employees\u2019 headache and poor health are guaranteed. Silent workstation performance is achieved by using low-noise fans and passive cooling systems.<\/p>\n
Do not use top hardware. The idea to buy the most expensive processor, memory, motherboard for your new workstation is not the best one. We had many problems with the workstation in which similar components were used.<\/p>\n
In our opinion, this configuration is optimal today:<\/p>\n
OS: Windows 10 Pro 64-bit<\/p>\n
CPU (2):\u00a0 E5-2660 v4 (14 core)<\/p>\n
RAM: 64 GB DDR-42133 ECC<\/p>\n
OS Drive: 1 TB SSD<\/p>\n
Temp\/Cache\/DB Drive: 256 GB SSD<\/p>\n
Data Drive: 8 TB 7200rpm<\/p>\n
RAID Drives: 5×4 TB 7200rpm<\/p>\n
Video Card: GeForce GTX 1080<\/p>\n
We recommend to use two or more monitors for each workstation.<\/p>\n
The most effective work is achieved when a digital examiner uses two workstations in its work.<\/p>\n
Use NET Storages to store cases, forensic images, etc. NET Storages with a volume of 100-150 TB proved to be quite effective.<\/p>\n
Use 10Gbit Net Cards. They will allow you to transfer data from the workstation to NET Storages quickly.<\/p>\n
<\/p>\n
![\"\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/004.png\")
<\/p>\n
A Tableau Write Blockers Kit<\/p>\n
<\/p>\n
<\/span>FORENSIC SOFTWARE<\/span><\/h2>\nIt’s a good idea to have as more different forensic software in the digital laboratory. This will allow a forensic examiner to make cases as quickly and efficiently as possible. Also, this makes it possible to recheck the results of the research effectively.<\/p>\n
However, if you have a limited budget, we recommend buying this software:<\/p>\n
Windows 10 Pro<\/p>\n
Office 365<\/p>\n
Antivirus software<\/p>\n
X-ways Forensic<\/p>\n
AXIOM (Magnet Forensics)<\/p>\n
The rest of the tools can be purchased as the laboratory develops.<\/p>\n
Also, a lot of research can be done using freeware tools. Sometimes these tools outperform functionality of commercial tools.<\/p>\n
![\"\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/006-1.jpg\")
<\/p>\n
<\/p>\n
<\/span>CASE MANAGEMENT SOFTWARE<\/span><\/h2>\nIf you create a digital forensic laboratory in a government organization, for example in the police department, then most likely they have their own case management software and then your task \u00a0is just to add a new laboratory to the network of existing ones.<\/p>\n
In other cases, you can use free and chargeable CRM systems. Besides, some CRM systems can be adapted to your management needs.<\/p>\n
We recommend Kirjuri (Kirjuri is a web application for managing cases and physical forensic evidence items.) and Lima Forensic Case Management of all the specialized tools.<\/p>\n
<\/p>\n
<\/span>VIDEO FORENSICS<\/span><\/h2>\nWe recommend using a separate workstation for the production of video forensics cases. We recommend using the following forensic tools:<\/p>\n
DVR Examiner<\/p>\n
Amped FIVE<\/p>\n
Elecard<\/p>\n
Very good results of recovering deleted videos can be obtained using X-ways Forensic. We have written about this tool above.<\/p>\n
<\/p>\n
<\/span>MOBILE FORENSICS<\/span><\/h2>\n <\/p>\n
We recommend using a separate workstation to carry out mobile forensics research.<\/p>\n
There are a lot of tools for mobile forensics. That is why it is difficult for a beginner to understand what they need to carry out this research effectively. We recommend using the following mobile forensic tools:<\/p>\n
UFED 4PC (with CHINEX, UFED Camera Kit)<\/p>\n
![\"\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/005.png\")
<\/p>\n
Cellebrute UFED Touch<\/p>\n
![\"\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/003.png\")
<\/p>\n
Cellebryte cables and adapters<\/p>\n
Oxygen Forensics DETECTIVE<\/p>\n
XRY<\/p>\n
Elcomsoft Mobile Forensic Bundle<\/p>\n
We recommend using S\u0420 Flash tool to retrieve data from MTK based phones.<\/p>\n
![\"\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2018\/04\/002.png\")
<\/p>\n
A Faraday Box (Ramsey)<\/p>\n
<\/p>\n
<\/span>CLOUD FORENSICS<\/span><\/h2>\nWe recommend using the following tools for Cloud forensics:<\/p>\n
UFED Cloud Analyzer<\/p>\n
Oxygen Forensics DETECTIVE<\/p>\n
Elcomsoft Cloud eXplorer<\/p>\n
<\/p>\n
<\/span>MOBILE DATA RECOVERY<\/span><\/h2>\nWe recommend using flashers for JTAG research:<\/p>\n
Easy Z3x JTAG BOX<\/p>\n
Octoplus Box<\/p>\n
Samsung anyway S101<\/p>\n
<\/p>\n
For Chip-off we recommend using:<\/p>\n
VISUAL NAND RECONSTRUCTOR (STARTER KIT, Rusolut)<\/p>\n
SMARTPHONE KIT (Rusolut)<\/p>\n
CHINESE SMARTPHONE KIT (Rusolut)<\/p>\n
NuProg-E UFS\/EMMC Programmer<\/p>\n
IN-UFS-Socket\u00a0 BGA\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Opentop<\/p>\n
N-UFS-065-BGA095-115130-02O BGA\u00a0\u00a0\u00a0 Opentop<\/p>\n
N-UFS-050-FBGA153-115130-02O BGA Opentop<\/p>\n
<\/p>\n
We recommend using Weller WHA 300 Hot Air Reworking Station or Ersa HR100 Hybrid Rework system for disordering chips.<\/p>\n
<\/p>\n
<\/span>DATA RECOVERY (HARD DRIVES, FLASH DRIVES, MEMORY CARDS)<\/span><\/h2>\n <\/p>\n
We recommend using a separate workstation for the production of Data recovery. You will need special hardware and tools for data recovery:<\/p>\n
PC-3000 Express Professional System\u00a0 (Acelab)<\/p>\n
Data Extractor Express (Acelab)<\/p>\n
PC-3000 Flash (Acelab)<\/p>\n
<\/p>\n
<\/span>FURNITURE<\/span><\/h2>\n <\/p>\n
Many people believe that it is enough to buy ordinary office desks and chairs to equip a digital forensic lab. However, it is not so. Tables must have abrasion resistant coatings. We recommend the use of special laboratory tables.<\/p>\n
Office chairs should be as convenient as possible. We recommend using not ordinary office chairs but gaming chairs.<\/p>\n
The table where the electronic equipment is assembled and disassembled should be equipped with an antistatic mat and an antistatic bracelet.<\/p>\n
<\/p>\n
<\/p>\n
Happy forensicating!<\/p>\n
<\/p>\nIt’s a good idea to have as more different forensic software in the digital laboratory. This will allow a forensic examiner to make cases as quickly and efficiently as possible. Also, this makes it possible to recheck the results of the research effectively.<\/p>\n
However, if you have a limited budget, we recommend buying this software:<\/p>\n
Windows 10 Pro<\/p>\n
Office 365<\/p>\n
Antivirus software<\/p>\n
X-ways Forensic<\/p>\n
AXIOM (Magnet Forensics)<\/p>\n
The rest of the tools can be purchased as the laboratory develops.<\/p>\n
Also, a lot of research can be done using freeware tools. Sometimes these tools outperform functionality of commercial tools.<\/p>\n
<\/p>\n
<\/p>\n
<\/span>CASE MANAGEMENT SOFTWARE<\/span><\/h2>\nIf you create a digital forensic laboratory in a government organization, for example in the police department, then most likely they have their own case management software and then your task \u00a0is just to add a new laboratory to the network of existing ones.<\/p>\n
In other cases, you can use free and chargeable CRM systems. Besides, some CRM systems can be adapted to your management needs.<\/p>\n
We recommend Kirjuri (Kirjuri is a web application for managing cases and physical forensic evidence items.) and Lima Forensic Case Management of all the specialized tools.<\/p>\n
<\/p>\n
<\/span>VIDEO FORENSICS<\/span><\/h2>\nWe recommend using a separate workstation for the production of video forensics cases. We recommend using the following forensic tools:<\/p>\n
DVR Examiner<\/p>\n
Amped FIVE<\/p>\n
Elecard<\/p>\n
Very good results of recovering deleted videos can be obtained using X-ways Forensic. We have written about this tool above.<\/p>\n
<\/p>\n
<\/span>MOBILE FORENSICS<\/span><\/h2>\n <\/p>\n
We recommend using a separate workstation to carry out mobile forensics research.<\/p>\n
There are a lot of tools for mobile forensics. That is why it is difficult for a beginner to understand what they need to carry out this research effectively. We recommend using the following mobile forensic tools:<\/p>\n
UFED 4PC (with CHINEX, UFED Camera Kit)<\/p>\n
<\/p>\n
Cellebrute UFED Touch<\/p>\n
<\/p>\n
Cellebryte cables and adapters<\/p>\n
Oxygen Forensics DETECTIVE<\/p>\n
XRY<\/p>\n
Elcomsoft Mobile Forensic Bundle<\/p>\n
We recommend using S\u0420 Flash tool to retrieve data from MTK based phones.<\/p>\n
<\/p>\n
A Faraday Box (Ramsey)<\/p>\n
<\/p>\n
<\/span>CLOUD FORENSICS<\/span><\/h2>\nWe recommend using the following tools for Cloud forensics:<\/p>\n
UFED Cloud Analyzer<\/p>\n
Oxygen Forensics DETECTIVE<\/p>\n
Elcomsoft Cloud eXplorer<\/p>\n
<\/p>\n
<\/span>MOBILE DATA RECOVERY<\/span><\/h2>\nWe recommend using flashers for JTAG research:<\/p>\n
Easy Z3x JTAG BOX<\/p>\n
Octoplus Box<\/p>\n
Samsung anyway S101<\/p>\n
<\/p>\n
For Chip-off we recommend using:<\/p>\n
VISUAL NAND RECONSTRUCTOR (STARTER KIT, Rusolut)<\/p>\n
SMARTPHONE KIT (Rusolut)<\/p>\n
CHINESE SMARTPHONE KIT (Rusolut)<\/p>\n
NuProg-E UFS\/EMMC Programmer<\/p>\n
IN-UFS-Socket\u00a0 BGA\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Opentop<\/p>\n
N-UFS-065-BGA095-115130-02O BGA\u00a0\u00a0\u00a0 Opentop<\/p>\n
N-UFS-050-FBGA153-115130-02O BGA Opentop<\/p>\n
<\/p>\n
We recommend using Weller WHA 300 Hot Air Reworking Station or Ersa HR100 Hybrid Rework system for disordering chips.<\/p>\n
<\/p>\n
<\/span>DATA RECOVERY (HARD DRIVES, FLASH DRIVES, MEMORY CARDS)<\/span><\/h2>\n <\/p>\n
We recommend using a separate workstation for the production of Data recovery. You will need special hardware and tools for data recovery:<\/p>\n
PC-3000 Express Professional System\u00a0 (Acelab)<\/p>\n
Data Extractor Express (Acelab)<\/p>\n
PC-3000 Flash (Acelab)<\/p>\n
<\/p>\n
<\/span>FURNITURE<\/span><\/h2>\n <\/p>\n
Many people believe that it is enough to buy ordinary office desks and chairs to equip a digital forensic lab. However, it is not so. Tables must have abrasion resistant coatings. We recommend the use of special laboratory tables.<\/p>\n
Office chairs should be as convenient as possible. We recommend using not ordinary office chairs but gaming chairs.<\/p>\n
The table where the electronic equipment is assembled and disassembled should be equipped with an antistatic mat and an antistatic bracelet.<\/p>\n
<\/p>\n
<\/p>\n
Happy forensicating!<\/p>\n
We recommend using a separate workstation for the production of video forensics cases. We recommend using the following forensic tools:<\/p>\n
DVR Examiner<\/p>\n
Amped FIVE<\/p>\n
Elecard<\/p>\n
Very good results of recovering deleted videos can be obtained using X-ways Forensic. We have written about this tool above.<\/p>\n
<\/p>\n
<\/span>MOBILE FORENSICS<\/span><\/h2>\n <\/p>\n
We recommend using a separate workstation to carry out mobile forensics research.<\/p>\n
There are a lot of tools for mobile forensics. That is why it is difficult for a beginner to understand what they need to carry out this research effectively. We recommend using the following mobile forensic tools:<\/p>\n
UFED 4PC (with CHINEX, UFED Camera Kit)<\/p>\n
<\/p>\n
Cellebrute UFED Touch<\/p>\n
<\/p>\n
Cellebryte cables and adapters<\/p>\n
Oxygen Forensics DETECTIVE<\/p>\n
XRY<\/p>\n
Elcomsoft Mobile Forensic Bundle<\/p>\n
We recommend using S\u0420 Flash tool to retrieve data from MTK based phones.<\/p>\n
<\/p>\n
A Faraday Box (Ramsey)<\/p>\n
<\/p>\n
<\/span>CLOUD FORENSICS<\/span><\/h2>\nWe recommend using the following tools for Cloud forensics:<\/p>\n
UFED Cloud Analyzer<\/p>\n
Oxygen Forensics DETECTIVE<\/p>\n
Elcomsoft Cloud eXplorer<\/p>\n
<\/p>\n
<\/span>MOBILE DATA RECOVERY<\/span><\/h2>\nWe recommend using flashers for JTAG research:<\/p>\n
Easy Z3x JTAG BOX<\/p>\n
Octoplus Box<\/p>\n
Samsung anyway S101<\/p>\n
<\/p>\n
For Chip-off we recommend using:<\/p>\n
VISUAL NAND RECONSTRUCTOR (STARTER KIT, Rusolut)<\/p>\n
SMARTPHONE KIT (Rusolut)<\/p>\n
CHINESE SMARTPHONE KIT (Rusolut)<\/p>\n
NuProg-E UFS\/EMMC Programmer<\/p>\n
IN-UFS-Socket\u00a0 BGA\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Opentop<\/p>\n
N-UFS-065-BGA095-115130-02O BGA\u00a0\u00a0\u00a0 Opentop<\/p>\n
N-UFS-050-FBGA153-115130-02O BGA Opentop<\/p>\n
<\/p>\n
We recommend using Weller WHA 300 Hot Air Reworking Station or Ersa HR100 Hybrid Rework system for disordering chips.<\/p>\n
<\/p>\n
<\/span>DATA RECOVERY (HARD DRIVES, FLASH DRIVES, MEMORY CARDS)<\/span><\/h2>\n <\/p>\n
We recommend using a separate workstation for the production of Data recovery. You will need special hardware and tools for data recovery:<\/p>\n
PC-3000 Express Professional System\u00a0 (Acelab)<\/p>\n
Data Extractor Express (Acelab)<\/p>\n
PC-3000 Flash (Acelab)<\/p>\n
<\/p>\n
<\/span>FURNITURE<\/span><\/h2>\n <\/p>\n
Many people believe that it is enough to buy ordinary office desks and chairs to equip a digital forensic lab. However, it is not so. Tables must have abrasion resistant coatings. We recommend the use of special laboratory tables.<\/p>\n
Office chairs should be as convenient as possible. We recommend using not ordinary office chairs but gaming chairs.<\/p>\n
The table where the electronic equipment is assembled and disassembled should be equipped with an antistatic mat and an antistatic bracelet.<\/p>\n
<\/p>\n
<\/p>\n
Happy forensicating!<\/p>\n
<\/p>\n<\/p>\n<\/p>\nWe recommend using the following tools for Cloud forensics:<\/p>\n
UFED Cloud Analyzer<\/p>\n
Oxygen Forensics DETECTIVE<\/p>\n
Elcomsoft Cloud eXplorer<\/p>\n
<\/p>\n
<\/span>MOBILE DATA RECOVERY<\/span><\/h2>\nWe recommend using flashers for JTAG research:<\/p>\n
Easy Z3x JTAG BOX<\/p>\n
Octoplus Box<\/p>\n
Samsung anyway S101<\/p>\n
<\/p>\n
For Chip-off we recommend using:<\/p>\n
VISUAL NAND RECONSTRUCTOR (STARTER KIT, Rusolut)<\/p>\n
SMARTPHONE KIT (Rusolut)<\/p>\n
CHINESE SMARTPHONE KIT (Rusolut)<\/p>\n
NuProg-E UFS\/EMMC Programmer<\/p>\n
IN-UFS-Socket\u00a0 BGA\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Opentop<\/p>\n
N-UFS-065-BGA095-115130-02O BGA\u00a0\u00a0\u00a0 Opentop<\/p>\n
N-UFS-050-FBGA153-115130-02O BGA Opentop<\/p>\n
<\/p>\n
We recommend using Weller WHA 300 Hot Air Reworking Station or Ersa HR100 Hybrid Rework system for disordering chips.<\/p>\n
<\/p>\n
<\/span>DATA RECOVERY (HARD DRIVES, FLASH DRIVES, MEMORY CARDS)<\/span><\/h2>\n <\/p>\n
We recommend using a separate workstation for the production of Data recovery. You will need special hardware and tools for data recovery:<\/p>\n
PC-3000 Express Professional System\u00a0 (Acelab)<\/p>\n
Data Extractor Express (Acelab)<\/p>\n
PC-3000 Flash (Acelab)<\/p>\n
<\/p>\n
<\/span>FURNITURE<\/span><\/h2>\n <\/p>\n
Many people believe that it is enough to buy ordinary office desks and chairs to equip a digital forensic lab. However, it is not so. Tables must have abrasion resistant coatings. We recommend the use of special laboratory tables.<\/p>\n
Office chairs should be as convenient as possible. We recommend using not ordinary office chairs but gaming chairs.<\/p>\n
The table where the electronic equipment is assembled and disassembled should be equipped with an antistatic mat and an antistatic bracelet.<\/p>\n
<\/p>\n
<\/p>\n
Happy forensicating!<\/p>\n
<\/p>\n
We recommend using a separate workstation for the production of Data recovery. You will need special hardware and tools for data recovery:<\/p>\n
PC-3000 Express Professional System\u00a0 (Acelab)<\/p>\n
Data Extractor Express (Acelab)<\/p>\n
PC-3000 Flash (Acelab)<\/p>\n
<\/p>\n