Table of Contents for

System Forensics, Investigation, and Response, 3rd Edition

First and foremost, you must have adequate equipment for the job. Among other things, this means adequate storage for the data. Remember, you might analyze a system, but it could be months before the case goes to trial. A server with the most storage you can afford is in order. And that server must have redundancy. It should have a bare minimum of RAID 1 (disk mirroring), but RAID 5 is recommended. And it should be backed up at least once per day. It is likely you will need multiple servers to accommodate your storage needs.

You also need a variety of computers capable of attaching various types of drives—for example, external universal serial bus (USB), internal Small Computer System Interface (SCSI), Enhanced Integrated Drive Electronics (EIDE), and Serial Advanced Technology Attachment (SATA) drives. The exact number depends on the workload expected for the lab. You should also have power connectors for all types of smartphones, laptops, routers, and other devices.

Security is paramount for forensics. First and foremost, the machines being examined should not be connected to the Internet. You can have a lab network that is not attached to the Internet and is separate from your working network where you check email and use the Internet. It is also important to have the lab in a room that is shielded from any electromagnetic interference. This means that cellular and wireless signals cannot penetrate the room housing the lab.

After you have established network and electronic security, physical security is the next concern. It is imperative to limit access to the lab. Allow only people with a legitimate need to enter the lab. It is recommended that the lab entrance have some sort of electronic method of recording who enters and when they enter. Swipe-card access is ideal for this. Furthermore, the room itself should be difficult to forcibly access. That means the windows and doors are very secure and would be extremely difficult to force open.

The lab also requires the means to secure evidence when it is not being used. An evidence safe is the best way to do this. The safe should be highly fire resistant, so that in case of fire the evidence is preserved.

In addition to the general guidelines already listed, you should consider various standards that exist.

The American Society of Crime Laboratory Directors (ASCLD) provides guidelines for managing a forensic lab. It also provides guidelines for acquiring crime lab and forensic lab certification. The ASCLD offers voluntary accreditation to public and private crime laboratories in the United States and around the world. It certifies computer forensics labs that analyze digital evidence and other criminal evidence, such as fingerprints and DNA samples. The ASCLD/LAB certification regulates how to organize and manage crime labs. Achieving ASCLD accreditation is a rigorous process. A lab must meet about 400 criteria to achieve accreditation. Typically, an unaccredited lab needs two to three years to prepare for accreditation. It spends this time developing policies, procedures, document controls, analysis validations, and so on. Then, the lab needs another year to go through the process. The lab manager submits an application. The lead assessor and a team spend one to two months reviewing the application and the policies and procedures to make sure the lab is ready. The assessment takes about a week. The assessment team generates findings that require corrective action. The lab typically requires several months to make corrections to the satisfaction of the lead assessor. Once the facility has made all corrections, the lead assessor recommends the lab to the board of directors for accreditation. Finally, the ASCLD/LAB board of directors votes on whether to accredit the lab.

The ASCLD/LAB program includes audits to ensure that forensic specialists are performing lab procedures correctly and consistently for all casework. The society performs these audits in computer forensics labs to maintain quality and integrity. One recommendation for labs is to follow the DoD guidelines on electromagnetic radiation (EMR). The U.S. Department of Defense shields computers from EMR detection under its TEMPEST program. You can find out more about TEMPEST at http://www.gao.gov/products/NSIAD-86-132.

Shielding all computers would be impossible because of the high cost involved. To protect high-risk investigations, however, a lab might consider implementing TEMPEST protection. TEMPEST certifies equipment that is built with shielding that prevents EMR. In some cases, TEMPEST can be applied to an entire lab. Shielding a lab is an extremely high-cost approach that includes the following measures:

• Lining the walls, ceiling, floor, and doors with specially grounded conductive metal sheets

• Installing filters that prevent power cables from transmitting computer emanations

• Installing special baffles in heating and ventilation ducts to trap emanations

• Installing line filters on telephone lines

• Installing special features at entrances and exits that prevent the facility from being open to the outside at any time

Creating and maintaining a TEMPEST-certified lab is expensive. Such a lab must be inspected and tested regularly. Only large regional computer forensics labs that demand absolute security from eavesdropping should consider complete TEMPEST protection. For smaller facilities, use of TEMPEST-certified equipment is often a more effective approach.