Forensic workstation pt 2 – additional hardware

Forensic workstation, part 2 – additional hardware

Last week in part 1 – base station I started documenting the steps (and costs) in creating a forensic workstation for working with born-digtial archives. Following a few additional purchases from eBay and Amazon I have extended the hardware capacity significantly;

Adapter with SATA (left) & IDE (right) drives

Hard drives

I purchased a couple of refurbished drives to use for testing purposes;

  • Seagate 160GB IDE drive (£4.55 plus postage) 
  • Western Digtial 160GB 3.5″ SATA drive (£8.00)
  • Hitachi 500GB 2.5″ SATA drive (£6.60)

This means I can test reading drives that might be removed from computers and laptops. The first thing I did on receipt of the drive was to use a hard drive adapter (£26) to do a full format of the drive using the disk management tools built into Windows 10. This gave me a clean slate to start with and avoided the risk of data contamination or virus from the old drive. Note the adapter is fine to quickly check if a drive might have content on it, but it is not part of the processing workflow – this will utilise forensic write blockers to avoid updating the content. 

USB Zip250 drive in its stand

Iomega Zip250 drive

One format I had used personally and thought reasonable to encounter was the Iomega zip disk. I secured a Zip250 USB drive with the original installation and user guide on 2 CDs, most of the appropriate cables and 8 disks (£27).

Having installed the software onto the workstation and raided my cable drawer to plug the gaps I was able to get the drive up and working and successfully reformatted both PC and Mac disks. I left a couple of the Mac formatted disks for a future data recovery and extraction test!

3.5″ floppy disk

Three 3.5″ floppy drives (USB on top)

From my own experiences I know we can still expect to receive 3.5″ floppy disks in the archives given that it is estimated that 2 billion were produced in 1998 shortly before writable CDs and USB drives emerged. I purchased three floppy disk drives including two internal drives. Floppy disk drives of course are digital preservation friendly… just flick the tab on the disk to reveal the hole to enable write protection!

Why buy two drives (£1.40 and £5.99) that have been extracted from old PCs aswell as a new USB version? Experience has shown that the internal drives were built for heavy daily use and as such are far more robust than the USB floppy drive (£18) versions which are more designed for occasional use. !

Costs (so far)

  1. base unit, including monitor, keyboard and mouse £230
  2. three hard drives for testing £19 [optional]
  3. USB hard drive adapter £26 [optional]
  4. USB Zip250 drive including some PC and Mac disks £27 [optional]
  5. three 3.5″ floppy disk drives £26 [optional]

The total spent so far is about £350 (including postage etc) but I have a forensic workstation and added the capacity to read floppy disks and zip drives. Next week I will take a look at software (I will return for more detailed look at some titles) and then the final piece in the jigsaw that of write blockers.

Leave a Reply

Your email address will not be published. Required fields are marked *