Forensic workstation

Forensic workstation, part 1 – base unit

In 2011 as part of the AIMS Project I recycled an old PC into a forensic workstation and documented the process through four blogs. These are all still available online if you want to have a look – start with part 1.  

Now in 2020 as I build-up my freelance business I decided to create a forensic workstation so I have the capacity to support clients looking to extract files from a range of media. The scale and extent of born-digital archives can be on a  different scale than many people are used to. Instead of talking about boxes or linear metres accessions might be measured in terms of number of files 10,000+ is not untypical with extent in GB or TB. We must also remember that we have new tools and new opportunities to undertake the routine processing tasks but also to gain new insights and perspectives into the material in our care. 

Options

You can purchase a system designed for this specific task but the FRED (Forensic Recovery Evidence Device) machines start at £5000. Assuming you don’t have this sum to invest you can build your own forensic workstation to provide similar functionality for a fraction of the cost. I will share the steps (and the costs) I take to create a forensic workstation, future blogs will look in turn at specific digital preservation hardware like write-blockers and software including Archivematica and BitCurator

I have an expectation of needing to handle a range of media including 3.5″ floppy disks, CD and DVDs and hard drives from computers and laptops. I recognise that I may need to identify solutions for other media formats (zip drives, Amstrad disks etc) as and when the need arises.

Specification 

I spent several days on eBay looking for a machine, I initially looked at Windows 98 machines with floppy disk, CD/DVD drive and USB ports. Whilst these are available for a very modest sum it quickly became apparent that I’d need to open the box to upgrade the memory and hard drive so instead I set a budget of £250 to get the best specification I could. 

I deliberately sought a known manufacturer for the base unit as this would make it easier to find documentation online and improves the chances of getting spare parts further down the line. I contacted a few sellers and asked them about upgrade options knowing they would have a wide pool of components to hand. In the end the specification for the machine I selected was:

  • Refurbished HP 280 G1 mini tower
  • motherboard with 4th generation i5 chip and 16GB RAM (it originally came with 4GB RAM)
  • 240GB solid state drive for the operating system (Windows 10)
  • 500GB hard disk drive for storage
  • Video card
  • USB wireless adaptor
  • Refurbished 17” Dell monitor, keyboard and mouse

This cost £230 so I returned to eBay for a couple of additional purchases including an internal 3.5” floppy disk drive (£1.40 plus postage), and two SATA drives 500GB 2.5” (£6.60) and 160GB 3.5” (£8) for testing purposes. 

I had to re-organise my desk of course to make space for the new box, monitor and keyboard and extra power sockets!

My new forensic workstation installed on my desk with a few multi-card readers, internal hard drive and both internal and USB 3.5″ floppy drives. 

Leave a Reply

Your email address will not be published. Required fields are marked *