What is a Forensic Network?
A Forensic Network is a series of processing and imaging computers connected and integrated directly with a high-speed, high-capacity server to share resources. The file server operates as the backbone of the Forensic Network and is used as a central storage
facility for Forensic Images as well as applications software
for use by the client processing and imaging stations. Workstation
clients on the network perform the actual imaging and processing
tasks, while the central file server stores the images and case
work. High speed scanners and color printers can also be made
available as shared resources on the network. Multiple forensic
clients can access case and image files simultaneously without
duplicating information on several workstations. File and image
storage space is centralized at the file server reducing the
localized storage requirements at the workstation clients.
Forensic networks are typically physically isolated from other networks (including the Internet) due to the sensitive nature of the data being stored. This means that the forensic network must also have its own network services such as DNS, DHCP, and user account management. Lastly, there must be support for the long-term archival of evidence utilizing removable media - typically tape backups.
How Can a Forensic Network be Used?
The client workstations in a forensic network
are used for the actual acquisition of forensic images. However,
rather than storing those images locally on each client, the images
are recorded directly to the high-capacity fault-tolerant storage array on the
file server over the network. These workstations can be pre-configured
to access the network directly from DOS or Windows operating
environments. Only a minimum of local storage is required on each
client processing station for the operating system(s) and temporary work space.
In fact, CD and network PXE boot disk images are provided
such that each station can be brought completely onto the network
requiring absolutely no hard drive facilities at all!
The forensic file server
maintains a high capacity RAID6 storage array.
Each RAID module hs two redundant power supplies as a dedicated
power source for the RAID array itself. This online storage is used
for maintaining forensic images as well as application and forensic
software and utilities. The file server is also configured with
a Robotic Tape Library for system backups and offline storage of case
information and images once online access to the information is
no longer required. This file server comes pre-configured and installed
with a highly optimized SUSE Linux Enterprise Server. Microsoft Certified
(MCSE, MCPS) and Novell Certified (CNA, CNE) personnel on our staff
ensure that these network operating systems are properly configured
and installed prior to delivery.
Once the forensic images are recorded directly on file server
storage space, any forensic client workstation on the network can
be used to process the information. Images can be restored directly
from the network to work drives on each client or processed in place
on the file server. Multiple clients can be used to process a single
image simultaneously from the network without requiring local storage
at the workstations. One or more shared printers may be installed
on the network in order to provide print services to all the client
The file server can also be used to store "functional" images
of operating environments for testing and analysis. Symantec
Ghost images can be pre-configured and stored on the file server
restored to any of the network clients as needed. Want
to see how a particular piece of software behaves in Windows? Deployment of pre-configured functional
images can be a tremendous time saver when needed to research
or test the behavior
of multiple operating systems!
The forensic file server not only serves as a centralized facility
for the storage of forensic images, case information, and functional
images, but also a resource for the production and printing of reports
and other day-to-day operational requirements. Furthermore, this
centralized resource can also be used to allow or deny access to
any of the forensic images or information on the laboratory network
as your organization's requirements dictate.
Why a Forensic Network?
Faster Than a Local Hard Drive
Image a hard drive directly to a Forensic File Server 25% faster than you can image to a local mechanical hard drive... DIRECTLY to the server over standard Copper Gigabit Ethernet. There's no need to image to your workstation and then copy it up to a slow server.
Significantly Faster Than a Windows Server
A Forensically Optimized Network Operating System is 30% faster than Windows Server running on the same hardware!
17.1 GB/Minute Imaging Speeds From Four Workstations Simultaneously
Real-world forensic benchmark utilizing Tableau Imager (TIM) to image drives connected to the UltraBay 4 on our FRED Workstations.
Keep Your Existing Clients
Use the same Operating Systems on your desktop as always. Our Forensic Network Operating System integrates seamlessly with your existing clients - no additional client software is required.
Centralized File Storage
Consolidate your storage investment. No need to buy lots of standalone hard drives to pass around your lab. No wondering where that case data is. Stop wasting money on individual hard drives or portable RAID arrays.
Centralized Access Control/Security
Decide who has access to what evidence from a single vantage point. Determine which investigators have access to which cases.
Centralized File Sharing
Allow multiple investigators to work on a single case using a single set of Data Files.
Centralized Data Backup
Backup and Restore data from a single vantage point into a single offline repository using a 16 tape LTO-6 robotic tape library. Maintain your data in two separate locations at all times (online and offline).
0 to 60 in Two Days
FREDC equipment is typically installed in 2 days. Equipment assembly and configuration on Day 1, and your orientation/training on Day 2. Take your lab from an outdated workstation centric environment to a fully optimized forensic network in 2 days. (Your MIS / IT guys have been relying on networks since the late 80's - now its your turn to blow them away.)
It's a complete network in a rack including all TCP/IP services (DNS / DHCP). Just connect your workstations with Cat 5e Gigabit or Cat6a 10 Gigabit Ethernet and you're ready to go! We establish a proven storage architecture that makes your access control simple and your backup activities manageable. We even set up your backup jobs and establish your automatic drive mappings for you. Instead of imaging to a local hard drive (i.e. "D:") you simply use your network drive letters instead (i.e. "R:").
Easy to Maintain
We provide approximately a full day of orientation/training for the person(s) who will be managing the server. Since our server runs like an appliance (no blue screens, no weekly patches), the routine tasks are minimal. Adding/Removing Investigator accounts, performing Backups, and modifying access control (if required) are essentially all that needs to be done.
Easy to Use
What Options Should
be Considered When Designing a Forensic Network:
The only thing your investigators (users) will notice is new (network) drive letters. Everything else stays the same!
- How much online RAID6
storage do you require?
- How many Forensic Clients would you like in your
- Would you like a Shared
- Digital Intelligence installs
the Network at your facility.
- Digital Intelligence configures your network to meet your security, administration, or
- Digital Intelligence provides training on the day-to-day use and
administration of your Forensic Network.
- Digital Intelligence provides support to assist in the
day-to-day administration and use of your Forensic Network.
FREE ONSITE TRAINING WITH A FREDC SYSTEM PURCHASE!
DON'T ACCEPT LESS-CAPABLE IMITATIONS OR KNOCK-OFFS!
Do the Research: Examine our system specifications, ask existing customers about our products and support. You'll understand why our FRED Systems are continually recognized as the best designed, most capable, completely supported Forensic Workstations in the world! (even by those who try to copy our products)
You know the name - now get your own! Only at Digital Intelligence!