Computer Forensics
Computer Forensics HardwareComputer Forensics SoftwareComputer Forensics TrainingComputer Forensics ServicesPurchase Forensic Computer ProductsTechnical SupportResellersCompany Information
DI Advanced Search


17165 W. Glendale Drive
New Berlin, WI 53151
866-DIGINTEL (866-344-4683)
Outside the US: 262-782-3332

Site Contents Copyright © 2018


Forensic Network

What is a Forensic Network?

A Forensic Network is a series of processing and imaging computers connected and integrated directly with a high-speed, high-capacity server to share resources. The file server operates as the backbone of the Forensic Network and is used as a central storage facility for Forensic Images as well as applications software for use by the client processing and imaging stations. Workstation clients on the network perform the actual imaging and processing tasks, while the central file server stores the images and case work. High speed scanners and color printers can also be made available as shared resources on the network. Multiple forensic clients can access case and image files simultaneously without duplicating information on several workstations. File and image storage space is centralized at the file server reducing the localized storage requirements at the workstation clients.

Forensic networks are typically physically isolated from other networks (including the Internet) due to the sensitive nature of the data being stored. This means that the forensic network must also have its own network services such as DNS, DHCP, and user account management. Lastly, there must be support for the long-term archival of evidence utilizing removable media - typically tape backups.

How Can a Forensic Network be Used?

The client workstations in a forensic network are used for the actual acquisition of forensic images. However, rather than storing those images locally on each client, the images are recorded directly to the high-capacity fault-tolerant storage array on the file server over the network. These workstations can be pre-configured to access the network directly from DOS or Windows operating environments. Only a minimum of local storage is required on each client processing station for the operating system(s) and temporary work space. In fact, CD and network PXE boot disk images are provided such that each station can be brought completely onto the network requiring absolutely no hard drive facilities at all!

The forensic file server maintains a high capacity RAID6 storage array. Each RAID module hs two redundant power supplies as a dedicated power source for the RAID array itself. This online storage is used for maintaining forensic images as well as application and forensic software and utilities. The file server is also configured with a Robotic Tape Library for system backups and offline storage of case information and images once online access to the information is no longer required. This file server comes pre-configured and installed with a highly optimized SUSE Linux Enterprise Server. Microsoft Certified (MCSE, MCPS) and Novell Certified (CNA, CNE) personnel on our staff ensure that these network operating systems are properly configured and installed prior to delivery.

Once the forensic images are recorded directly on file server storage space, any forensic client workstation on the network can be used to process the information. Images can be restored directly from the network to work drives on each client or processed in place on the file server. Multiple clients can be used to process a single image simultaneously from the network without requiring local storage at the workstations. One or more shared printers may be installed on the network in order to provide print services to all the client workstations.

The file server can also be used to store "functional" images of operating environments for testing and analysis. Symantec Ghost images can be pre-configured and stored on the file server and then restored to any of the network clients as needed. Want to see how a particular piece of software behaves in Windows? Deployment of pre-configured functional images can be a tremendous time saver when needed to research or test the behavior of multiple operating systems!

The forensic file server not only serves as a centralized facility for the storage of forensic images, case information, and functional images, but also a resource for the production and printing of reports and other day-to-day operational requirements. Furthermore, this centralized resource can also be used to allow or deny access to any of the forensic images or information on the laboratory network as your organization's requirements dictate.

Why a Forensic Network?

Faster Than a Local Hard Drive
Image a hard drive directly to a Forensic File Server 25% faster than you can image to a local mechanical hard drive... DIRECTLY to the server over standard Copper Gigabit Ethernet. There's no need to image to your workstation and then copy it up to a slow server.

Significantly Faster Than a Windows Server
A Forensically Optimized Network Operating System is 30% faster than Windows Server running on the same hardware!

17.1 GB/Minute Imaging Speeds From Four Workstations Simultaneously
Real-world forensic benchmark utilizing Tableau Imager (TIM) to image drives connected to the UltraBay 4 on our FRED Workstations.

Keep Your Existing Clients
Use the same Operating Systems on your desktop as always. Our Forensic Network Operating System integrates seamlessly with your existing clients - no additional client software is required.

Centralized File Storage
Consolidate your storage investment. No need to buy lots of standalone hard drives to pass around your lab. No wondering where that case data is. Stop wasting money on individual hard drives or portable RAID arrays.

Centralized Access Control/Security
Decide who has access to what evidence from a single vantage point. Determine which investigators have access to which cases.

Centralized File Sharing
Allow multiple investigators to work on a single case using a single set of Data Files.

Centralized Data Backup
Backup and Restore data from a single vantage point into a single offline repository using a 16 tape LTO-6 robotic tape library. Maintain your data in two separate locations at all times (online and offline).

0 to 60 in Two Days
FREDC equipment is typically installed in 2 days. Equipment assembly and configuration on Day 1, and your orientation/training on Day 2. Take your lab from an outdated workstation centric environment to a fully optimized forensic network in 2 days. (Your MIS / IT guys have been relying on networks since the late 80's - now its your turn to blow them away.)

Completely Configured
It's a complete network in a rack including all TCP/IP services (DNS / DHCP). Just connect your workstations with Cat 5e Gigabit or Cat6a 10 Gigabit Ethernet and you're ready to go! We establish a proven storage architecture that makes your access control simple and your backup activities manageable. We even set up your backup jobs and establish your automatic drive mappings for you. Instead of imaging to a local hard drive (i.e. "D:") you simply use your network drive letters instead (i.e. "R:").

Easy to Maintain
We provide approximately a full day of orientation/training for the person(s) who will be managing the server. Since our server runs like an appliance (no blue screens, no weekly patches), the routine tasks are minimal. Adding/Removing Investigator accounts, performing Backups, and modifying access control (if required) are essentially all that needs to be done.

Easy to Use
The only thing your investigators (users) will notice is new (network) drive letters. Everything else stays the same!

What Options Should be Considered When Designing a Forensic Network:  
  • How much online RAID6 storage do you require?
  • How many Forensic Clients would you like in your network?
  • Would you like a Shared Network Printer?
  • Digital Intelligence installs the Network at your facility.
  • Digital Intelligence configures your network to meet your security, administration, or functional requirements.
  • Digital Intelligence provides training on the day-to-day use and administration of your Forensic Network.
  • Digital Intelligence provides support to assist in the day-to-day administration and use of your Forensic Network.

FREDC - The Forensic Network Solution
FREDC is our Forensic Recovery of Evidence Data Center. FREDC provides fully integrated processing power and flexibility far beyond any forensic solution available.



Do the Research:  Examine our system specifications, ask existing customers about our products and support.  You'll understand why our FRED Systems are continually recognized as the best designed, most capable, completely supported Forensic Workstations in the world! (even by those who try to copy our products)  


You know the name - now get your own!  Only at Digital Intelligence!