Computer Forensics Lab Management

Computer Forensics Lab

• This is where investigations are conducted, evidence is stored, and equipment is housed.
• The American Society of Crime Laboratory Directors (ASCLD) provides guidelines for managing, certifying, and auditing forensics labs.

Lab Manager Duties

• Setting up case management processes
• Promoting group consensus in decision making
• Maintaining fiscal responsibility
• Enforcing ethical standards
• Planning lab updates
• Establishing quality-assurance processes
• Setting production schedules
• Estimating caseloads and timelines for preliminary/final results
• Creating/monitoring lab policies
• Providing a safe and secure work environment

Staff Member Duties

• Having knowledge and training in hardware, software, operating systems, file types, technical skills, investigative skills and deductive reasoning
• Regularly reviewing work

Lab Budget Planning

• Costs should be broken down into daily, quarterly, and annual expenses.
• Past expenses should be used to predict future costs.
• Expenses include hardware, software, facility space, and trained personnel
• The Uniform Crime Report provides crime statistics.
• For a private lab, check hardware/software inventory, past problems, and future tech developments.
• Time management is a major issue when choosing software and hardware to purchase.

Acquiring Certification and Training

• Update skills through training.
• The International Association of Computer Investigative Specialists (IACIS) was created by police officers
  • IACIS offers the Certified Electronic Evidence Collection Specialist (CEECS) and Certified Forensic Computer Examiners (CFCEs) certifications
• The High-Tech Crime Network (HTCN) offers certifications for Computer Crime Investigator and Computer Forensic Technician at basic and advanced levels.
• Other certifications include EnCase Certified Examiner (EnCE) and AccessData Certified Examiner (ACE).
• The High Technology Crime Investigation Association (HTCIA) is another training resource.
• Other training and certifications can be obtained from:
  • SysAdmin, Audit, Network, Security (SANS) Institute
  • Computer Technology Investigators Network (CTIN)
  • NewTechnologies, Inc. (NTI)
  • Southeast Cybercrime Institute at Kennesaw State University
  • Federal Law Enforcement Training Center (FLETC)
  • National White Collar Crime Center (NW3C)

Physical Requirements for a Computer Forensics Lab

• The lab should be secure to prevent lost, corrupted, or destroyed evidence.
• It should provide a safe physical environment
• Inventory control of assets is a must.

Lab Security Needs

• A secure facility preserves the integrity of evidence.
• Minimum requirements include a small room with floor-to-ceiling walls, a locking door, a secure container, and a visitor's log.
• People working together should have the same access level.
• Staff should be briefed on the security policy.

High-Risk Investigations

• If conducting such investigations, more security than the minimum lab requirements is needed.
• Tempest Facilities are one type of added security and are EMR proofed
• Low-emanation workstations can be used to circumnavigate the high costs of Tempest facilities

Evidence Containers

• These must be secure to prevent unauthorized access, located in restricted areas, and only accessible by authorized personnel
• Records must be kept of authorized personnel
• They should remain locked when not in use
• If using a combination lock:
  • Provide the same level of security for the combination
  • Destroy previous combinations
  • Only authorized personnel may change the combination
  • Change the combination every six months or when required
• If using a keyed padlock:
  • Appoint a key custodian
  • Stamp sequential numbers on each key
  • Maintain a key registry
  • Conduct a monthly audit and inventory of keys
  • Place keys in a lockable container
  • Maintain the same level of security for keys as for evidence containers
  • Change locks and keys annually
• The container should be steel with an internal cabinet or external padlock.
• Acquire a media safe and build an evidence storage room if possible.
• An evidence log should be kept and updated whenever containers are opened or closed.

Facility Maintenance

• Physical damages should be immediately repaired.
• Cleaning crews should be escorted.
• Minimize static electricity with antistatic pads and cleaning.
• Maintain separate trash containers for unrelated and sensitive materials.
• Hire specialized companies for disposing of sensitive materials when possible.

Physical Security Needs

• Create a security policy and enforce it
• A sign-in log for visitors is required, and all visitors should be escorted.
• Use visible or audible indicators for visitors.
• Install an intrusion alarm system and hire a guard force if needed.

Auditing

• Auditing ensures proper enforcing of policies.
• Audits should include checking the ceiling, floor, roof, walls, doors, locks, visitor logs, and evidence container logs.
• At the end of each workday, secure evidence not being processed.

Workstations

• Selection depends on budget and needs.
• Less powerful workstations can be used for mundane tasks.
• Multipurpose workstations are for high-end analysis.
• Police labs have the most diverse needs.
  • One computer investigator for every 250,000 people in a region.
  • One multipurpose forensic workstation and one general-purpose workstation.
• It is easier to determine private and corporate lab requirements.

Hardware Peripherals

• IDE cables
• Ribbon cables for floppy disks
• SCSI cards (ultra-wide preferred)
• Graphics cards (PCI and AGP)
• Power cords
• Hard disk drives
• At least two 2.5-inch Notebook IDE hard drives to standard IDE/ATA or SATA adapter
• Computer hand tools

Software Inventories

• Maintain licensed copies of software such as Microsoft Office, Quicken, programming languages, specialized viewers, Corel Office Suite, StarOffice/OpenOffice, and Peachtree.

Disaster Recovery Plan

• This should restore the workstation and investigation files to the state they were in before virus contamination and reconfigurations
• Includes backup tools for single disks and RAID servers
• Configuration management should keep track of software updates

Equipment Upgrades

• Risk management determines acceptable risk levels in processes.
• Identify equipment your lab depends on for periodic replacement as well as equipment that can be replaced when it fails
• Computing components last 18-36 months under normal conditions, schedule upgrades preferably every 12 months and at least every 18 months

Laptop Forensic Workstations

• They can be lightweight and mobile, but are still limited as forensic workstations despite improvements
• Laptop workstations should have a FireWire port, USB 2.0 port, and PCMCIA SATA hard disk.

Building a Business Case

• A business case is used to sell services to management/clients
• Labs help save money and increase profits by protecting trade secrets and business plans
• Follow these steps in preparing a case:
  • Justification
  • Budget development (facility, hardware, software, miscellaneous)
  • Approval and acquisition
  • Implementation (acceptance testing, correction for acceptance, production)