Digital forensics lab

From ForensicsWiki
Revision as of 23:39, 8 December 2013 by Simsong (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

For an instructional lab

Goals of the Lab

  • Teach basic forensic practices
  • Acquaint with procedures


  • High performance workstation with:
    • At least 16GiB of RAM.
    • At least 3TB of local storage, ideally >8TB.
  • SATA docks to allow SATA drives to be plugged and unplugged. Ideally connect the docks with USB3 or eSATA. Be sure you have docks that can handle hard drives > 2TB.

Open Source Software

  • SleuthKit

Commercial Software

In general we do not recommend commercial software for instructional purposes, but if you need it, here's stuff to buy:

For a research lab

Goals of the Lab

  • Insight on how to conduct research