How to build your own digital forensics lab, cheap

Step-by-step instructions for downloading and using free or inexpensive digital forensics tools.

For the read/write blocking device you have two options: buy or build.

If you choose to buy, there are a variety of commercial options available at different price points. I personally use Logicube's Portable Forensic Lab, which works like a portable copier. This device runs for a few thousand dollars but can make copies at a rate of 4GB per min and is easy to ship to non-tech people to use. Logicube and other vendors also make small portable units for a few hundred dollars that work fine too.

However, here is a simple and cheap trick to make your own device. Using an empty USB external hard drive case ($20) and a simple change to your registry, you can be imaging like a pro.

First set up your registry with the following steps. (Note: Editing the registry isn't usually recommended if you aren't reasonably familiar with PC technology.)

1. Click on the Start Button and type in Regedit and hit Enter.

2. Navigate through HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control.

3. Right click on Control and select New and then Key. Call the new key FORENSICWRITEBLOCK.

4. Right click on FORENSICWRITEBLOCK and select New and then Dword. Call the new dword WriteProtect.

5. Right click on WriteProtect and select Properties. Set the value to 1 and hit OK.

(Note: To revert and remove the blocked write access to USB drivers after you're done imaging, just delete the StorageDevicePolicies registry key, or delete the WriteProtect registry entry, or change the value data for WriteProtect to zero.)

When you have finished setting up your registry, test your external drive with a personal or blank hard drive by trying to copy a file to the plugged-in external drive. Windows should give you an error message indicating the drive is write-protected and your attempted file copy will fail.

After covertly grabbing your suspect's hard drive (preferably during the middle of the night--see How to be a Better Burglar), plug the drive into your read/write blocking device. Windows should recognize the new drive and explorer will open. At this point you can search and use the drive as it was your own or make a forensic image that can see deleted files, be reviewed at a later time by you or a third-party and will hold up in court.

To make a forensic image, download Accessdata's FTK Imager 2.6.1. On the forensic market there are a lot of open source, freeware and paid software to choose from, but I find FTK Imager is very easy to use for beginners with its step by step wizard and of course, free price tag. Once installed select Create Disk Image, select the source of the image (your usb drive), name your file and save location (I recommend saving to a large external drive) and click start. After a few hours you will have an identical copy of your suspect's drive to explore. At this time you can return your suspect's drive without them knowing you made a copy. FTK Imager can also review the imaged drive or original drive by selecting "Add Evidence Item." In this function, Imager acts much like Windows Explorer, but will show you many deleted files marked with an X.

Tags digital forensics

Show Comments