Monday 22 August 2011

Forensic Workstation pt2

When we moved from the University campus to our new joint facilities with Hull City Archives and the Local Studies Library we took the opportunity to upgrade many of our PCs – leaving a few older specimens “just in case” anybody was so desperate that they were willing to accept a machine that was reluctant to start-up!

Recently the library has been re-organising its stock and space-utilisation ahead of a major refurbishment. Our old PC was discovered in the basement and ear-marked for disposal (well recycling really but disposal is less ambiguous). It was at this point, and with a new-found digital archives perspective, that I realised the potential of this machine to become our first digital forensics workstation. With an internal 3.5” floppy drive, CD drive and 2 USB ports this was a combination that seemed to promise possibilities for dealing with a range of media but also the chance to transfer the files once they had been extracted. The PC with slightly grubby keyboard and monitor were shipped to their new home at the History Centre.

I had by this time, started to identify requirements for a new PC to act as a workstation for the capture of hard-drives and other large volume of material. This request intrigued a colleague Tom in ICT and a visit was duly arranged, Tom was really interested in our work and offered to help. Tom took our PC and returned it a few days later - with a clean version of the Windows XP image installed aswell as an internal zip drive added.

Tom has also promised to put aside a couple of internal 3.5” floppy drives as an insurance policy for the drives failing as Jeremy Leighton John at the British Library had reported mixed results when using the external USB floppy drives. Having two workstations, one old and one new, will give us an option for dealing with some media formats; a USB drive for 3.5" floppy drives and an external 250MB zip drive. The latter was found when clearing-out an old cupboard and came with all cables and even its original installation CD proving that assembling a forensic workstation does not have to cost a fortune and I have heard several tales of kit assembled via ebay purchases.

4 comments:

  1. Trying again...

    Have you thought of buying a 5.25" drive from eBay or elsewhere, to give you a bit more flexibility?

    I can also recommend a Catweasel controller, which will let you read various strange older disk formats like Amiga and the original Apple disks.

    ReplyDelete
  2. Chris

    We have identified only one 5.25" disc in our collections which we decided was not sufficient to justify identifying a solution "in-case" we subsequently received more of this media. But agree that E-bay can be a vital source to acquire appropriate hardware.

    I have started to make tentative research into the catweasel controller. At present all of our efforts have been PC-based and have no solution for material generated on Apple Macs.

    ReplyDelete
  3. Simon,

    What kinds of problems did Jeremy have with external floppy/USB drives? I ask because I have been unsuccessful in imaging about 3 out of 95 3.5" floppies in our Cheuse collection and I'm not sure what the problem is.

    ReplyDelete
  4. Gretchen
    Jeremy reported that he had found the USB floppy drives were not as robust as the internal models. For this reason he often had to use combination of internal and USB models. With some drives reading disks that others couldn't - more due to pot-luck than any other reason!
    Simon

    ReplyDelete