Recommend the physical space that the organization should put in place, to support this work both at MegaCorp and what would be contractually required for the forensics partner to do their work off-site

Recommend the physical space that the organization should put in place, to support this

work both at MegaCorp and what would be contractually required for the

forensics partner to do their work off-site.

To preserve the integrity of forensic investigations and the evidence itself, the actual laboratory will be self-contained, and climatically-controlled and monitored.

A fully equipped digital forensics laboratory contains numerous specialty spaces, each with its own unique and specific architectural/ engineering design issues that must be addressed. However, there are some general design requirements that are applicable for all of the spaces within the digital forensics unit.

The laboratory will consist of private work surfaces, secured storage areas, and a variety of forensic tools. These private rooms will be located in areas least-likely to suffer contamination from the elements, such as wind storms, flooding, and offer dry fire protection

Laboratory: should be designed specifically for electronics repair, assembly, and examination and should be provided with electrostatic discharge (ESD) protection, numerous computer accessories, including door and drawer base cabinets, display mounts, keyboard trays,CPU placement, cable management, power distribution, rack mounts, and parts and supplies bins, to include anti-static flooring and HVAC system, reference materials, UPS, necessary software, printers, scanners, additional HD and Tape Drives.

Physical Location Requirements: Access to emergency services, control of lighting at the lab, structural design of parking for security purpose

Lockers: Evidence will be stored in a fire and water proof that is air-tight, RFID to log and date any tagged evidence that leaves the forensic lab.

Office-Site Forensic: Only small group of trained professional, solid storage case built for traveling, wide array of adapters, multi-card reader, Hardware write-blockers and Seizure Toolbox.

Recommend the categories of tools that MegaCorp needs to purchase to support

this work on-site and what categories of tools would be contractually

required for the forensics partner to do their work off-site.

On-Site Tools: Host computers with fast bus, RAM and CPU, large monitors, data storage for evidence, Windows 7 and OSX to include Linux/Unix natively or in VM environment.

Off-Site Tools: SFF PC for mobile unit or Laptop, Forensic Talon from Logicube and HardCopy by Voom Technologies,

Each lab will be equipped with the following:

WeibeTech’s Forensic Field Kit (FFK-A4) comes with a Forensic UltraDock and six v4 Combo Adapters — everything you need to acquire data in the field from a large variety of hard drives, including 2.5 & 3.5-inch PATA or SATA drives, 1.0-inch MicroDrives, CompactFlash modules, SD cards, 1.8-inch drives, ZIF drives and a USB WriteBlocker for access to USB thumb drives and many other USB mass storage devices; to include the following below:

WeibeTech’s Hot Plug, this allows to seize and remove a PC anywhere without shutting it down
MacForensicsLab, a cross platform application for digital forensics and e-discovery
MacLockPick, a cross platform application to extract data.

Identify the advantages and disadvantages of having dedicated

space within MegaCorp for this work

Advantages	Disadvantages
Least expensive option	Time intensive
Quick response time	Requires multi-skilled investigators
Does not require outside intervention for potentially ‘brand’ damaging incidents	Does not ensure evidence integrity
Potential to develop in-house forensic tea	Requires technical diversity
Security staff know your system	Requires constant awareness of hacker tools and methods
	Requires constant awareness of current forensic tools
	Requires constant awareness to changes in relevant legislation
	Funds not always available in companies budgets to allow for the required training and resources to maintain the required expertise.

Provide a detailed plan for how you will ensure that the MegaCorp forensics partner

is able to meet these contractual obligations prior to signing the contract and

that it continues to be an appropriate partner into the future.

There is no one size fits all solution for computer forensics investigations, It is not feasible for any one person to be well-versed in every technology (including all software) used within an organization; therefore, individuals performing forensic actions should be able to reach out to other teams and individuals within their organization as needed for additional assistance. MegaCorp should ensure that IT professionals throughout the organization, especially the computer forensic team understand their roles and responsibilities.

To ensure MegaCorp is able to meet contractual obligations it will partner with NISTand National State/Local Agencies. This will ensure a consistent set of international standards that can efficiently deliver reliable and economical services.

The practice of forensic science is constantly changing, it may be less obvious but perhaps no less inescapable that the business of forensic science is evolving. The benefits of partnering will be increased throughput, more available expertise, and additional revenue streams. (Mohr)

Reference

Capella Element K, (2012). Computer Forensic Tutorial. Retrieved at http://www.capella.edu

Denmark, A. and Michael, M. (2010). Forensic Magazine. Digital Forensics: Architectural and Engineering Facility Design Requirements. Retrieved at http://www.forensicmag.com/article/digital-forensics-architectural-and-engineering-facility-design-requirements?page=0,4

Mohr, K. (2005). Forensic Magazine. The Benefits of Partnerships. Retrieved at http://www.forensicmag.com/article/benefits-partnerships?page=0,2

Nelson, B., Phillips, A., Enfinger, F., Steurt, C. (2008) Guide to computer forensics and investigations

Ryder, K. (2002). SANS-Computer Forensics- We’ve had an incident, who do we get to investigate? Retrieved at ttp://www.sans.org/reading_room/whitepapers/incident/computer-forensics-weve-incident-investigate_652