How to Build a Computer Crime Lab

A hard drive platter

Computer forensics plays a large role in gathering, securing and analyzing evidence in many criminal and civil investigations. Computer forensic analysts are skilled technicians with training in forensic-recovery methods and the laws governing evidence recovery. That evidence must be collected, analyzed and maintained according to the rules of evidence, or the evidence is not admissible in a court of law. The location, security and policies of your computer crime lab will be subject to review with every case you investigate.

Things You'll Need

• Evidence container
• Locks
• Logbooks
• Forensic workstation

Instructions

1. Choose a room or building to house your lab. The computer crime lab door must have a working lock so you can limit room access to authorized personnel. Small rooms with walls that go from floor to ceiling are ideal. If the room has suspended ceilings, make sure that there is no opening between rooms above the ceiling tiles.

2. Secure a building or room using door locks and a security system if your budget allows for it. Choose locks that are bump-resistant, like Medeco or Assa Abloy locks. While not required, consider 24-hour manned security to enforce proper entry procedures.

3. Log the name, date, time and reason for visit for every person who enters the lab. Any bound book with lined pages is suitable for use as a log because it will be obvious when someone has removed a page.

4. Use high-quality padlocks to secure the evidence containers. Keep evidence containers in secure areas with limited access and minimize the number of people who have keys to the containers. Keep access logs for each container.

5. Purchase or build at least one forensic workstation. The specifications and hardware requirements for the workstation will vary depending on your budget and the type of media you will examine. The basic forensic workstation will include two processors, removable drive bays, SCSI (small computer system interface), Serial ATA and IDE (integrated drive electronics) controllers, USB and Firewire ports, a CD writer and the maximum amount of random access memory, or RAM, supported by the motherboard and operating system.

Tips & Warnings

• These are the minimum and basic requirements for a computer crime lab. Check your state's laws for more specific information and regulations.

References

• "Guide to Computer Forensics"; Bill Nelson, Amelia Phillips, Frank Enfinger and Christopher Steuart; 2008
• "Hacking Exposed 6"; Stuart McClure, Joel Scambray and George Kurtz; 2009