Solution Guide

64 Store
can be completed even more quickly because several analysts and consulting
specialists, such as foreign language experts, can work on the same *.E01 file
simultaneously from different workstations.
Work can be triaged according to difficulty and assigned to analysts with
differing levels of experience; a junior analyst can take charge of the more time-
consuming task of pulling graphic files from an *.E01 file, while the more
experienced senior analyst can better spend her time doing more complicated
review and analysis of those graphic files.
Scalability
On the back end, Solution datacenter components are modular; and they are
designed with scalability in mind. Because the datacenter is handling the
workload, workstations do not have to be loaded with memory or computing
power. In fact, very inexpensive, lightweight terminals can be used to access the
required evidence files and even the analytical software stored within the
datacenter.
Security
The escalating trend toward information aggregation makes our data storage
systems increasingly vulnerable. At the same time, access to evidence storage
should be the most rigorously controlled area of a digital forensics system. Best
practice calls for implementation of a three-tiered strategy:
• Strictly regulated physical access that limits access to the hardware on which
your evidence data resides
• An administrative control layer that includes the use of group policies
• Computer-based security, such as secure password-creation policies
To this end, when the issue of designing the volume and structure adequate to
your needs is addressed (see "Ingest" on page 39), security is an agency’s
primary consideration where storage is concerned.
Physical Access Layer
Your digital forensics evidence server files should be housed more securely than
any other files in your organization, including Human Resources files.