Last year I devoted two columns to reviews of different computer forensics software. This month I'm revisiting computer forensics once again, but this time let's look at a hardware device developed for the cybercrime investigator.
One of the key tasks of the cyber cop is to find and document evidence of the crime on computers used by the suspect. Unfortunately, there are times when it's unreasonable or more likely impractical to seize someone or some organization's computer assets.
For example, let's say you're investigating a financial crime perpetrated from a college computer lab. Removing all the computers from the lab would be a huge task, it would disrupt the lab's educational mission, and it would generally tick off the college faculty. In this case, what you need is a portable device that can capture all of the information on the computers and leave them in place.
The tool for this job is Logicube's portable Forensic MD5. This 16-ounce handheld unit makes exact images or copies of a suspect storage drive or device.
To grasp a basic understanding of the process, you could compare imaging a hard disk to taking a picture. The Forensic MD5 unit is the camera. It stores an image of the suspect's hard drive. Then, when you are ready, all you have to do is "print" the image onto a new evidentiary hard disk for examination and courtroom presentation.
It's no surprise that Logicube would develop such a powerful portable forensic data tool. The Chatsworth, Calif.-based company is an industry leader in hard drive duplication, backup, data recovery, and computer forensics systems. Its hard drive cloning and duplication systems are used by IT departments worldwide. And Logicube's new line of forensic tools is key to the fight against cybercrimes and was used by the FBI to gain evidence against Zacarias Moussaoui, the accused "20th 9/11 hijacker."
Logicube's Forensic MD5 system is designed specifically for the requirements of professional law enforcement investigators, corporate security departments, and cybercrime investigation of forensic computer data. The handheld IDE hard drive data capturing system is ideal for fast disk drive data seizure. Using its built-in CRC-32 engine, the MD5 images data at speeds up to 3.3GB per minute. Its tamper-proof drive capture ensures bit-for-bit, sector-by-sector accuracy, guaranteeing zero chance of alteration of the suspect and evidence drives.
The Forensic MD5 kit comes in a ruggedized waterproof carrying case that's about the size of a small suitcase. It contains almost all of the components you'll need for an on-site forensic extraction. However, one necessary item not supplied is the destination storage device. These days the cost of large storage devices is so low I was surprised Logicube didn't include a 200GB hard drive in each kit.
Logicube supplies two copies of the software to run the MD5 unit. One is loaded onto a 64MB CompactFlash card; the other is on one of the four 3.5-inch floppy disks that come with the kit.