I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices?
I would try to better explain this scenario, by considering a work environment where us(as technical security team) gets call for investigation to the xyz location to gather some kind of digital evidence. Right now, we don't have the forensics means to do so , just relying on basic manual means to gather the data.E.g searching file histroy, temp folders.
Now, after a month of deliberation working out the benefits of using forensics technology, we have come up with a strategy where we would be using hard-disk duplicators to fetch data from remote workstation / laptop and writing to write protected hard-disks.
Now, where I'm stuck in the whole process, is how to optimise the transfer of data from the drives into the analysis system. The analysis system in this case would be using EnCase software. I want to know from the list below what would be the optimal way to transfer evidence to analysis systems.
- Workstation / laptop connected to external hard-drive
- Workstation / laptop connected to USB interface
- Workstation / laptop connected to network-connected hard-drive.
- Also other methods not mentioned in here.
Considering , that in our environment the volume of disk drives fetches to terabytes. For example an image of a terabyte drive when copied to analysis system through whatever channels should be fast enough for forensics software to run complex queries e.g finding deleted files, or access to computer through remote terminal.
I want to know of the method mentioned above what provides the fastest analysis of evidence. Considering, that there is no shortage of space of storing digital evidence in the analysis system.