We use a mix of new and vintage off-the-shelf computing workstations and specialized forensic peripherals. So far, we have found this approach to be stable, affordable, and scalable. We hope the configurations shared here can serve as a starting point for your equipment decisions.
Imaging Workstation 1
OS: Windows 10
Specifications: Intel i7-6700, 32GB RAM, SSD system disk and 1TB hard drive for VM storage
Imaging Workstation 2
OS: Windows 10
Specifications: Intel Core i7-6700 CPU, 16GB RAM, SSD system &disk
Nickname: Ms. Pacman (formally Mr. Crummy)
Our imaging stations were configured using the preferred system requirements for Forensic Toolkit (station 1) and to run BitCurator as the native OS (station 2) as of late 2017. Station 1 has an additional large hard drive to accommodate multiple virtual machines. We no longer run BitCurator as an OS, so future machines will be configured to preferred systems requirements for FTK, with enough RAM/CPU power to comfortably run VMs.
These computers also have two network cards to connect to the lab's local storage pool and the external internet. The external internet connection is usually disconnected for security purposes and only used to update the machine on a weekly bases. And yes, all of our computers have nicknames.
Forensic computing peripherals
Digital Intelligence USB Forensic Bridge
Digital Intelligence Firewire Forensic Bridge
CRU Forensic ComboDock
Device Side Data FC5025
Since we use standard off-the-shelf workstations, we employ certain specialized tools and purpose-built peripherals to enable forensic workflows. We will build out this kit as needs arise. We plan to upgrade our current USB 2 USB forensic bridge to a USB 3 version, as transferring material from modern external hard drives can be quite slow using older versions of USB.
Vintage computing equipment
A sampling from our small vintage collection:
Macintosh PowerBook 145B
Macintosh Power Macintosh 7600/120 & 7600/132
Macintosh Power Macintosh 8500/120
Dell Dimension 2400
TEAC 5.25 floppy drives
Assorted cables, drives, and monitors
Our collection is comprised of donations from U-M faculty and library staff, and purchases made from Property Disposition and eBay. While we prefer to use modern equipment, sometimes vintage equipment is the best/only way to retrieve content. Because our collections contain Apple 400k and 800k formatted disks, our main focus is to acquire hardware/software that can handle this type of media. We will also accept certain vintage equipment because it's just plain cool.