In addition to managing the back end of the RISK Team’s operations and delivering Labs Services to our On Demand and Rapid Response Retainer customers, the RISK Labs team evaluates and tests forensic solutions for our investigators in the field. While some consultants don’t mind traveling with the best gear they can locate, others want the smallest footprint possible when navigating the airport security line.
In response to that request, the RISK Labs team began investigating whether the MacBook Air—in particular its Boot Camp compatibilities—make it a viable forensic laptop.
In the past, we’d faced issues with Apple’s implementation of ExpressCard and devices using that interface operating in Boot Camp. At that time (~2009), ExpressCard was the best way to access eSATA devices from Mac laptops, but that wasn’t consistently true when running Windows. The inclusion of Thunderbolt in the latest generation of MacBook Air gave us hope that we could work with all of our standard forensic software and devices without issue.
In testing, that proved to be the case. When booted into Windows on our test system, we were able to use all of the following solutions:
- EnCase 6.19
- FTK 4.0.2
- Seagate GoFlex Thunderbolt
- Addonics CipherChain hardware encryption devices
- Tableau write blockers
- LaCie Thunderbolt/eSATA hub
The LaCie Thunderbolt hub was of particular interest to the team as it does not significantly increase the footprint of our field kit, but allows two eSATA connections to external devices. We connected two Ciphertex Ranger encrypted RAID arrays to our test unit, giving our Air a little over 20TB of storage. That should accommodate a good number of forensic images.
(Note that two five-bay storage arrays do significantly add to the footprint of a field kit.)
Initial reports from the field have been good, so it looks like we’ve identified a good portable forensic solution for the time being. Digital forensic technology is constantly changing, though, so we’re already pondering running the SIFT Workstation on a Raspberry Pi…
