The most important tool in DFIR that you must have...
One of the workstations I have ranks up there in the clouds insofar as hardware. You name it, this machine has it. Lots of it. Crammed into a huge case with lots of lights and liquid cooling hosing. I call it the “Monster”. No matter what I throw at it, it chews it up, spits it out, and smiles asking for more. Seriously. It’s a dream machine of a forensic workstation.
One thing about it however is that no matter how fast it is, or how cool it looks, it doesn’t really do forensics. You see, I have this other little computer (laptop). It’s really really small and light. No CD/DVD drive, one USB port, and stuffed with high-speed hardware, but not that you can stuff that much in such a small laptop. I call this one my “Little Baby”.
When I go somewhere, I take my Little Baby. It does everything I need for the most part. I would not want to try to index a terabyte or more to index, or try to do any serious processing with it. However, this Little Baby does forensics work. I've done forensic work in the offices of lawyers, in front of judges, and in court. Each time using my Little Baby (I have a few, but they are all my Little Babies).
I mean this in the manner that it’s not the machine (such as my Monster or Little Baby), but the examiner, that does the forensic work. If you forego “processing” and “indexing”, the forensic machine comparisons in speed become irrelevant and everything comes down to the examiner. I mean everything. The best examiner can use X-Ways or Encase or FTK or any open source forensic tool on practically ANY computer when it comes down to deep-diving into electronic evidence. The machine allows the examiner to use a software to access the media. That’s it. A million gigs of RAM won’t let you examine the registry any faster than 4GB will. Your eyes and the stuff between your ears will get the job done.
When I teach forensics, one of the things I try to get across is that it is the person that gets the job done. Flashing lights are cool on a computer, but if the examiner doesn’t know how (or where) to find evidence on a hard drive, then the flashing lights are not going to help. If the examiner does not have critical thinking skills to investigate (or now commonly being described as "hunting") threats or evidence, then the tools are useless.
...
