Josh Moulin - Designing A Mobile Digital Forensic Lab On A Budget

ueslqoloq o Moblle ulqltol loteoslcs lob oo o 8oJqet Page 1 of 18
Iosboo 5. Moollo - C5c,ccN1,CclA,clc,cAwl,ulcl,Ac,cc5 bttp.//IosbMoollo.com

!"#$%&$&% ( )*+$," !$%$-(, .*/"&#$0# 1(+ *& ( 234%"-

!"5",*6$&% ( 23#$&"## 73#-$8$0(-$*&

When l began lnvesLlgaLlng cyber crlmes and selzlng dlglLal evldence, lL was rare Lo selze more Lhan Len
lLems of dlglLal evldence from a resldenLlal search warranL. usually a suspecL would have a deskLop
and lapLop compuLer, a cellular phone, and some loose medla llke floppy dlsks or Cus. lL was easy Lo
ldenLlfy Lhe dlglLal evldence and Lhe capaclLy was relaLlvely small, allowlng for fasLer forenslc lmaglng
and analysls.

As Lechnology became more affordable and accesslble wlLh larger sLorage capaclLles, my dlglLal
forenslcs laboraLory began feellng Lhe effecLs. A Lyplcal resldenLlal search warranL sLarLed Lo yleld
dozens of dlglLal devlces, all requlrlng a forenslc examlnaLlon by Lralned analysLs. l remember one
search warranL LhaL was served aL a home ln a chlld sexual explolLaLlon case where over 80 lLems were
selzed. uevlces such as compuLers, LableLs, smarL phones, Cus, uvus, uS8 devlces, camera cards, and
neLwork sLorage devlces sLarLed becomlng commonplace. new operaLlng sysLems and lncreased
securlLy conLrols and encrypLlon along wlLh Lhe sheer volume of evldence belng selzed placed an even
hlgher demand on Lhe few dlglLal forenslc examlners avallable.

Lvery crlme lmaglnable has a nexus Lo elecLronlc evldence. Couple Lhls facL wlLh an lncrease ln
elecLronlc evldence belng selzed aL every crlme scene and lL doesn'L Lake long Lo waLch Lhe backlog
and Lurnaround Llme of a forenslcs lab grow exponenLlally. Slnce dlglLal evldence ls unlque from oLher
LradlLlonal evldence ln LhaL lL can be Lhe lnsLrumenLallLy Lo commlL a crlme (chlld explolLaLlon, neLwork
lnLruslons), lL may be Lhe frulL of Lhe crlme (sLolen ln a burglary), or lL may conLaln evldence of a crlme
lL had noLhlng Lo do wlLh (Lhlnk of a suspecL who may wrlLe a [ournal), cyber crlme lnvesLlgaLors are
flndlng Lhemselves needed ln all Lypes of lnvesLlgaLlons.

1o add Lo Lhe monumenLal Lask of managlng an lncreaslng caseload and havlng a reasonable
Lurnaround Llme, new Lechnlques and Lechnologles conLlnue Lo be developed. Cne example of a
paradlgm shlfL ln dlglLal forenslcs ls Lhe collecLlon of volaLlle evldence from a devlce, such as Lhe
conLenLs of 8andom Access Memory (8AM). When l began ln dlglLal forenslcs, Lhe sLandard proLocol
was Lo pull Lhe power plug from Lhe back of a runnlng compuLer and LransporL lL Lo Lhe forenslcs lab.
uolng anyLhlng oLher Lhan pulllng Lhe plug was seen as desLrucLlve and agalnsL all sLandard pracLlces.
now, flrsL responders and forenslc pracLlLloners are belng LaughL qulLe Lhe opposlLe Lo save crlLlcal
evldence. lorenslc examlners are now LaughL LhaL pulllng Lhe plug desLroys evldence LhaL may conLaln
lnculpaLory or exculpaLory evldence. MosL law enforcemenL agencles don'L have Lhe fundlng or Llme
Lo Lraln and equlp paLrol offlcers and deLecLlves ln Lhe collecLlon of volaLlle memory, so managers have
Lo make a rlsk-based declslon, conLlnue pulllng Lhe plug, or provlde Lhe experLlse Lo selze dlglLal
evldence properly.


As a dlglLal forenslc lab dlrecLor and law enforcemenL manager, l declded Lo make my forenslc
examlners (deLecLlves) avallable durlng selzures Lo perform Lasks such as capLurlng volaLlle memory
and asslsLlng wlLh Lhe search and selzure of dlglLal evldence. 1he pros of Lhls declslon was LhaL we
were geLLlng evldence LhaL oLherwlse would have been losL. We also were able Lo be more selecLlve
on whaL dlglLal evldence was selzed aL scenes and could ldenLlfy some dlglLal sLorage devlces LhaL non-
Lechnlcal lnvesLlgaLors dldn'L reallze may conLaln evldence. 1he cons of Lhe declslon lncluded havlng
examlners ouL of Lhe lab frequenLly, resulLlng ln lncreased backlogs and Lurnaround Llmes.

1he legal landscape of dlglLal forenslcs also began Lo change, mosLly as Lhe resulL of law enforcemenL
mlshandllng dlglLal evldence ln some hlgh proflle cases. !udges began Lo be less LoleranL of Lhe lengLh
of Llme lL was Laklng dlglLal forenslc labs Lo provlde Lhe resulLs of Lhelr analysls. ln some cases
lndlvlduals and buslnesses LhaL had daLa selzed durlng an lnvesLlgaLlon were walLlng monLhs and even
years wlLhouL Lhelr daLa and crlmlnal cases were Laklng forever Lo reach ad[udlcaLlon. AlLhough lL was
my lab's sLandard pracLlce Lo explaln ln boLh sLaLe and federal affldavlLs LhaL due Lo Lhe hlghly
Lechnlcal process of dlglLal forenslcs and Lhe lack of Lralned forenslc examlners Lhere was a delay ln
analyzlng evldence, [udges began puLLlng Llme llmlLs on us. We even sLarLed Lo see search warranLs
wrlLLen LhaL requlred Lhe onslLe prevlew of dlglLal evldence and lmmedlaLe Lrlage wlLh lnsLrucLlons LhaL
only devlces LhaL had daLa relaLed Lo Lhe lnvesLlgaLlon could be Laken offslLe for addlLlonal analysls.

As l began waLchlng Lhese changes, boLh Lechnlcal and admlnlsLraLlve, l reallzed LhaL someLhlng had Lo
be done Lo make my lab boLh more efflclenL and mosL lmporLanLly, more effecLlve. My answer Lo Lhls
dllemma was Lhe creaLlon of a buslness plan Lo [usLlfy a moblle dlglLal forenslcs laboraLory. lL was my
oplnlon LhaL lf we had Lhe ablllLy Lo Lake our forenslcs lab Lo Lhe crlme scene, my lab could begln
collecLlng evldence, lmaglng evldence, and even dolng some forenslcally-sound analysls ln Lhe fleld all
whlle wlLhln a conLrolled and secure envlronmenL. l hypoLheslzed LhaL lf my lab could respond Lo a
crlme scene or warranL locaLlon wlLh all of our Lools and equlpmenL, we would be able Lo provlde
lmmedlaLe feedback Lo Lhe lnvesLlgaLors and reduce our overall operaLlng cosLs. 1he reducLlon ln
expenses would come from fasLer case ad[udlcaLlons, less evldence supplles belng consumed, and less
evldence space belng needed. ln Lhe end, l was able Lo prove all of Lhese.

ln 2009 when Lhls buslness plan was creaLed, Lhere were no oLher moblle dlglLal forenslc laboraLorles
ln my sLaLe. 1he only exposure Lo Lhese vehlcles l had was lmages on Lhe lnLerneL of cusLom-bullL
vehlcles. AfLer obLalnlng a few quoLes for Lhese vehlcles, lL became qulckly apparenL LhaL buylng a pre-
made moblle dlglLal forenslcs lab was ouL of Lhe quesLlon. My agency had no budgeL for Lhls Lype of
expense, so an alLernaLlve plan was creaLed.

ln order Lo move forward wlLh Lhe pro[ecL, Lhe vehlcle requlremenLs had Lo be documenLed. lor a
moblle dlglLal forenslcs lab Lo be successful, lL had Lo:

1. 8e secure
2. Pave adequaLe room for Lwo or Lhree people Lo work
3. 8e mechanlcally rellable


4. Pave boLh AC and uC power avallable lnLernally and exLernally wlLh Lhe capaclLy Lo power
mulLlple hlgh-end compuLers
3. Pave cllmaLe conLrol
6. 8e able Lo run for long perlods of Llme whlle noL lnLroduclng exhausL fumes lnLo Lhe passenger
comparLmenL
7. Pave adequaLe lnLernal and exLernal llghLlng
8. Pave sLorage space for dlglLal evldence and equlpmenL
9. Pave Lhe ablllLy Lo neLwork equlpmenL lnslde

As Lhese requlremenLs were revlewed, l began conslderlng all of Lhe exlsLlng vehlcles avallable LhaL
could meeL Lhe above requlremenLs. l looked aL dellvery Lrucks (uS, ledLx, eLc.), bread Lrucks, and
small recreaLlonal vehlcles. 1hen, Lhe perfecL vehlcle came Lo mlnd, an ambulance. l happened Lo
know all abouL ambulances slnce l spenL elghL years as a flreflghLer and LM1, worklng Lhree years on a
LransporL ambulance before l sLarLed my law enforcemenL career.

A local non-proflL ambulance company was known Lo donaLe Lhelr ambulances when Lhey reached
Lhelr cycle perlod, so l reached ouL Lo Lhem abouL my need. WlLhln abouL Lwo hours of my phone call
Lo Lhe ambulance company, l had an ambulance parked ln my agency's parklng loL, compleLely free of
charge. An ambulance ls perfecL for a moblle dlglLal forenslcs lab because lL meeLs all of Lhe
requlremenLs, buL also ls already seLup as an emergency vehlcle. lL has emergency llghLs, slren, radlo,
anLennas, and ls sure Lo be malnLalned ln excellenL condlLlon.

veblcle lo lts otlqlool cooJltloo wbeo lt wos JoooteJ.

WlLh some lnLerlor remodellng, Lhe ambulance was qulckly Lransformed lnLo a worklng dlglLal forenslcs
laboraLory. 1o help keep cosLs down, l conLacLed varlous companles ln Lhe area and recelved several


donaLlons. A local body shop agreed Lo remove Lhe decals and palnL Lhe vehlcle for free, a Llre shop
agreed Lo provlde all new Llres, a Whelen represenLaLlve provlded new LLu llghLs aL cosL, a graphlc
deslgn company provlded new cusLom graphlcs aL cosL, and a local graphlcs shop agreed Lo apply Lhe
graphlcs for free, a local cablneLry maker agreed Lo remodel Lhe lnLerlor for cosL, and an upholsLery
shop agreed Lo reupholsLer Lhe vehlcle and LlnL Lhe wlndows for a reduced fee. 1o express our
appreclaLlon Lo Lhese buslnesses, Lhe names of Lhese buslnesses were placed on Lhe rear of Lhe vehlcle
wlLh Lhe words 1hls vehlcle was made posslble by" above Lhe buslness names.

9&-"/$*/ !"#$%&

ulmenslons were Laken of Lhe lnLerlor of Lhe vehlcle and a deslgn was creaLed. 1he bench seaL on Lhe
passenger's slde was removed and Lhls ls where Lhe forenslc worksLaLlons were lnsLalled. Cn Lhe
drlver's slde, Lhe cablneLry was perfecL for sLorlng forenslc equlpmenL such as wrlLe blockers, cables,
uS8 devlces, hard drlves, keyboards, eLc. 1hls was kepL as-ls, wlLh Lhe excepLlon of a vold area near
Lhe rear doors LhaL was used Lo hold foldlng sLreLchers. A new cablneL was speclfled for Lhls area wlLh
ad[usLable shelvlng Lo hold addlLlonal equlpmenL.

Otlqlool cooJltloo of lotetlot


1he cablneLry work was Lhe flrsL Lhlng Lo be done slnce lL was golng Lo be Lhe largesL pro[ecL and creaLe
Lhe blggesL mess lnslde Lhe vehlcle.

kemoJeleJ cooJltloo of moblle foteoslcs lob

1he above lmage shows Lhe compleLed lnLerlor remodel. 1he work surface on Lhe passenger's slde
gave Lwo examlners plenLy of room Lo work wlLh Lwo cusLom-bullL forenslc worksLaLlons beLween
Lhem. lasLeners were placed on elLher end of Lhe work surface so a bungee cord could cllp Lo each
end, pushlng Lhe chalrs up agalnsL Lhe area keeplng Lhem secure when Lhe vehlcle was ln moLlon.

1he orlglnal floorlng was wood wlLh a sandpaper-llke layer glued Lo Lhe wood for LracLlon. 1he Lop
layer was manually removed and bare wood was exposed. AnLl-sLaLlc carpeL Llles were selecLed for Lhe
new floorlng. 1hls Lype of floorlng reduced Lhe nolse lnslde Lhe vehlcle, was more comforLable, and
Lhe carpeL Llles are easy Lo pop up and remove ln Lhe evenL one becomes damaged or sLalned.


cobloetty oo Jtlvets slJe

1he exlsLlng cablneLs were lefL, [usL cleaned and labeled. new plasLlc organlzlng blns were purchased
and labeled and equlpmenL was sLored loglcally ln Lhe cablneLs. 1he new addlLlonal cablneL LhaL was
bullL as parL of Lhe remodel can be seen on Lhe far lefL of Lhe phoLograph. 1hls seLup allowed a
forenslc examlner Lo slL aL Lhelr worksLaLlon and slmply spln around on Lhe offlce chalr Lo access
everyLhlng needed, wrlLe blockers, cables, noLepads, and more were all aL Lhelr flngerLlps.


commoolcotloos Ateo

1he area shown above already exlsLed ln Lhe vehlcle and was repurposed for use ln dlglLal forenslcs.
1hls area provlded AC and uC power, so a prlnLer and charger for porLable radlo baLLerles was
lnsLalled. 1hls area had a pollce radlo lnsLalled so Lhe examlners ln Lhe back could hear radlo Lrafflc
and Lalk on Lhe radlo lf needed. 1he conLrol panel shown ln Lhe Lop of Lhe phoLograph provlded Lhe
ablllLy Lo conLrol Lhe alr condlLlonlng and heaLlng, Lhe lnLerlor llghLs, and oLher funcLlons.

1he enLlre vehlcle was equlpped wlLh a secure, encrypLed 8lueLooLh neLwork. 1hls allowed examlners
Lo send documenLs Lo Lhe 8lueLooLh prlnLer shown above and prlnL dlrecLly on scene. We were able Lo


make properLy recelpLs or prlnL evldence found on a compuLer durlng a forenslc prevlew and glve lL Lo
Lhe lnvesLlgaLors conducLlng a suspecL lnLervlew.

loteoslc wotkstotloos

1he above plcLure shows Lhe forenslc work area. 1he remodel lncluded Lhe Lhree sLorage cablneLs
above Lhe examlner work surface whlch were used Lo sLore evldence supplles, noLepads, pens, and
oLher mlscellaneous lLems. 1he Lop of Lhe work surface was lamlnaLe, allowlng lL Lo be scraLch
reslsLanL and easy Lo clean afLer puLLlng dlrLy hard drlves and oLher equlpmenL on lL.


1op of wotkstotloo ooJ mooltots

1he deslgn lncluded a large hole cuL ln Lhe Lop of Lhe work surface, dlrecLly ln Lhe cenLer. Several
cables were run Lhrough here Lo glve an examlner lmmedlaLe connecLlvlLy Lo Lhe forenslc worksLaLlons.
1he cables lncluded uS8, eSaLa, llrewlre 800, and power cords for 1ableau wrlLe blockers.

23" Acer monlLors were selecLed for Lhls vehlcle and mounLed dlrecLly on Lhe wall. uue Lo Lhe llmlLed
space, Lhe monlLors lncluded uS8 porLs and bullL-ln speakers, ellmlnaLlng Lhe need for sLandalone
speakers and uS8 hubs for Lhe examlners. uongles could easlly be plugged ln Lo Lhe monlLor for
forenslc appllcaLlons, sLlll leavlng uS8 porLs on Lhe fronL of Lhe worksLaLlons for addlLlonal
connecLlvlLy.

A large sLalnless sLeel power sLrlp was lnsLalled aL Lhe base of Lhe work surface, glvlng examlners
plenLy of ouLleLs Lo plug ln devlces. lL was noL uncommon for examlners Lo have wrlLe blockers
plugged ln, cell phones charglng, and lapLops powered on.


1he enLlre vehlcle was neLworked wlLh CaL 6 cables. ln Lhe above lmage LLherneL cables can be seen
comlng up from Lhe Lwo forenslc worksLaLlons and plugged lnLo ouLleLs ln Lhe base of Lhe newly bullL
cablneLs. ln Lhe Lop of Lhe sLorage cablneL labeled 7" ln Lhe far lefL of Lhe above phoLograph, a
neLwork ALLached SLorage (nAS) head was lnsLalled and aLLached Lo a nAS devlce. An lnLernal
workgroup was creaLed and compuLers could aLLach Lo Lhe workgroup and access Lhe nAS. 1he nAS
was a mulLl-LerabyLe sLorage devlce and lL was formaLLed as a 8edundanL Array of lndependenL ulsks
(8Alu) ln level 3. 1he nAS was furLher parLlLloned wlLh Lhe largesL parLlLlon used as evldence sLorage
and Lhe smaller parLlLlon used Lo sLore documenLs.

Lxamlners had Lhe ablllLy Lo access our forms, such as evldence recelpLs, search warranL LemplaLes,
exlgenL clrcumsLance forms, and oLher lmporLanL documenLs and creaLe and prlnL Lhem aL Lhe scene.
ulglLal evldence could be forenslcally lmaged dlrecLly Lo Lhe nAS and Lhe nAS could Lhen be unplugged
from Lhe moblle forenslcs lab and LransporLed lnLo Lhe forenslcs lab and downloaded Lo Lhe ln-house
SAn.

loteoslc wotkstotloos


1o conLlnue savlng cosLs on Lhls pro[ecL, l bullL Lhe forenslc worksLaLlons. 1hese worksLaLlons had
64blL Wlndows 7 ulLlmaLe operaLlng sysLems, plenLy of lnLernal hard drlve space, and loLs of 8AM. 1o
ensure Lhe compuLers dld noL Llp whlle Lhe vehlcle was ln moLlon, a closeL rod was placed ln fronL of
Lhem wlLh paddlng on lL.

lotetlot llqbtloq

1he ambulance came wlLh sLandard halogen lnLerlor llghLs LhaL were dlmmable and could be Lurned on
as elLher a bank of Lhree, or all slx llghLs. 1he halogen llghLs were removed and replaced wlLh Lhese
Whelen LLu lnLerlor llghLs. l selecLed Lhree whlLe dlmmable LLu llghLs for general purpose and Lhen
Lhree red LLu llghLs. 1he red LLu llghLs allowed examlners Lo work ln Lhe back of Lhe vehlcle and noL
lose Lhelr nlghL vlslon durlng nlghLLlme operaLlons. lL also made lL nearly lmposslble Lo see lnLo Lhe
vehlcle aL nlghL Lhrough Lhe LlnLed wlndows when Lhe red llghLs were on.


lotoJoy 8ox

1o address Lhe growlng need of moblle devlce forenslcs, a laraday box was lnsLalled ln Lhe moblle
dlglLal forenslcs vehlcle. Cne of Lhe exlsLlng shelves was converLed Lo a slldlng shelf so whlle Lhe
vehlcle was ln moLlon or Lhe laraday box was noL belng used, lL could be puL away. When needed, Lhe
shelf could be pulled ouL and Lhe Lop opened, allowlng an examlner Lo conducL an analysls of a moblle
devlce. ln Lhe cablneL above Lhe laraday box was a Celle8rlLe unlL.


lotetlot cob

1hls vehlcle saL on a lord L-430 dlesel chassls LhaL was ln excellenL condlLlon. As parL of Lhe
remodellng process, all chalrs were reupholsLered. 1he lnLerlor cab was already equlpped wlLh a
conLrol panel, radlo, and slren. 1he conLrol panel allowed Lhe passengers ln Lhe cab Lo conLrol Lhe


cllmaLe and llghLlng ln Lhe back as well as all of Lhe emergency llghLs and scene llghLs on Lhe exLerlor of
Lhe vehlcle.

:;-"/$*/ !"#$%&

1here was noL much LhaL had Lo be done Lo Lhe exLerlor excepL for cosmeLlcally. All of Lhe emergency
llghLs were converLed from sLrobe and halogen llghLs Lo LLu as a maLLer of preference, however lL
wasn'L absoluLely necessary Lo do ln order for Lhe vehlcle Lo be placed ln servlce.

5lJevlew of moblle Jlqltol foteoslcs lob

1he exLerlor of Lhe vehlcle provlded a greaL deal of scene llghLlng, whlch was excellenL durlng evenlng
search warranLs or crlme scene lnvesLlgaLlons. 1hls vehlcle began respondlng Lo ma[or assaulLs,
deaLhs, vehlcle colllslons, and oLher lncldenLs as parL of a reglonal ma[or crlme Leam. We were able Lo


lmmedlaLely search wlLness and suspecL cell phones aL Lhe scene of crlmes and provlde real-Llme
lnformaLlon Lo Lhe lnvesLlgaLors, or pull dlglLal vldeo fooLage of a crlme Lo help ln Lhe lnvesLlgaLlon.

keot of moblle Jlqltol foteoslcs lob

1he rear of Lhe vehlcle also provlded addlLlonal scene llghLlng and emergency llghLlng. All wlndows
were LlnLed wlLh llmouslne LlnLlng Lo provlde Lhe mosL amounL of prlvacy and safeLy Lo Lhose lnslde Lhe
vehlcle. 1hls also prevenLed bysLanders from seelng Lhe conLenL belng dlsplayed on Lhe forenslc
worksLaLlon monlLors.


ltoot of moblle Jlqltol foteoslcs lob

:<3$6="&- >*3#"4 ?$-@$& -@" A"@$0,"

Cur lab dld noL have Lhe budgeL Lo repllcaLe all of Lhe equlpmenL LhaL was ln our laboraLory lnslde of
Lhls vehlcle. When Lhe vehlcle was needed aL a scene, cerLaln lLems from Lhe lab had Lo be moved Lo
Lhe moblle lab. 1o ensure equlpmenL was noL mlssed, a checkllsL was creaLed. 1he vehlcle was
equlpped wlLh mulLlple 1ableau wrlLe blockers, LoglLech 1alon devlces, all Lypes of compuLer-relaLed
cables, wlped hard drlves, empLy uS8 Lhumb drlves, neLwork equlpmenL, Cus, uvus and Lhumb drlves
conLalnlng forenslc sofLware, noLepads, pens, evldence bags, a porLable heaL seallng devlce for
evldence, permanenL markers, cameras, baLLerles, keyboards, mlce, flashllghLs, adapLers, and forclble
enLry Lools. AnyLlme we responded somewhere wlLh Lhe vehlcle we would always add aL leasL one
Celle8rlLe unlL, some lapLop compuLers, and addlLlonal wrlLe blockers.

Cn a monLhly basls Lhe forenslc worksLaLlons lnslde Lhe moblle dlglLal forenslcs lab were paLched for
any vulnerablllLles (alLhough Lhey were noL on Lhe lnLerneL) and all updaLes for our forenslc sofLware
were applled as well.


8efote ooJ Aftet

:88"0-$5"&"## (&4 :88$0$"&0$"# B($&"4

1he success of Lhe moblle dlglLal forenslcs vehlcle was beLLer Lhan anLlclpaLed. 8espondlng Lo a crlme
scene wlLh Lhls vehlcle dlsplayed professlonallsm and lL rapldly became a soughL afLer resource. My
lab was able Lo Lake dlglLal evldence lnLo Lhls vehlcle, forenslcally prevlew Lhe evldence, and provlde
lnvesLlgaLors wlLh lmmedlaLe feedback durlng Lhelr lnvesLlgaLlons. Cn numerous occaslons, we were
able Lo flnd evldence, prlnL Lhe evldence, and hand lL Lo an lnvesLlgaLor who was lnLervlewlng a
suspecL. 1hls feedback was lnvaluable and occaslonally led Lhe lnvesLlgaLlon ln a new dlrecLlon.

1he vehlcle was parLlcularly helpful durlng lncldenLs LhaL lnvolved several wlLnesses, such as an offlcer
lnvolved shooLlng. 1he moblle dlglLal forenslcs lab would arrlve and wlLnesses who capLured evldence
wlLh Lhelr cell phone were able Lo slgn a consenL Lo search form, walL flfLeen or LwenLy mlnuLes for us
Lo lmage Lhelr cell phone, and Lhen geL lL back. lL was also helpful for Lhose lndlvlduals who normally


would noL consenL Lo belng wlLhouL Lhelr phone for a few days whlle a LradlLlonal lab examlned Lhe
devlce, buL would consenL Lo glvlng lL up for a few mlnuLes.

We dld see a reduced amounL of evldence belng selzed aL crlme scenes. CfLen, our examlners could
qulckly rule ouL a dlglLal devlce and leave lL aL Lhe scene. ln Lhe pasL, every lLem of dlglLal evldence was
selzed, packaged, sLored, and examlned wlLhln a laboraLory. now, we could Lrlage onslLe and leave
lLems LhaL dldn'L have evldence and Lake back only Lhose lLems LhaL we knew were lnvolved ln Lhe
lnvesLlgaLlon. 1hls LranslaLed Lo a reducLlon ln Lhe use of cosLly anLl-sLaLlc evldence bags, evldence
Lape, barcode labels, and Lhe physlcal sLorage space needed Lo sLore Lhe evldence.

ln all, Lhe vehlcle and Lhe relaLed equlpmenL sLored wlLhln Lhe vehlcle came Lo [usL under $13,000.
WlLhouL Lhe donaLlons recelved, Lhe cosL probably would have been closer Lo $23,000 Lo $30,000.
1here were some upgrades done Lo Lhls vehlcle LhaL were noL absoluLely necessary, buL were
funcLlonal enhancemenLs, whlch could be ellmlnaLed lf a budgeL dldn'L allow for Lhem. lor whaL we
galned, $13,000 was a mlnlmal expense and over Llme Lhls vehlcle noL only saved us money buL lL
served Lhe needs of Lhe publlc. l was also able Lo leverage Lhls vehlcle and our capablllLles Lo
successfully obLaln granL fundlng and flnanclal parLnershlps wlLh ouLslde law enforcemenL agencles,
acLually maklng us money ln Lhe end.

Josh Moulin - Designing A Mobile Digital Forensic Lab On A Budget

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Josh Moulin - Designing A Mobile Digital Forensic Lab On A Budget

Uploaded by

Copyright:

Available Formats

ueslqoloq o Moblle ulqltol loteoslcs lob oo o 8oJqet Page 1 of 18

Iosboo 5. Moollo - C5c,ccN1,CclA,clc,cAwl,ulcl,Ac,cc5 bttp.//IosbMoollo.com

You might also like