A new forensic computer from a UK based company promises to make the task of gathering evidence at the scene of a crime much easier. The dual booting Windows XP and Suse Linux TreCorder portable forensic lab is built into a rugged portable chassis and can simultaneously copy up to three hard drives at a speed of 2GB per minute per drive. This is a substantial time saving over the kind of kit currently being used by forensic detectives in the field.
Three Tableau T345 write blockers mean that the drives being copied can be IDE, S-ATA or SCSI. Actually, they can be all three at the same time if need be. Using Firewire B to connect to the host ensures the system does not need to be powered down when connecting new evidence drives, and the Intel Core 2 Duo E6400 2.13GHZ CPU coupled to 4GB of memory and 4 Barracuda ES 500GB SATA-IICPU drives means that performance is not an issue.
Being a specially designed forensic tool, the TreCorder copies a mirror image of the drive and system memory, all deleted and reformatted data, and does so both quickly and securely so the evidence will stand up in court. This is achieved by using hardware based write protection to remove the notion of falsification of data during copying, and the copying is done on a sector by sector basis.
Does this mean that we will be seeing a TreCorder on CSI some time soon? Will Gil Grissom become a lInux geek as well as an insect freak? Seriosuly though, anything that can speed up the forensic data collection process has got to be a good thing. It should help bring more bad bad guys to justice in less time, and save money as a result.