I am going to build a new portable acquisition kit, and need a case something like this:

 

http://www.lunchboxcomputers.com/lunchboxes/Lunchbox2600PortableDualProcessor.htm

 

I need a minimum of 2 exposed 5.25 drive bays, but w/o paying an arm and a leg.

 

Any suggestions?

since no one has bitten.....I would make a joke about those new fangled things called laptops....and the very rare usb ports and cables....oh and the priceless external drives

 

but....I may need your help one day so I won't....lol

 

hope you find something on the cheap!!!

Not luggables, but have you seen these:

 

http://www.newertech.com/products/usb2_adaptv2.php

 

http://www.newertech.com/products/usb3_universaldriveadap.php

I have plenty of adapters and dongles... even for SCSI, ESDI, and ST-506 interfaces.

 

The case is what I need.

Can't think of anything retail. Have you considered (do you have the means) to build your own? I have a guy on my private forum that has made a few cases that sound similar to what you need, let me know if you want to take a look.

have you considered the waterproof case approach:

 

 

with a LC attached to the inside of the lid and the entire PC barebones attached inside.

 

Extremely rugged and gives you instant access to the hardware.

 

Ive seen a couple of wireless pen test rigs done this way with great effect

 The problem is I need a PORTABLE box, that will fit within airline carry-on rules, so I can take it on location.

 

Mostly for my own knowledge, I'm curious about a couple things.  First, what's wrong with eSATA and Firewire 800?  While Firewire would be a bit slower, I wouldn't think that would be a huge concern, especially if this wouldn't be your primary forensics box.

 

And second, have you considered getting a pre-built forensics machine, either a special-purpose device for imaging (and then just a laptop for analysis), or a complete system?  I'd guess that the market is big enough that there would be some good options.  I don't know if these are any good, but something like this or this is what I had in mind.

 

The whole point is to not pay $5K for a box from DI.  I can build the equivalent of their uFRED for $500.    Also, DI only ships Tableau WBs, which are tremendously overpriced, and only work on FW.  Tailgate WBs like the Tableau are slow.  To get speed, you have to go SATA-to-SATA.  You also can not get some drive info over FW.

 

It is possible to use eSATA, but the whole point of this project is to have all drives being used (the source and destination) inside a drive bay, and not sitting out on the table.  There have been some disasters (and near disasters) with typical acquisition setups because of this (i.e. ESD or someone trips on a cable and snatches the drive off the table to the floor).  There is also an aesthetic concern, as some clients see the mass of wires and drives laying out on a table as kludgey and unprofessional.  Yes, that is the way most acquisitions are done, but it still worries people who are not familiar with the process.

 

 

I did some quick searching and came across this.

I did some quick searching and came across this.

 

Thanks prostuff1 .... that would be the ticket if it had 1 more 5.25 bay   although it would be iffy for some airline carry-ons.

 

If money were no object, the best case I've found so far is this one:

 

  http://www.bsicomputer.com/new/portable/s6/s6_details.htm

 

Now if I could source that case from higher up the food chain cheaper... or used.

 

 

The whole point is to not pay $5K for a box from DI.  I can build the equivalent of their uFRED for $500.    Also, DI only ships Tableau WBs, which are tremendously overpriced, and only work on FW.  Tailgate WBs like the Tableau are slow.  To get speed, you have to go SATA-to-SATA.  You also can not get some drive info over FW.

 

OK. That makes sense.  If you're willing to share, I'd be interested to see what you end up putting together.  Computer forensics is a subject I'm tangentially interested in.  I always thought all hardware write blockers were quite expensive, so while it doesn't surprise me that you could do something cheaper than a DI system, it does surprise me that its possible to build a comparable system for about $500.

So one 5.25" bay is for the drive you are analyzing, and the other is for your OS drive?  What if you used an SSD as your OS drive?  You then might be able to mount it internally and be able to use a case with only one 5.25" bay.

 

Or maybe you need both 5.25" bays for analysis...

So one 5.25" bay is for the drive you are analyzing, and the other is for your OS drive?

 

No, one is for the subject drive being analyzed, the other is the precleared drive that is receiving the copy.

 

 

Yes and no.