Just before summer 2013 Police Zone (PZ) Schelde-Leie in Belgium installed their first Tracks Inspector stand-alone server with 10Tb of RAID5 storage and a Physical Evidence System (PES). Before having Tracks Inspector they typically handled 4-5 cases a year for which they requested support from digital forensics experts at the regional computer crime unit which was a slow and frustrating process. Recently, at a Tracks Inspector event in Leuven, detective Luc Luyckx from Schelde-Leie reported his experiences after working one year with the system. Because of the quick turn-around time enabled by having their own Tracks Inspector system, they had processed and investigated nearly 100 exhibits in more than 30 cases varying from vice, shoplifting, disappearances, stalking, cyber, drugs and murder investigations. Results found with Tracks Inspector have been successfully submitted as evidence to the Belgium court.
Doubling capacity without any down time
Typically, PZ Schelde-Leie keeps cases active on the system for a couple of months before archiving them to disk to free-up space on the server. However, with the spectacular growth in demand the 10Tb capacity was no longer sufficient. Having seen the effectiveness of Tracks Inspector in their organisation, management didn’t hesitate and approved an investment to expand. With traditional digital forensics tools, expanding the hardware typically means taking the system off line, replacing or upgrading existing hardware, reinstalling the software, migrating active data and sometimes even requiring additional licenses. A process that can take one or more days during which time the system is not available. This is not the case with Tracks Inspector. All PZ Schelde-Leie had to do is buy an additional server, configure the Tracks Inspector software on it and plug it into their server rack.
How does this work?
Tracks Inspector has a scalable architecture that supports distribution of evidence processing, storage, databases and user sessions over multiple servers. A stand-alone Tracks Inspector server can be transformed into a multi-server Tracks Inspector solution by just adding a new server. Unlike other digital forensics software Tracks Inspector does not require any additional licenses. The new server announces itself at the evidence controller of the existing system. When the PES requests an evidence storage location, the controller returns the location with the most capacity. As the new system includes 20Tb RAID5 storage, Luc Luyckx has tripled his storage space by just adding one new server. Even better, the CPU cores of the new server are automatically integrated with the existing system to speed up processing and further improve the turn-around time of new evidence.