pt.1 OCFA Installation - Introduction/OS

The installation document for the Open Computer Forensic Architecture was mostly accurate. However, I ran into some issues. Posts labeled OCFAInstall are supplements to the OCFA on Debian installation documentation which can be found (once OCFA is downloaded) in 'ocfa/doc/usage/install/HOWTO-INSTALL-debian-etch.txt' - Direct download links, a bit more detail in some areas, as well as some troubleshooting advice to issues I ran into is given.

At the time of this writing OCFA 2.1.1 is the current version.
Installed on Debian 40r7
Installed on Debian 5.0

OCFA homepage
OCFA Project Page [Downloads]
Join the OCFA project mailing list

Debian 4.0r7 (etch) - The netInstall version has been removed. You'll have to get the full version, or...

Get Debian 5.0 (lenny) Tested on Feb. 19, 2009 to work with OCFA.


Operating System
As suggested by the OCFA installation instructions, I am using the newInstall version of Debian. The target machine must be able to connect to the internet to download required packages. If this is not an option you can download the larger Debian install CD/DVD (650MB - 4.4 GB), however they may not contain all required packages. In that case you will need a way to download and transfer the packages to the target machine.
You can manually look for Debian packages at packages.debian.org

Hardware
The suggested hardware is at least a 40GB internal disk, and some sort of SAN or RAID system with 1+TB of storage, and at least 2GB of memory.

That being said, these are recommendations for production servers. I am testing, and know I will not be processing real-world amounts of data. Because of this I can say that, for me, a virtual machine with a total of 40GB storage, and 2GB of memory has worked very well for my purposes. *The VM was originally assigned 512MB of memory, which was much too little and eventually caused errors.

Debian InstallThe Debian netInstall is... rediculiously easy. There are really only three things I can suggest here:
1) To avoid future confusion, don't name your machine simply 'OCFA'. Try 'OCFAServer' or the name of a greek god.
2) Do not create a user named 'OCFA' - one will be created automatically later.

3)The hardest part of the OS install is the partitioning. To partition the drives as suggest by the install documentation, do the following:

On the 'Partition disks' screen - scroll down to the 'Manual' option

Scroll down and find your disk - mine is IDE1 master (hda) - you may have more than one. If so start with the disk you want to install the operating system on.

In my case, there are no partitions. When you select the device, you will be asked if you want to partition the entire device. Say yes. This produces a primary partition equal to the size of the device.

Now select the newly created partition (FREE SPACE), and select 'Create New Partition'

The installation documentation suggests the following setup:

1 2GB swap
1 /boot 200 MB ext3
3 /var/log 10 GB xfs
4 / remaining xfs

Starting with the swap space - enter '2 GB' in the 'New partition size' box

Hit 'Continue' - for partition type choose 'primary' - for Location choose 'Beginning'

Now scroll to 'Use as' and hit enter: This is where you set the file system (xfs, ext3, swap).
Scroll down and choose 'swap area'. Once done, scroll down to 'Done setting up the partition' and hit enter.

You are now back to the Partition disks main menu. Repeat the same process for the remaining suggested partitions (and any extras you may have)

The final result should look similar to the following screen shot. Due to a small drive, I do not have a separate partition for /var/log.

Hit 'Finish partitioning' th
e 'write changes to disk', and your partitions are done.

In the Software selection section I chose 'DNS Server, File Server and Standard System' - I don't think there is really a need for a Desktop environment, unless you are using this as a workstation as well.

After the installation of GRUB the system will reboot, and you should have a working Debian install ready for OCFA.


See pt.2 OCFA Installation - Prep and Building