Truxton Forensic Rack

The Truxton Forensic Rack is a 7 foot tall rack populated with hardware dedicated to forensic processing. It has a Yellowbrick database appliance, seven dedicated loader/exploitation machines and 1PB of usable depot storage. With everything separated, it gives us many knobs to turn for loading.

Hardware

Here's how the hardware is stacked:

U42	Network Switch
U27	Yellowbrick
U26	Yellowbrick Manager 0
U25	Yellowbrick Manager 1
U23	KVM Server
U22	Keyboard and Monitor
U13	Loader Node 7
U11	Loader Node 6
U09	Loader Node 5
U07	Loader Node 4
U05	Loader Node 3
U03	Loader Node 2
U01	Loader Node 1

Installing Hardware

Normally you won't have to do this but should you want to move the hardware out of the existing rack an into a different one, populate the new rack from the bottom up.

1. Locate Server Node 1
   1. Install the rails for the server into the rack position
   2. Slide the server onto the rails
2. Repeat for the remaining servers working your way up the rack
3. Install rails for KVM
4. Install KVM
5. Install rails for Yellowbrick Management Node 1
6. Install Yellowbrick Management Node 1
7. Install rails for Yellowbrick Management Node 2
8. Install Yellowbrick Management Node 2
9. Install rails for Yellowbrick Server
10. Install Yellowbrick Server
11. Populate Yellowbrick Server with 9 blades
12. Fill the empty spaces in Yellowbrick Server with empty blade enclosures
13. Install rails for network switches
14. Install network switches
15. Add the hundreds of cables

Power Up Sequence

Generally speaking, you start the rack from the top down.

1. Turn on the network switches
2. Turn on the KVM switch
3. Connect the Yellowbrick blades to power then wait for fans to slow/quiet (4-5 mins to boot if blades off for 3+ days).
4. Connect a KVM Crash Cart to Yellowbrick Manager node 0.
5. Power up Yellowbrick Manager node 0 wait 30 seconds.
6. Power up Yellowbrick Manager node 1 wait 3 minutes.
7. Log into Yellowbrick as ybdadmin user using KVM monitor. Run the following command to verify everything is running:

   ybcli system status
   

8. Login to Yellowbrick SMC console from a browser as yellowbrick at your virtual IP YB URL.In the Truxton DB this URL is configured to be http://10.10.182.103. You should see at status OK on the dashboard.
9. Turn on the Servers (7 through 1)

It will take several more minutes for everything to boot.

Software

Installing Software

Prior to software installation, several decisions must be made about where to store things on each node in the rack.

Where are temporary files going to go?

ETL processes may have to write files to a temporary location during forensic processing. This folder should ideally be on an SSD local to the node for speed. However, in your testing, having the temporary folder on the SAN may be fast enough.

Where are the hashsets going to go?

This should definitely be on an SSD local to the server. The hashset files are searched every time a file (a record in the [File] table) is added to Truxon. This will result in several IO operations being performed on the hashset file. Multiply this number of operations by the number of files being added and you can see why these operations must have as little latency as possible. Read/write speeds of the disk are far less important than seek time.

Where are the SOLR indexes going to go?

SOLR indexes are written when content is indexed in Truxton. If you are running the rack as a production server, SOLR should have its own storage volume on the SAN. If you are testing different configurations with the equipment in the rack, have SOLR store its contents on the Scratch drive.

Where are the software installation packages?

There will always be software that you want to install on the server nodes. It is best to put them on the SAN where you can maintain one location accessible by all nodes.

Defaults as Shipped

The Truxton Forensic Rack is delivered with the following defaults:

What	Where
Temporary Files	D:\Temp
Hash Sets	D:\Hashsets
SOLR	C:\Clusterstorage\Scratch\UXX\SOLR
Software Installers	C:\Clusterstorage\SampleData\Rack Management\Software
Databases	D:\Truxton Data\data

Each server node is pre-installed with Notepad++ and dBeaver tools.

Truxton was installed to write data to the D:\Truxton Data folder.

Configuring Software

Now that you have a rack full of equipment to play with, you can test different configurations to meet your needs. The process of re-configuring a server is basically:

1. Stop Trutxon
2. Replace configuration files in C:\ProgramData\Truxton\Settings
3. Start Truxton

Default Truxton Configurations

The Truxton Forensic Rack comes with several different configurations on it. These are stored in folders in the C:\ClusterStorage\SampleData\Rack Management\Configurations folder.