Bench standards
Bench-grade. What that means.
"Bench-grade evidence" is the practice tagline. It is not a slogan. It is a working standard with consequences. It decides what tools come in the door and what does not.
A report from this practice has to hold up wherever it is read. Insurance carrier. Counsel. Regulator. Court. The first question those readers ask is what tool produced the evidence and whether that tool can be trusted to have produced it accurately. A tool that does not answer that question well puts the entire report at risk, no matter how careful the analyst was.
The false economy
Cheap tools cost more than they save.
Every category of bench instrument has a real version and a clone-with-pirated-software version. Logic analyzers. Oscilloscopes. Programmers. Soldering stations. Microscopes. The clone is twenty to forty percent of the price. People setting up their first bench talk themselves into the clone because the spec sheet looks similar.
It is not similar. Not for evidentiary work.
A cheap logic analyzer with sloppy timing drops samples on long captures. The trace looks complete. It is not. A bench scope with overstated specs misses the transient you needed to catch. A programmer running modified firmware reads chips back unreliably and produces a binary that may not match what is actually on the part. None of these failures are visible in the file you hand to opposing counsel. They show up only as "this evidence does not match what we expected," and you have no way to prove which side is wrong.
When the report is challenged, the chain of custody for evidence runs through the tool that captured it. A specified, vendor-backed instrument with documented accuracy answers the challenge. A clone running pirated software does not. The savings disappear the first time a single capture is contested. The savings turn into a loss the first time a report has to be retracted or rewritten because the underlying capture cannot be defended.
Three filters
What earns a place on this bench.
B.01
Specified accuracy.
Sample rate, timing precision, voltage range, trigger latency, and bandwidth are documented by the manufacturer and citable in the report. When a finding rests on a sub-microsecond timing measurement, the instrument's documented timing accuracy is what makes the finding defensible. A device with no published accuracy spec, or a device whose published spec cannot be trusted, has no place in evidentiary work.
B.02
A vendor that exists.
Real support behind the product. When something breaks, there is a company that answers email, ships replacement parts, and pushes firmware updates that are signed by an entity with a return address. Vendors that back independent researchers and stand behind their instruments are the vendors whose tools earn the work. Vendors that vanish behind a forum post do not.
B.03
Behavior in actual use.
Long captures complete without dropping samples. Software does not crash mid-case. Trigger conditions catch the one-shot event that cannot be re-run. The first cloud handshake of a freshly powered device. The OTA push that disables a refused-consent client. The transient on a power rail that explains why a board failed. Every case has events that happen once, and the instrument either catches them or it does not.
Vendors that earned the place
Tools that meet the bar.
Saleae for protocol capture and logic analysis. Documented timing, software that opens long captures without choking, trace files with provenance baked in. They back independent researchers with real reciprocity, not just marketing copy.
Rigol for analog work. Documented bandwidth, working trigger system, scope display that does not lie about what it sees. The DHO924S sits in the same bench position a Keysight or a Tektronix would in a more expensive shop, and the published accuracy holds.
Weller and JBC for soldering and rework. The WXsmart 2010 and the JTSE-1QB are the two stations that have earned the work this bench does, including BGA and fine-pitch.
Bus Pirate for active bus probing. Open-firmware, vendor-supported by Dangerous Prototypes, trusted across the security research community.
Rabbit-Labs for bench supplies and probes. Small-shop posture, real product, real support, and they back the work the same way Saleae does.
Halehound for fixturing and custom rigging. Independent product done right.
Swift for component-level optical inspection. Real stereo microscopy, real working distance, photographs that survive transmission into a report.
XGecu T76 for chip programming, hardened for case work. Modified to keep its phone-home shut down, network-locked, used inside the practice's controlled bench rather than connected to vendor cloud.
Dell cluster for the compute side of analysis. Owned hardware, in-house racks, no rented cloud holding case material.
Built in-house
When the right tool is the one we make.
Some bench infrastructure is built rather than bought. Vendor catalogs do not stock every shape the work requires, and the off-the-shelf option is sometimes engineered for a different problem. When that happens, the right answer is to build the tool to spec.
Shielded RF enclosure. A 36-inch cube TIG-welded from half-inch steel plate. Continuous welds at every seam so the chamber does not leak at the joints. Copper waveguide-below-cutoff feedthroughs for power penetration, sized so that any RF coupled to the conductors inside cannot propagate out and external RF cannot leak in. Hand-access port sized to permit in-chamber manipulation while functioning as another waveguide-below-cutoff aperture by virtue of being small relative to the wavelengths of interest. Built to provide forensic-grade isolation for phone-home behavior testing, where the load-bearing argument is what a device does with the network connection versus without one. Devices under test can be evaluated under controlled RF denial conditions to verify behavior when the phone-home channel is unavailable.
The chamber is one piece of in-house infrastructure. The compute cluster is another. The bench rigging that holds delicate captures stable is a third. None of these need a vendor logo to be credible. They need to be built right, documented, and used consistently across cases.
The cost of getting it wrong
A bench cuts both ways.
You can save four hundred dollars on a logic analyzer. You can lose ten thousand dollars on the case it fails. Worse, you can write a report that gets thrown out and damage a client's position in a dispute they relied on you to prove. The downstream cost of a cheap bench is paid by the people who hired you to do the work right.
The bench is the foundation of the practice. Cutting cost on the bench cuts the foundation of every report that bench produces. That is why the equipment list is what it is, and why the trust panel on the home page reads as honest credit to the vendors that earned a place rather than a logo wall.
Real tools. Real evidence. Real reports.