Notifications
Clear all

mac pros for f lab?

23 Posts
16 Users
0 Likes
1,571 Views
(@bithead)
Posts: 1206
Noble Member
 

Really pretty open ended questions. What software are you using? Can you deal with the minor issues encountered when running an OS in emulation? Are you doing Mac forensics? Are these machines restricted to the lab? Do you want the drive bays in a extra large case like the FRED or is the Frankenstein approach more what meets your needs. Are you going to network your lab and place the cases on a server or SAN? If you are networking are you comfortable with setting up Mac security?

Pretty tough to answer the original question without at least a few more parameters.

 
Posted : 23/04/2008 2:29 am
tabz
 tabz
(@tabz)
Posts: 19
Active Member
 

I use both standard PCs and a MacBook Pro (running WinXP). I find the MacBook Pro very fast in the data acquisition phase. By using onboard FireWire 800 via Tableau WriteBlocker and acquiring to an external SATA HDD via eSata ExpressCard I am able to acquire a device around 20% faster than on my previous notebooks.

When it comes to analysis, in my experience, nothing beats a PC with regards to speed and flexibility. Some benefits are being able to install removable HDD bays, additional ports, and just raw processing power.

Really depends on the type of work you will be performing, but if its a lab situation where you're performing analysis, my feeling would be PCs are the safest (and cheaper) way to go.

 
Posted : 23/04/2008 5:21 am
(@ronanmagee)
Posts: 145
Estimable Member
 

Hi guys,

we purchased some mac book pros and were are using the following setup
- Dual boot using boot camp (Win XP)
- VMWare 1.1.3
- Encase 5.05j with compression set as NONE
- Tableau SATA write blocker

I tried imaging a 40GB Western Digital (Model WD400BD-60JPA0) SATA HDD over different ports and have the following times
Mac book VMWare (USB2.0)- 2hrs 35mins
Macbook Bootcamp (USB2.0) - 1hr 35mins
Macbook Bootcamp (FW800, daisy chain tableau to evidence drive) - 0hrs 37mins
Lenovo T60 (USB2.0) - 1hr 23mins

Has anyone got similar speeds or any tips on improving the speed using VMWare? Firewire is not supported in VMWare, but Bootcamp supports it. We imaged using Firewire 800 using a daisy chain (as the mac book has only one FW800 port) - has anyone added an Expresscard and seen any improvement in time compared to using one FW800 port?

Regards,

Ronan

Ronan

 
Posted : 01/07/2008 7:21 pm
Webbie
(@webbie)
Posts: 29
Eminent Member
 

I personally would forget Bootcamp in its present form, VMware Fusion gives the ability to use the 'power' of the Mac Pro whilst examining a Windows machine via VWware.
You can run most if not all window apps in VWware Fusion, and the new version (currently in Beta) has the ability to use multi screens.
Mac Pros are the way forward
Regards
Paul

 
Posted : 01/07/2008 8:10 pm
(@kovar)
Posts: 805
Prominent Member
 

Greetings,

I have a MacBook Pro and use it heavily. I still use something else to do my imaging with because VMware cannot use the Firewire port or the eSATA ExpressCard which means that we're stuck with the USB port for imaging. BootCamp can use the Firewire port and so you might not want to forget about it just yet.

Also, if you're going to use VMware, max the RAM out. My system thrashed until I did so.

Finally, if you really want to do analysis, I'd get a desktop machine rather than a MacBook Pro. You can put a lot more resources into the desktop system. I use the MacBook Pro for field analysis, note taking, research, prototyping, and the like but the real analysis is done on a big Dell desktop with 2TB of internal RAID, 8GB of RAM, and two dual core CPUs.

-David

 
Posted : 01/07/2008 8:27 pm
(@ronanmagee)
Posts: 145
Estimable Member
 

Hi Paul,

Thanks for your reply. Having used VM Ware Fusion my tests to date clearly show it is slower at imaging a drive when compared to other systems and it does not support firewire. Imaging is an important task that I would like to complete as quickly as is possible so that I don't waste time onsite. I'd like to know what you mean by using VMWare to harness the 'power' of the Mac Book Pro.

I aim to use the mac book onsite, and only for imaging, with previewing the data but no actual analysis, this is done in the lab on dedicated desktop machines.

 
Posted : 01/07/2008 8:34 pm
Webbie
(@webbie)
Posts: 29
Eminent Member
 

I'd like to know what you mean by using VMWare to harness the 'power' of the Mac Book Pro.

I aim to use the mac book onsite,

The Mac Pro – Not Macbook Pro.
I agree with your views re on-site, however the original question, I believe referred to setting up a Lab.

 
Posted : 02/07/2008 7:26 pm
(@datawiz77)
Posts: 7
Active Member
 

I tried imaging a 40GB Western Digital (Model WD400BD-60JPA0) SATA HDD over different ports and have the following times
Mac book VMWare (USB2.0)- 2hrs 35mins
Macbook Bootcamp (USB2.0) - 1hr 35mins
Macbook Bootcamp (FW800, daisy chain tableau to evidence drive) - 0hrs 37mins
Lenovo T60 (USB2.0) - 1hr 23mins

Did you try to image the drive in OS X using dd? The time for that would be interesting.

 
Posted : 02/07/2008 7:46 pm
(@bithead)
Posts: 1206
Noble Member
 

Imaging is an important task that I would like to complete as quickly as is possible so that I don't waste time onsite.

We use the Logicube Talon or Forensic MD5 just because of the speed.
"The Talon® simultaneously images and verifies data at up to 4 GB/min."

I am also testing the ICS Solo-3 (because of the Mac option).
"With multiple data acquisition features such as IDE, Notebook and Serial ATA hard drives, plus Flash Cards and USB and FireWire connection, the IM Solo-3 can now capture data from SCSI hard drives in a transfer rate exceeding 4GB/Min."

 
Posted : 02/07/2008 8:02 pm
Webbie
(@webbie)
Posts: 29
Eminent Member
 

Did you try to image the drive in OS X using dd? The time for that would be interesting.

Try dcfldd

 
Posted : 02/07/2008 8:20 pm
Page 1 / 3
Share: