Digital Evidence St...
 
Notifications
Clear all

Digital Evidence Storage Ideas (Encase 7 Specific)

14 Posts
6 Users
0 Likes
1,168 Views
(@jemfrench)
Posts: 9
Active Member
Topic starter
 

Hello,

Just wondering how other members store and backup there digital evidence? Mainly E01 and E01X files.
Currently our plan was build a hardware raid setup which would be connected to 2 workstations via Infiniband 20GBPS ports.

Specs

RAID
8 x 2TB HDD Hardware RAID 6
Infiniband 2 x 20GB/s ports

Workstation 1 (ENCASE 7 PROCESSOR)
Evidence Cache- 2 x 512GB SSD'S Raid 0
Evidence Storage- 2 x 2TB HDD Raid 0
Infiniband 1x 20GB/s ports

Workstation 2 (ENCASE 7)
Infiniband 1 x 20GB/s port

We currently use the Tableau TD3 for evidence collection. The plan is to transfer the collected evidence from the TD3 to Workstation 1 for processing. Once processed the evidence would be packaged and transferred to the RAID. When the examiner is ready to examiner the evidence he/ she will access the evidence straight from the RAID. Once the case is closed the evidence and all associated files will be achieved to tape.

It is hoped that the RAID will produce around 600-800MB/s which the Infiniband should cope with easily. All HDD will be WD Black Drives.

I look forward to your thoughts and opinions

Regards

Jem

 
Posted : 26/09/2013 6:33 pm
(@agbarnet)
Posts: 75
Trusted Member
 

That seems incredibly robust. What kind of price range are you looking at to create a setup like that?

 
Posted : 29/09/2013 8:48 pm
(@jemfrench)
Posts: 9
Active Member
Topic starter
 

Hoping to build the whole setup for £2500-£3000 what's your thoughts?

 
Posted : 30/09/2013 1:00 am
Chris_Ed
(@chris_ed)
Posts: 314
Reputable Member
 

My main thought is how many cases do you work on at once? If you're Police, 16TB will not get you far.

 
Posted : 30/09/2013 11:44 am
(@jemfrench)
Posts: 9
Active Member
Topic starter
 

Hello thanks for your response, We are a small company and don't deal with to many case's per month. We are hoping 16TB (12TB RAID 6) will last us 8-12 months. The RAID can be expanded but its not a fun exercise. We hope to expand by 8 TB per year and replace all drives when their warranty's lapse every 5 years.

Once a case has closed with with archive to tape.

Jem

 
Posted : 30/09/2013 1:43 pm
(@jemfrench)
Posts: 9
Active Member
Topic starter
 

Hello thanks for your response, We are a small company and don't deal with to many case's per month. We are hoping 16TB (12TB RAID 6) will last us 8-12 months. The RAID can be expanded but its not a fun exercise. We hope to expand by 8 TB per year and replace all drives when their warranty's lapse every 5 years.

Once a case has closed with with archive to tape.

Jem

 
Posted : 30/09/2013 1:45 pm
(@jemfrench)
Posts: 9
Active Member
Topic starter
 

Hello thanks for your response, We are a small company and don't deal with to many case's per month. We are hoping 16TB (12TB RAID 6) will last us 8-12 months. The RAID can be expanded but its not a fun exercise. We hope to expand by 8 TB per year and replace all drives when their warranty's lapse every 5 years.

Once a case has closed with with archive to tape.

Jem

 
Posted : 30/09/2013 1:46 pm
EricZimmerman
(@ericzimmerman)
Posts: 222
Estimable Member
 

I love my synology devices. Robust, fast, and expandable.

 
Posted : 30/09/2013 6:04 pm
Bulldawg
(@bulldawg)
Posts: 190
Estimable Member
 

I love my synology devices. Robust, fast, and expandable.

That's great to hear. I'm about to buy a Synology RS2212+ to get me into the "now." (as a co-worker used to say) Any pitfalls or comments about initial setup? I'm buying the RAM upgrade to bump it to 3 GB, and I plan to install 6x 4TB drives to start configured in RAID 6. I'm also planning to use Link Aggregation to, hopefully, get 2Gbps throughput.

How has it been adding drives to an array? I think 16TB should get me through a year or so before I need to add drives, but I don't want to be down for a week while the array rebuilds when I do it. If it's too much of a pain to add drives to a RAID 6 array, I'll just fill all 10 bays now and call it good until I need the RX1211 expansion.

 
Posted : 30/09/2013 10:51 pm
EricZimmerman
(@ericzimmerman)
Posts: 222
Estimable Member
 

i have one of those and a 3431xs.

both are great the of course the 3431 is faster. i went with all 3 TB disks in one large pool and then cut it up as needed/expand as the slices fill up. this works wonderfully. you can watch the share get larger in real time if you map it to a drive letter in windows.

i used their 2 disk protection mode vs any classical raid setup (my chassis hold 10 disks each).

once all the drives are in you basically create the pool and it does the rest. then you carve out slices as need be in a variety of formats.

it is my understanding if you start with 10 disks at capacity A and get things going you can hot unplug one of those drives and replace it with a bigger one. then you wait while the device repairs itself. you do this until all your capacity A drives are replaced and you have zero downtime.

this is another reason to NOT use a classic raid setup. think of the synology raid tech in a similar manner to ZFS. its an expandable pool of storage vs "All disks all the same all the time." you can even mix and match capacities.

in my case i did all 10 bays in both (the 2212 backs up the 3431 primarily) using 2TB hard drives. i made one giant pool in each vs several smaller pools.

i use link aggregation too against SMC tigerswitches and it works fine.

works great and i havent had even an hour of downtime. once you get them set up (which is easy), they just work.

 
Posted : 01/10/2013 12:29 am
Page 1 / 2
Share: