Notifications
Clear all

i7 or Xeon

16 Posts
8 Users
0 Likes
9,199 Views
Vesalius
(@vesalius)
Posts: 66
Estimable Member
Topic starter
 

So my question for today is, will a top of the line i7 CPU do better for Ripping and Analyzing phones using UFED 4PC or will an Intel Xeon do better?

So let's say an i7 Extreme Proccessor or let's say the 7700k with really good multi-threading capabilities, or an Intel Xeon.

I would like to hear your opinion's on the matter.

 
Posted : 06/04/2017 11:28 am
steve862
(@steve862)
Posts: 194
Estimable Member
 

Hi,

There's quite a price difference when you factor in motherboards as well. I think that an i7 7700K will be plenty for phone analysis, particularly if you read the phone dumps from a fast storage method, rather than mechanical disks.

The Xeon of the same speed will require a more expensive motherboard and is less likely to have M.2 SATA slots in that sort of price range too. The X99 chipset for i7 Extreme will also be pricier but is more likely to have M.2 SATA.

Having looked at resource usage in a few of the phone tools; XRY, Oxygen and UFED PA, there certainly are times when the task being performed is single threaded and so a higher base clock speed will benefit you over more but slower cores. That might make the i7 Extreme CPUs less suitable too.

Steve

 
Posted : 06/04/2017 2:37 pm
(@danielb)
Posts: 30
Eminent Member
 

When last looking at UFED and PC performance a year or two back I did some tests with sample reads and came to the following conclusions

The actual phone read isnt really affected by pc performance

The opening of the file in Physical Analyser was affected alot by cpu performance and also to some smaller degree disk performance.

Report creation was more affected more by disk performance and not that much by cpu.

So an 4c/8th i7 eg i7-7700k or even i7-6700 etc would be a nice sweet spot for both the single and multi threaded decoding involved in opening up a file. Unless you really need the extra features of the z170/z270 boards I would recommend a b150/b250 board or something similar.

Its worth getting a decent sized SSD for general use as well. Theres another debate on how much you will benefit from faster SSD's eg m2 pcie etc however a decent brand Sata SSD such as a Samsung 850 should be your starting point.

 
Posted : 06/04/2017 7:22 pm
MDCR
 MDCR
(@mdcr)
Posts: 376
Reputable Member
 

Building a system with one Xeon processor is a waste of money, as pointed out above the system card can be a bit more expensive than one for a regular i7 processor.

The advantage of the i7 is cheaper and higher clock speeds. The one major advantage with Xeon is that the system card usually can fit more memory, I've seen one setup with 384 GB memory.

The Xeon really flies with a dual/multi processor setup, and multi threaded applications work well since it is built for it. So, if you got an application that wouldn't make use of Xeon hardware, then go with the i7.

 
Posted : 07/04/2017 1:16 am
Passmark
(@passmark)
Posts: 376
Reputable Member
 

I would actually argue that the main benefit of the Xeon is ECC RAM support.
(as clearly you don't need all the extra CPU cores you can get with Xeon, nor the extra RAM, nor the dual CPU support).

But you can get ECC support with the new AMD Ryzen CPUs as well.

 
Posted : 07/04/2017 4:17 am
(@randomaccess)
Posts: 385
Reputable Member
 

The Xeon really flies with a dual/multi processor setup, and multi threaded applications work well since it is built for it. So, if you got an application that wouldn't make use of Xeon hardware, then go with the i7.

I did a bit of testing with single and dual xeon machines and didn't really find a huge speed improvement for the dual.
Better to have a faster disk speed and more RAM

 
Posted : 07/04/2017 5:24 am
MDCR
 MDCR
(@mdcr)
Posts: 376
Reputable Member
 

The Xeon really flies with a dual/multi processor setup, and multi threaded applications work well since it is built for it. So, if you got an application that wouldn't make use of Xeon hardware, then go with the i7.

I did a bit of testing with single and dual xeon machines and didn't really find a huge speed improvement for the dual.
Better to have a faster disk speed and more RAM

And with what did you test it? Was it specifically written for Xeon processors? If not, you get crap performance and it wont matter.

There is a reason why there are 2+ CPU slots on most Xeon boards, they don't add extra CPUs for because someone thinks it would be cool.

 
Posted : 07/04/2017 6:07 pm
(@randomaccess)
Posts: 385
Reputable Member
 

The Xeon really flies with a dual/multi processor setup, and multi threaded applications work well since it is built for it. So, if you got an application that wouldn't make use of Xeon hardware, then go with the i7.

I did a bit of testing with single and dual xeon machines and didn't really find a huge speed improvement for the dual.
Better to have a faster disk speed and more RAM

And with what did you test it? Was it specifically written for Xeon processors? If not, you get crap performance and it wont matter.

There is a reason why there are 2+ CPU slots on most Xeon boards, they don't add extra CPUs for because someone thinks it would be cool.

I tested a few forensic tools commonly used in my lab.
I dont think many forensic tools are written for xeon processors, so yeah pretty much was just testing for multi-core+ram+disk speed. Basically encase6 is ridiculously slow when compared to encase8 and xways (which in some respects were equal, but xways was usually faster). Having all the data on the host ssd also made a massive difference (as expected), even compared to the raid.

As a sidebar, there's also some research into the use of RAMdisks to improve speed even more, but that's only going to be useful for some processes until you can get into the terabytes of ram

I get there's a reason for it, I'm just saying I don't think it's necessary for forensic applications - someone should get a xeon, dual xeon, and i7-7700 and run some tests 😉

 
Posted : 07/04/2017 6:21 pm
MDCR
 MDCR
(@mdcr)
Posts: 376
Reputable Member
 

I tested a few forensic tools commonly used in my lab.
I dont think many forensic tools are written for xeon processors, so yeah pretty much was just testing for multi-core+ram+disk speed. Basically encase6 is ridiculously slow when compared to encase8 and xways (which in some respects were equal, but xways was usually faster). Having all the data on the host ssd also made a massive difference (as expected), even compared to the raid.

As a sidebar, there's also some research into the use of RAMdisks to improve speed even more, but that's only going to be useful for some processes until you can get into the terabytes of ram

I get there's a reason for it, I'm just saying I don't think it's necessary for forensic applications - someone should get a xeon, dual xeon, and i7-7700 and run some tests 😉

Well, there you go. As i have mentioned in another thread, i've written specific program that utilise multicore/multicpu hardware and when you do, Xeon is unbeatable. If you want to read up on why and when you should us Xeon, here you go https://en.wikipedia.org/wiki/Xeon

You can use Ramdisks today to store information you want to write, or as a cache. IMDisk is one free tool you can use - now - to get a RAM device capable of bus speeds. You can also put PCI Express SSD storage devices like Revodrives in Raid0 and get a speed close to the bus speed, i have done it and it is insanely fast. To get the same speed, you need several SATA3 controllers with one SSD per controller in raid 0 to get the same performance.

Putting all this together There is a reason why i don't even look at Encase, FTK or Security Analytics when i've done investigations, my main forensics tool is Visual Studio running on insanely fast hardware. If i need to extract information, i use a specialised tool like Network miner, in all other cases when dealing with any kind of large raw (big)data like DD images, Logs, Pcaps - i write my own multi threaded tools.

This is why i recommend forensics analysts to learn how to code. If you don't know how to code then you are limited to the products capabilities.

 
Posted : 08/04/2017 9:42 am
Vesalius
(@vesalius)
Posts: 66
Estimable Member
Topic starter
 

Well then from what I gathered I got a pretty decent purchase,
————————————————————————————————————-
Operating System
Windows 10 Pro 64-bit
CPU
Intel Core i7 @ 4.20GHz
Kaby Lake 14nm Technology
RAM
32.0GB Dual-Channel Unknown @ 1071MHz (15-15-15-36)
Motherboard
ASUSTeK COMPUTER INC. MAXIMUS IX CODE (LGA1151)
Graphics
HP 24es (1920x1080@60Hz)
4095MB NVIDIA GeForce GTX 1070 (ASUStek Computer Inc)
Storage
476GB Samsung SSD 850 PRO 512GB (SSD)
Optical Drives
TSSTcorp CDDVDW SH-224GB
Audio
Realtek High Definition Audio

————————————————————————————————————-

all I need to upgrade or add is another SSD, prefreabbly M2, or SSD's for grabbing images.

Cheers guys!

 
Posted : 10/04/2017 3:30 pm
Page 1 / 2
Share: