±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34714
New Yesterday: 0 Visitors: 246

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

forensics workstations and supercomputer ?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3  Next 
  

Re: forensics workstations and supercomputer ?

Post Posted: Tue Aug 07, 2018 6:10 am

You love mocking people and hiding it between technical details don't you? Very Happy
Some computers you have there, we should get some of them too.
_________________
"Simplicity is the ultimate sophistication." 

calimelo
Senior Member
 
 
  

Re: forensics workstations and supercomputer ?

Post Posted: Tue Aug 07, 2018 7:23 am

- jaclaz


Hmmm, I beleive you have some dates (or disk capacities) off. Shocked

6 years ago (circa 2012) there were NO 6 Tb hard disks (that were announced end of 2013, actually available in 2014) , let alone 8 Tb (announced in second half of 2014 actually shipped later in 2014 or beginning 2015) .
Same goes for SSD's, AFAICR first 1TB ones were 2011-2012, but 2 Tb ones were 2013, possibly a bit later on the market.

jaclaz


So more specifically, we have used Lenovo machines for 6 years, in various incantations, for the 6 year period. We work on a 3/4 year refresh rate, so we started with a machine (not a P920, possibly D30) then required some more machines (for new staff etc.) and had some P900 and some P910's. Originally the machines had 2TB and 4TB disks with 1TB SSD's. These have been upgraded/refreshed as we replaced old hard disks/ordered new machines. At some point we were using 4TB and 6TB's before upgrading to 6 and 8TB drives. In most cases the larger drives became the smaller drives in the new configuration. Though specifically I am speaking about the reliability of the machines over the disks, as the disk reliability varies by brand etc.

Overall, we have had few issues with all the Lenovo builds we have had over this 6 year period. All of the original machines are still working in our unit, although most have been 'retired' to other processing/tasks rather than main machines for investigators.  

minime2k9
Senior Member
 
 
  

Re: forensics workstations and supercomputer ?

Post Posted: Tue Aug 07, 2018 8:25 am

- calimelo
You love mocking people and hiding it between technical details don't you? Very Happy
Some computers you have there, we should get some of them too.

Naah, I am not hiding at all, only stating facts out of my personal experience.

Surely the people making (and selling) servers love to hint that non-servers (including the workstations they themselves sell) are not designed for continuous use (and very likely this is accurate), still actual hardware sometimes is much better and lasts longer then what the designers expect.

Many, many years ago (circa 2002/2003), I had this problem to solve, a couple machines that needed to operate 24h 7/7 (think of something like a Pos, no actual need for "computing power") with no or little maintenance.
Previous attempts (using normal motherboards) had failed mainly because of one thing: dust (stops/crashes due to processor overheating).
So I bought a bunch of VIA Epia motherboards with passive cooling and voilà no more issues with machines stopping because the dust crippled the processor heatsink and its fan.
OS Windows NT 4.0 (and later Windows 2000), never (and I mean never) had any BSOD's, if not due to some hardware issue, that were mainly of two kinds:
1) failed hard disks (they were PATA/IDE), let's say one failure per machine every 4 or 5 years
2) failed PSU's (I foolishly originally chose some smallish case that used non-standard form size PSU's), let's say one failure per machine every 3/4 years, until I bought a few 1U (Rack Server Wink ) PSU's and *somehow* fitted them and never had another issue with PSU's after.

These machines were decommissioned recently (2017) after 14 or 15 years of continuous service, maybe I have been lucky, and surely those Epia mainboards were not at the time as cheap as "normal" motherboards+CPU, but they were not that much more expensive AFAICR, maybe some 10-15% more expensive.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: forensics workstations and supercomputer ?

Post Posted: Tue Aug 07, 2018 10:47 am

I recommend considering the following setup:

1) A server with as much RAM as one can afford, with an SSD drive for the operating system and dual Xeon processors with as many cores as one can afford. As many USB 3.0 or eSata ports as possible.

2) An External Hard Drive SATA Enclosure Docking Station USB 3.0 connected to the Server. The docking station will hold raw SATA drives holding your forensic images.

3) A Synology Disk Station DS1815+ 8‑Bay Diskless NAS Server with 1TB SSD drives x 8 to hold databases.

One can very easily connect the Synology NAS to Amazon Glacier storage for offsite disaster recover.  

UnallocatedClusters
Senior Member
 
 
  

Re: forensics workstations and supercomputer ?

Post Posted: Tue Aug 07, 2018 4:14 pm

Is password cracking your only concern? Can't high performance GPU boxes be rented from some cloud provider?

If i built a new forensics workstation today, i'd get a Xeon based box with PCI Express SSD drives for awesome IO performance, at least 64 gigs of ram (more preferably if budget allows), lots of harddrive space (in raid), lots of expansion/connectivity options, Drive analysis software, VMWare workstation and PCAP parsing abilities, backup solution/separate storage server.

But that's just me thinking on versatility. I used to write multithreaded applications that could use Xeon based processors quite effectively, it is far from normal that forensics programs can utilize Xeon based systems though.  

MDCR
Senior Member
 
 
  

Re: forensics workstations and supercomputer ?

Post Posted: Sat Aug 18, 2018 11:23 pm

thank u all for this useful info .... special thanks for jaclaz Smile  

qassam22222
Senior Member
 
 
  

Re: forensics workstations and supercomputer ?

Post Posted: Sun Aug 19, 2018 1:12 pm

The real question behind could be how to crack aes256, just the OP maybe didn't want to ask this publicly Smile

The answer is: you don't crack eas256, no matter how much you would invest in workstations, servers, gpu clusters, etc. You play the lottery, that's it Smile
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 

passcodeunlock
Senior Member
 
 

Page 2 of 3
Go to page Previous  1, 2, 3  Next