Notifications
Clear all

TD3 Performance

7 Posts
4 Users
0 Likes
1,044 Views
Bulldawg
(@bulldawg)
Posts: 190
Estimable Member
Topic starter
 

I was asked on the Forensic Focus LinkedIn group to test TD3 performance with SSD source and target. I'm so disappointed with the results, I'm posting here too.

First my methodology
-Both target and source drives are 512 GB Samsung 840 Pro SSDs. Prior to testing, I performed a secure erase on the target drive. This is important as it gives the drive empty cells in which to write. Writing to used cells is very slow.
-I turned off verification, but I am still hashing with MD5 and SHA1. I'm also writing to compressed e01 files. Basically duplicating how I'd normally image (but not verify).
-I have a IcyDock 2.5" to 3.5" drive adapter with the target SSD installed in the TDS2. This shouldn't affect performance at all, but I like the IcyDock product, so I'm plugging them here.
-I tested writing to both ext4 and exFAT file systems because exFAT is a recent addition and may not work as well as ext4.

First, performance in a computer.
A properly configured modern computer with AHCI enabled in BIOS will achieve about 500-530MB/s sequential write speeds with a 512GB Samsung 840 Pro. Some sites say 450 MB/s, but with Crystal DiskMark, I'm seeing north of 500 MB/s.

And now for the disappointment.
With the target drive formatted exFAT, the TD3 achieved about 100-103 MB/s during imaging.
With the target drive formatted ext4, the TD3 achieved about 110-112 MB/s during imaging.

I'm getting about 20% of maximum speed through the TD3.

I'd also like to know if anyone can do the same test with a Logicube Falcon. According to Logicube, the Falcon is about 4x faster than a TD3.

 
Posted : 16/08/2014 3:10 am
(@mscotgrove)
Posts: 938
Prominent Member
 

I would do some tests without compression, and without hashing. Both can require intensive processing. With slow hardware, this processing time might be masked by the drive speed. With fast drives, the processing time might be the slowest part of the link.

Start with a raw disk image, then add in hashing, then add in compression.

What type of data did you place on the drive - video/photos etc do not compress well and may slow the process down. Text and blank sectors will compress well, and may help with transfer rates.

 
Posted : 16/08/2014 3:38 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

I would agree with Michael - you really need to take as many unknowns out of the equation as you can when you start benchmarking.

I would forget encase (initially) and write a DD image. I would also try imaging an SSD to fast spinning media and then also do the reverse. I suspect that writing to an SSD rather than reading from it is the issue here, a bit of additional testing might cast more light on the problem and point toward a solution.

 
Posted : 16/08/2014 6:19 pm
Bulldawg
(@bulldawg)
Posts: 190
Estimable Member
Topic starter
 

It appears hashing cannot be turned off, so it always calculates MD5 and SHA1 hashes during imaging. I kicked off a dd image, and it's not going any faster than an e01. It also appears you can't create uncompressed e01 files.

I don't expect to get much faster. The TD3 manual states imaging speeds of up to 7.2 GB/min. (page 6 https://www.guidancesoftware.com/resources/Pages/doclib/Document-Library/TD3-Forensic-Imaging-System-User-Manual.aspx) That equates to less than 123 MB/s.

Writing to an SSD shouldn't be a problem. I've imaged to a secure erased SSD in a computer without trouble. I switched the target to a 2TB WD Black HDD, and the imaging speed went down slightly, but not significantly.

The TD3 just isn't built for speed. It is impressively flexible, but fast it is not.

 
Posted : 16/08/2014 11:58 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

If compression cannot be turned off you will want to 'play' with the data on you input drive.

Is there a difference if you blank your input drive and do a timing test, and then fill it with videos (or similar) and another test.

The compressed E01 files for a blank disk should be very small, and for a video disk, about the size of the disk.

 
Posted : 17/08/2014 3:08 pm
mokosiy
(@mokosiy)
Posts: 54
Trusted Member
 

Bulldawg,
I don't know real perfromance of TD3 on practice. So I would ask you small thing that can be helpful sometimes for those who work much…

Are you sure your target SSD is in full-speed state for writing and doesn't need to be trimmed?

 
Posted : 18/08/2014 11:03 am
Bulldawg
(@bulldawg)
Posts: 190
Estimable Member
Topic starter
 

Yes, I am sure. I performed a secure erase before starting, which trims the entire drive. I also tried imaging to a spinning disk and didn't see it going any faster.

 
Posted : 18/08/2014 5:23 pm
Share: