±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35965
New Yesterday: 0 Visitors: 281

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Observations on SSD RAID for forensic workstation

Discussion of forensic workstations, write blockers, bridges, adapters, disk duplicators, storage etc. Strictly no advertising of commercial products, please.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Bulldawg
Senior Member
 

Observations on SSD RAID for forensic workstation

Post Posted: Aug 20, 14 01:10

I've been playing with my SSDs lately. (See here for a discussion of TD3 performance using SSDs. This is more of a comment on TD3 performance than on the SSDs themselves.) My next target was to test the relative performance of an SSD RAID array when the drives were dirty and when they had recently been secure erased. I've always known I had to perform a secure erase on the SSDs in a RAID to avoid performance issues, but I've never tested how much of a difference it makes. For the benefit of everybody, I'm sharing my results.

Background:
Except for limited situations, SSDs used in a RAID configuration are unable to perform TRIM operations because the operating system cannot communicate directly with the SSD to inform the controller which cells are no longer needed. Writing to cells that contain data is significantly slower than writing to empty cells, so this has a profound impact on performance.

Setup:
I have just one workstation with an SSD RAID, but it is a nice one. The RAID card is an Intel RS25DB080. The card has two arrays attached: a RAID 5 array of four Western Digital WD2000FYYZ (2TB enterprise drives) and a RAID 0 array of four Samsung 840 Pro 512 GB SSDs. The SSD RAID is only for temporary storage when speed is critical such as EnCase Evidence Cache storage.

I am testing using Crystal Disk Mark. It's not the best drive testing tool, but it works pretty well and is free. It'll give us a good idea of the relative speed of the drives. Also, I'm only running one pass in each test. The RAM on the RAID card must be interfering with my tests because running multiple passes of the same test gives odd results. I'm paying attention mostly to the sequential read/write performance. The 4K random doesn't really apply in my use case since most files are much larger than 4K. The 512K random is a little better test, but 512K is still a pretty small file for what we're doing.

Comparisons:
First, let's see how fast a single Samsung 840 Pro 512 GB tests. This is the system drive on another computer, but since it's connected directly to a SATA 6 GB/s port, it can do TRIM properly.


Second, here's the test results of the RAID 5 HDD array attached to the same computer as the SSD RAID. It's not fair comparing RAID 5 to RAID 0, but I'm not moving the data off the HDDs for this test, so sorry. This is a good RAID card and RAID 5 shouldn't suffer as much of a performance hit as lesser cards. It's a 4 disk array, so you still have three drives' write performance combined, in theory.


Now for the SSD RAID:
This is the test in what I call the "dirty" state. It's had more data written to it than the capacity of the drives since the last secure erase, so the write performance of the array should be compromised by dirty cells.


Notice that read speed! More than 1.7 GB/s. Write performance is obviously suffering as it barely manages to best the single SSD with TRIM enabled.

And finally the freshly wiped SSD array. I did change the stripe size from 256K to 512K when compared to the dirty test. Nevertheless, check out the difference in write performance:


That's more like it. Almost exactly four times the performance as seen from the single SSD, which is theoretically what we should see.

Conclusions:
Before you ask, yes, processing on this computer is noticeably faster than computers that only have HDD RAIDs. I have not run a side-by-side comparison yet, but I plan to in the future. I'll post here when I have those results.

Secure erasing an SSD is a quick process. We have a Drive Erazer. All we have to do is remove the SSDs from the drive cage and initiate a secure erase with the Drive Erazer. It takes about 30 seconds to secure erase these SSDs. Rebuilding the RAID actually takes longer with getting into the card's BIOS, etc. If you have a RAID array with SSDs, it is definitely worth doing this after a significant amount of data has been written to the array.

Also, an array of SSDs is substantially faster than an array of HDDs. Exactly how much, I can't be sure, but you'd need a heck of an HDD array to match a nearly 2 GB/s read and write speed I'm getting from just four SSDs.  
 

Page 1 of 1