Forensic Toolkit v3 Tips and Tricks – On a budget

While researching FTK 3X and Oracle, you just recently discovered that the best configuration of your Oracle database would be on a solid state drive (SSD). Solid state drives give the maximum level of performance to Oracle databases and in turn speed up your FTK 3X responsiveness.

You are a conscientious analyst and decide to try reinstalling your database on a SSD. You approach your boss, who is not a techno geek, and ask him to purchase a 256GB high performance SSD:

“Five hundred dollars!! For one drive? In this economy? If I buy in bulk I can get ten Terabyte hard drives for that price; get out of my office and close the door behind you!”

Short stroking

So how do I get close to SSD performance on the cheap? Welcome to the world of short stroking.


Get The Latest DFIR News!

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

With short stroking, you don’t use the entire hard drive for storage. Disks have become so large and cheap that you can use the outer tracks of the disk just for storing data. If you create one partition that is twenty percent, of the total size of the drive, the drive head will travel much less distance. This will decrease your latency and improve your input / output performance, access times, and in all probability, drive wear. If correctly implemented, short stroking creates more than double the throughput in less than half the access time.

By using Fdisk, GParted, or software provided by the hard disk drive manufacturer, you can use only the first few blocks of the disk to limit the number of LBAs (Logical Block Addresses) accessible in your hard disk drive. This limits the drive arm to only the last few tracks of each platter and blocks the use of slower areas of the hard drive. Remember, you will lose access to the part that’s blocked; therefore, it cannot be used to store any data.

Reading from the outside sectors of the platters is faster, as more sectors pass under the heads per second (depending on your drive speed) at 10,000 or 15,000 RPM than towards the middle of the drive at the same speed.

If you do a twenty percent short stroke of a Terabyte hard drive, you will only have 200GB of usable space on the hard drive. You will need to short stoke two Terabyte hard drives, at twenty percent, and assemble them in a RAID 0 array to get 400GB of useable space for your Oracle database. Remember, even though RAID 0 is fast, it is not fault tolerant; be sure to periodically backup your database.

Defragment early, defragment often.

After you have installed your Oracle database on your short stroked RAID 0 array, another performance boost is recognized by defragmenting the drive that the Oracle database resides on. Defragmenting allows for rapid sequential file reads and writes.  It is always best to store file blocks together contiguously (especially in any type of database).

I have created and processed FTK cases, on a clean Oracle database install and have observed up to seventy five percent fragmentation on the hard drive. Before starting analysis, I defragment the hard drive containing the Oracle database and make sure it is at zero fragmentation.

You need to regularly defragment the hard disk drive to ensure all frequently used data is defragmented otherwise; you will lose some of the performance benefits.

Leave a Comment

Latest Videos

Magnet Forensics' Matt Suiche on the Rise of e-Crime and Info Stealers

Forensic Focus 12th January 2023 3:00 am

Just like your current holiday shopping for last minute presents a lot of the good stuff has gone off the shelves already. You reach to the back and find the toy nobody really wanted but it’s the thought that counts, you stare down at Si and Desi’s Holiday Special 2022 podcast. 

Please join these two as they lament over the year that was, discuss all the things they didn’t do but promise they will do them next year, query whether putting a NAS in the storage of a roller door is a good idea, and finally arrive at what they’re looking forward to bringing you in the new year.

Show Notes:

Arduino PLC IDE - https://docs.arduino.cc/software/plc-ide
Mycroft Mark II (open source Alexa) - https://www.kickstarter.com/projects/aiforeveryone/mycroft-mark-ii-the-open-voice-assistant
Christa’s new blog - https://christammiller.com/
Si’s holiday reading - https://amzn.to/3iJyGrR
Desi’s holiday reading -  https://inteltechniques.com/
Strange event for the end of the year - https://www.reuters.com/world/europe/25-suspected-members-german-far-right-group-arrested-raids-prosecutors-office-2022-12-07/
Si’s wishful thinking - https://www.youtube.com/watch?v=GXnRgXclLd0
Si’s list to do before the EOY - https://intrepidcamera.co.uk/products/intrepid-4x5-camera
Desi’s list to do before EOY - https://www.wired.com/story/how-to-reset-your-phone-before-you-sell-it/
“Cleaning your office” - https://www.manfrotto.com/uk-en/vintage-collapsible-1-5-x-2-1m-ink-sage-ll-lb5720/
Conference recorder - https://amzn.to/3UBmre5
Desi’s blog - https://www.hardlyadequate.com/

Just like your current holiday shopping for last minute presents a lot of the good stuff has gone off the shelves already. You reach to the back and find the toy nobody really wanted but it’s the thought that counts, you stare down at Si and Desi’s Holiday Special 2022 podcast.

Please join these two as they lament over the year that was, discuss all the things they didn’t do but promise they will do them next year, query whether putting a NAS in the storage of a roller door is a good idea, and finally arrive at what they’re looking forward to bringing you in the new year.

Show Notes:

Arduino PLC IDE - https://docs.arduino.cc/software/plc-ide
Mycroft Mark II (open source Alexa) - https://www.kickstarter.com/projects/aiforeveryone/mycroft-mark-ii-the-open-voice-assistant
Christa’s new blog - https://christammiller.com/
Si’s holiday reading - https://amzn.to/3iJyGrR
Desi’s holiday reading - https://inteltechniques.com/
Strange event for the end of the year - https://www.reuters.com/world/europe/25-suspected-members-german-far-right-group-arrested-raids-prosecutors-office-2022-12-07/
Si’s wishful thinking - https://www.youtube.com/watch?v=GXnRgXclLd0
Si’s list to do before the EOY - https://intrepidcamera.co.uk/products/intrepid-4x5-camera
Desi’s list to do before EOY - https://www.wired.com/story/how-to-reset-your-phone-before-you-sell-it/
“Cleaning your office” - https://www.manfrotto.com/uk-en/vintage-collapsible-1-5-x-2-1m-ink-sage-ll-lb5720/
Conference recorder - https://amzn.to/3UBmre5
Desi’s blog - https://www.hardlyadequate.com/

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_BhrBg5_sAKo

Si and Desi Holiday Special 2022

Forensic Focus 16th December 2022 12:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...