Join Us!

Encase needed specs...
 
Notifications
Clear all

Encase needed specs?  

  RSS
azmatt
(@azmatt)
New Member

I've seen some posts on here mentioning insane requirments for FTK hardware, mentioning an oracle db etc. I know that more is better, but is encase fairly easy to setup and less of a resource monster?

The spec recomendations on there site are beyond out of date.

Thanks,

Matt

Quote
Posted : 14/10/2010 9:49 pm
seanmcl
(@seanmcl)
Senior Member

I've seen some posts on here mentioning insane requirments for FTK hardware, mentioning an oracle db etc. I know that more is better, but is encase fairly easy to setup and less of a resource monster?

It depends upon what you want to do and your mileage may vary. But from my experiences working with both products, I have the following observations.

First, I don't consider the move to Oracle as anything but a practical solution insofar as dealing with the volume of data involved in many cases. One can argue whether Oracle was the best choice, but it seemed clear that the old architecture would soon make processing large cases with FTK impractical.

EnCase is memory intensive as it processes most files, even large files, in memory. Since most current commodity PCs are limited in terms of the total amount of physical memory that they'll support, running EnCase on jobs with many large files may require you to migrate to business-class hardware that supports more memory.

We, typically, run EnCase on systems with 24-32 Gbytes of RAM which gets to be expensive. While most jobs will run very well on systems with 8 Gbytes of RAM, the time to find out that you don't have enough resources is not in the middle of processing a case.

Also, EnCase, currently, has limited support for multi-core processing. With FTK, you can split the data handling between the database server and the case processor which decreases the both processor and IO congestion.

To put it another way, both products are resource intensive, especially when dealing with large files and large volumes of data. I wouldn't assume that just because EnCase does not use an external relational database, it is any less resource intensive for complex cases.

ReplyQuote
Posted : 15/10/2010 12:06 am
azmatt
(@azmatt)
New Member

Exactly what I was looking for, thank you very much.

ReplyQuote
Posted : 15/10/2010 6:38 am
Jonathan
(@jonathan)
Senior Member

We, typically, run EnCase on systems with 24-32 Gbytes of RAM which gets to be expensive. While most jobs will run very well on systems with 8 Gbytes of RAM, the time to find out that you don't have enough resources is not in the middle of processing a case.

What size of datasets are you examining Sean?

ReplyQuote
Posted : 15/10/2010 1:58 pm
seanmcl
(@seanmcl)
Senior Member

What size of datasets are you examining Sean?

Where I find that I need the greatest resources are things like Exchange Servers, Act! contact databases, etc., where a single file may be Gigabytes in size.

Typically we use other tools for things like this but there are occasions where EnCase is perfect for what we are attempting to do.

ReplyQuote
Posted : 15/10/2010 5:59 pm
Share: