Quicker Forensic Im...
 
Notifications
Clear all

Quicker Forensic Imaging?  

Page 4 / 5
  RSS
paul_mcms
(@paul_mcms)
New Member

all due respect if you can leave anything behind……..this is designed to cut the most precious to all - TIME (especially now you can get 6tb drives) If you are in situations where time is of the essence then this is for you. I have heard horror stories of leaving vital evidence behind because current systems are too slow to capture the required image. Our system will beat everything. I conducted a demo last week and the client did not believe the speeds on my demo laptop. He pulled out a tower PC and plugged it in. The linux machine was booted and 320GB imaged in 70 mins, no drive removed, (SHA 1). Needless to say placed an order.

ReplyQuote
Posted : 24/05/2014 1:50 am
jaclaz
(@jaclaz)
Community Legend

I have heard horror stories of leaving vital evidence behind because current systems are too slow to capture the required image.

Which is fine, of course, as I have also heard them ) , but also many selling stories *like*

Our system will beat everything. I conducted a demo last week and the client did not believe the speeds on my demo laptop. He pulled out a tower PC and plugged it in. The linux machine was booted and 320GB imaged in 70 mins, no drive removed, (SHA 1). Needless to say placed an order.

jaclaz

ReplyQuote
Posted : 24/05/2014 3:33 am
paul_mcms
(@paul_mcms)
New Member

Lots of negatives on here. We have a new capability to tackle increased data sizes. Inbox me if people are genuine and would like to move with the times. Cheers.

ReplyQuote
Posted : 25/05/2014 4:36 pm
jaclaz
(@jaclaz)
Community Legend

Lots of negatives on here. We have a new capability to tackle increased data sizes. Inbox me if people are genuine and would like to move with the times. Cheers.

Nothing "negative", only trying to separate the wheat from the chaff.

Not that doubting about people being genuine or hinting they may be not able or wanting to move with the times is particularly "positive thinking" BTW.

I don't think that the request of providing some more complete info on the hardware involved (as opposed to "a tower PC" or "my demo laptop" or "the linux machine") is asking that much, but of course you are perfectly free to not provide them ) .

Again, I have no doubt whatever about the tool being a nice one and about it being very fast, as you say, I would only like to understand how much faster it is when compared with other tools.

jaclaz

ReplyQuote
Posted : 25/05/2014 6:47 pm
PaulSanderson
(@paulsanderson)
Senior Member

I would like to see some further supporting information too.

As I see it there are three potential points of bottleneck when imaging 1) the speed of the source drive, 2) the throughput of the imaging system, 3) the speed of the destination drive(s).

If 1 is your bottleneck then 2 and 3 become irrelevant
if 2 is your bottleneck then 3 is irrelevant

obviously part of the picture is how 1 is connected to 2 and 2 to 3- but if you are imaging an IDE/sata drive then this is defined for us, in the case of this imaging equipment the conenction to the destination drives is flexible and multiple.

3 only becomes the bottleneck when you can suck data off 1 and push it through 2 faster than 3 can cope.

The only bit of this chain that is out out of our control is 1 and generally by definition if we connect directly the interface cable to 2.

Our goal is always to make 1 the bottleneck

The throughput of 2 will be defined by the operating system, processors and what we do before we spit the data out to 3 (MD5/Sha1/compress).

The performance of 3 is defined by its inherent speed and that of the interface, but also by what we write. If we compress data as we write it then we write less data and as long as the compression algorithm does not cause a bottleneck at 2 then this would/could shift the bottleneck back to 1.

The performance of 3 is also determined by how we write data - if 3 is FAT formated for instance (I know this is unlikely) then as data is written a FAT chain would be updated. There are ways around this - a sparse file could be created and a contiguous disk space allocated big enough for the entire image which would stop the allocated space growing incrementally. Writing to a raw device, i.e. ignoring any operating system would be better still - essentially disk to disk cloning.

All this has been done for many years, and other than writing to multiple devices (which is effectively achieved by writing to a RAID array) the only thing i see that makes this system different from any other is that you effectively have an array of disparate devices connected via different interfaces.

I would be very interested in seeing how this system performs against a similar hardware setup with a RAID array as a destination.

ReplyQuote
Posted : 25/05/2014 8:42 pm
C.R.S.
(@c-r-s)
Active Member

My business conducts some "tactical" acquisitions, and these days we always expect multi-TB installations. Therefore I read this thread carefully, and "beat everything" seems to be a very tough statement to me.

Our goal is always to make 1 the bottleneck

What makes me curious in my opinion, we've always been doing this close to the red line - the physical specifications of the source. Any competitor does pretty much the same.

How could I or the rest of the industry get away faster, if the tool doesn't magically suck the data out of the source?

When confronted with 3-6 TB drives, we won't switch from customized RAID stations to a laptop with a bunch of USB drives. And there are a few good reasons to remove source drives and not to power up anything else, no matter what acquisition options you have.

A little contentious question Does this tool provide any advantage to someone who already uses adequate equipment for what he does?

ReplyQuote
Posted : 25/05/2014 9:21 pm
bshavers
(@bshavers)
Active Member

Like a little kid, I like new toys. Forensic 'toys' are included.

I hope that I never came across as negative to anyone's work and efforts. Innovation, creativity, and the time involved to develop anything is a worthwhile endeavor and I respect everyone who creates things. Anytime I hear news of something new and better, I just can't wait to hear more about it. As I said, I'm like a little kid and things that go fast are cool.

For this new imaging system, I just don't know exactly where it will fit yet, and I think that is what several posts are asking. Where and when does this tool work compared to what exists today.

For me, any approach to a situation (data collection, scene seizure, etc…) requires me to choose the tools I have at hand that fit the situation in front of me.

Situation 1 Tools A, B, and E will work. Tools C, D, and F will not.
Situation 2 Tool H works. Tool B might work. Others tools will not.
Situation 3 Tools A-H work.
etc..

The situations are more varied than the tools. Macs, ultralights, servers, *nix machines, mobile devices, image allowed vs no imaging allowed, time unlimited vs restricted time frame, one machine vs a hundred, and so forth.

What I don't know is where this tool fits only because I haven't seen it. If it is as fast as advertised, does it come in black? https://www.youtube.com/watch?v=1stc_pAf1V0

ReplyQuote
Posted : 25/05/2014 9:52 pm
mscotgrove
(@mscotgrove)
Senior Member

Was the 70 mins for a newish disk without much data, or for one full of video/jpegs/docx/zip files?

I would like to know how much the time changes with data.

ReplyQuote
Posted : 25/05/2014 9:55 pm
jaclaz
(@jaclaz)
Community Legend

What makes me curious in my opinion, we've always been doing this close to the red line - the physical specifications of the source. Any competitor does pretty much the same.

How could I or the rest of the industry get away faster, if the tool doesn't magically suck the data out of the source?

Endochronicity applied to forensic imaging? 😯
http//en.wikipedia.org/wiki/Thiotimoline
wink

jaclaz

ReplyQuote
Posted : 26/05/2014 1:07 am
Adam10541
(@adam10541)
Senior Member

Well after reading all that I'm thoroughly dissapointed to say the least.

I find it very odd that the original poster wouldn't disclose anything other than the fact it was very fast after his visit for the "test", and then his next two posts read as if they were copy and pasted from promotional material.

The cynic in me thinks there is some linkage between the OP and the software company, but that's just me I tend to be suspicious by nature )

If it were me, the very first thing I would have posted after the testing was the fact that the speed gains were only possible by attaching multiple destination drives via USB to the device. It took some clever searching from another member to disclose that fact as neither the OP or the vendor were willing to talk about that.

What I want to see is a real world 1 to 1 test against the other forensic tools to gauge it's real speed, ie one source, one target. If I have to carry around dozens of USB drives to take out to jobs then this becomes a logistical nightmare.

On a personal note deceptive promotion of software by this method really annoys me and instantly makes me not want to try the software. If you have something you want to promote then by all means make us aware and be prepared to answer questions and be up front. You may find you get the support you want and even some valuable input.

ReplyQuote
Posted : 28/05/2014 6:36 am
jaclaz
(@jaclaz)
Community Legend

…. but that's just me I tend to be suspicious by nature ).

You may want to choose a career as investigator wink .

jaclaz

ReplyQuote
Posted : 28/05/2014 2:50 pm
markl1975
(@markl1975)
Member

Hello,

I am the OP. I didn't think this post would have this much interest when I posted, and I should point out I'm not with the vendor. I've been a FF member for nearly 5 years now, and am not affiliated with any vendors.

I have been keeping some test data, and I'll post some results here. This is my own testing, and I've tested multiple machines. Here is one result (I hope my maths is correct). The drive is 45% full, but this shouldn't matter as this is taking a DD image.

Test Machine Dell Vostro 3450, Core i5, 4GB RAM
HDD Samsung 320GB HM320HJ Platter Drive. Total bytes 320072932864 bytes.

Ballistic connected to 2 x USB2.0 ports, and 2 x USB3.0 ports. Drive imaged in 3511sec (58mins 31secs). Average speed of 5.469GB/min.

Tableau TD2 imaged drive in 77mins 48secs using a WD 1TB Velociraptor HDD as destination. Average speed 4.113GB/min. Time to remove drive for imaging was 25mins. Time to put the drive back in was 20mins.

FTK Imager connected to a single USB2.0 port took 224mins. Connected to a single USB3.0 port took 84mins 35secs.

The destination drive used for FTK was a Samsung 512GB 840 Pro SSD.

I would say Ballistic may not be the software tool of choice for guys sitting in a lab. If time is not a problem, then popping a drive out and attaching it to your Tableau or your FRED is fine.

The software is for my guys at the sharp end, working in Afghan or worse, where they can't hang about in a target environment. Ballistic is another tool for us, it has it's time and place like bshavers says, it's a tool for a particular situation.

ReplyQuote
Posted : 30/05/2014 2:04 pm
markl1975
(@markl1975)
Member

Sorry, forgot to list what my Ballistic hardware is.

I am using the original Kingston HyperX 26GB USB3.0 stick I got the software on. I bought another, and I also have 2 x Samsung 512GB 840 Pro SSD's attached to an eSATA cable, and a USB3.0 cable.

Cheers,

ReplyQuote
Posted : 30/05/2014 2:06 pm
Adam10541
(@adam10541)
Senior Member

Took you 25 mins to remove a HDD and another 20 mins to put it back in !!! 😯

Was the case welded shut? P

Even taking photographs and the associated paperwork I use I'm imaging a drive from a standard PC or Laptop within 5 mins tops.

ReplyQuote
Posted : 30/05/2014 2:36 pm
markl1975
(@markl1975)
Member

Good point. I picked the Vostro as it's a pain to get the drive out.

I should also have pointed out that the tests we do simulate the conditions the soldiers may be in when using the kit.

The software is tested in night-time conditions, and any equipment moved has to be carefully recorded. In this case, 25mins is pretty good for a drive removal. I did it without carrying all the other associated equipment.

The soldiers who are carrying out this work will also be laden with body armour, side-arms, ammunition, comms and other kit, and a hard drive removal can sometimes take upwards of 45mins.

If I was at my lab bench, then 5mins is realistic, but we have to simulate the conditions of use.

ReplyQuote
Posted : 30/05/2014 2:53 pm
Page 4 / 5
Share: