Distributed Processing

For carving you are normally limited by disk speed.

So I am not sure if throwing more CPUs at the problem across a (relatively slow) network is of much benefit.

Modern PCs tend to have CPU cores and RAM to spare.

For carving you are normally limited by disk speed.

So I am not sure if throwing more CPUs at the problem across a (relatively slow) network is of much benefit.

Modern PCs tend to have CPU cores and RAM to spare.

I've watched 3 worker nodes and the main system max out their CPUs over gigabit ethernet on FTK3. Then you can go a bit further without much more money in your network with bonding. Put your sources on a good RAID and the CPU will be the bottleneck. Distributed processing does help. I've just built a great system with 5 servers (32xcores each) and 2xSAN to distribute processing for eDiscovery.

For the OP, X-Ways allows distributed processing, although last I saw it was less simple to do than FTK.

I can imagine this is the case for some ediscovery tasks, but the OP was asking about carving. If you maxing out 160 CPU cores and a Gigabit network carving a file from the disk then I think there is something very very wrong with the carving algorithm.

Also if you have to copy your entire disk image from, for example, a USB drive to a RAID system, then you might already waste 20 hours doing this (2TB drive with USB2). In the same time you could have finished the carving job from the original drive instead. Of course if there are lots of different tasks you want to do on the image besides carving, then it makes sense to move it to a fast drive first.

I can imagine this is the case for some ediscovery tasks, but the OP was asking about carving. If you maxing out 160 CPU cores and a Gigabit network carving a file from the disk then I think there is something very very wrong with the carving algorithm.

Also if you have to copy your entire disk image from, for example, a USB drive to a RAID system, then you might already waste 20 hours doing this (2TB drive with USB2). In the same time you could have finished the carving job from the original drive instead. Of course if there are lots of different tasks you want to do on the image besides carving, then it makes sense to move it to a fast drive first.

Going to throw my 2p in.
For carving most things, including pictures and internet history, you are going to max out at CPU first. Although this problem is confounded by the fact that most carving programs are not multi threaded and therefore only use a small percentage of the CPU anyways!
This is probably why it seems there is a lot of CPU spare as a maxed CPU may only account for 10% of the CPU's maximum power.
Also it will depend on the complexity of the carving algorithm, simple header and footer carving is less CPU intensive compared to say SQLite records or picture files.

maybe you can use a server like this
http//ptk.dflabs.com/PTKBrochure.pdf