Hi All,
Apologies if answer is somewhere in a forum I couldnt find it.
I am interested in relation between imaging speed and computer hardware, note I am not talking here about the analysis machine only imaging PC
How does hardware of Imaging PC affect the speed of imaging?
Which components are most crucial and which cause the bottleneck effect?
Is it not dictated mainly by the transfer method? USB, Firewire, eSata etc…
Obviously, a compression can massively rely on the hardware performance but for the sake of the argument lets assume no compression or FTK Imager lvl 1 compression only.
I am interested in your opinions…
The largest determinant of imaging speed is the size of the pipe. Imaging over SATA or eSATA (or IDE where applicable) will yield substantial improvements over USB (1 or 2) or FireWire (400 or 800) up to the ability of the source media to output the data. The output of the source drive is generally a function of rotational speed, data density, and number of platters. Obviously this assumes that you're using fast drives for your destination also.
Analysis speed (indexing and other pre-processing) is heavily dependent on IO to a certain point, after which it becomes limited by processing power. I saw substantial improvements in processing speed after moving my indexes to RAID10, and now CPU is the limiting factor.
I ran some tests a few months ago on my acquisition laptop and found the results interesting. Hardware and compression played a part but software and settings are critical to your results.
The basic setup I ended up using was a bare 320gb source drive (SATA, 7200rpm) via Tableau T35-es_RW to onboard eSATA to a Dell E6400 (XP, 32 bit, mid-range dual-core) and out through a Belkin eSATA expresscard to a bare SATA (1TB Seagate, 7200rpm) drive.
I used TIM 1.0, EnCase 6.8 and 6.15, X-Ways 15.4 and the Tableau TD1.
TIM imaged the drive with Fast compression and MD5 & SHA1 in 1 hr and 17 minutes. TIM using no compression and the same settings came in at 1 hr 36 minutes.
FTK was also faster with compression (1 hr, 16 minutes vs 1 hr, 30 minutes.)
X-Ways and EnCase were faster using no compression.
X-Ways was the fastest acquisition with 1 hr and 6 minutes, no compression but only with the MD5 hash. X-Ways with Fast compression (MD5 only) finished in 1 hr and 13 minutes. X-Ways with MD5, Fast compression and Encryption finished in 1 hr, 23 minutes.
EnCase was the slowest with the time of 1 hr and 32 minutes for the MD5 only acquisition add another hour for Good compression.
The Tableau TD1 with no compression and the MD5 and SHA1 completed the acquisition in 1 hr, 9 minutes.