I am currently in the finally phases of developing a computer forensics lab for the police;however, I am a bit stumped on the best solution for storing case images and data with a retention of at least six years.
The budget is a bit limited at the moment, so SAN implementation with fiber or fiber over Ethernet is out of the question. Anyone have any suggestions on the best practices for archiving this data for a long term?
I believe that this thread will be of assistance to you
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=5457&postdays=0&postorder=asc&start=0
I believe that this thread will be of assistance to you
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=5457&postdays=0&postorder=asc&start=0
thanks man, i will give this a look.
No problem. )
I am currently in the finally phases of developing a computer forensics lab for the police;however, I am a bit stumped on the best solution for storing case images and data with a retention of at least six years.
The budget is a bit limited at the moment, so SAN implementation with fiber or fiber over Ethernet is out of the question. Anyone have any suggestions on the best practices for archiving this data for a long term?
As I said in the thread referenced, the best long-term data storage medium is tape. There's a reason why it's the standard for long-term file storage. RAID and SAN don't provide you with a mechanism to protect the integrity of the data you're storing; if the files get changed on the RAID or SAN, then they're changed period unless it has some snapshot features built-in, but even those aren't long-term solutions and only track changes over time. If you're serious about long-term storage, you use tape.
OT, but not much.
Anyone knows of paper/report/studies/data about actual "real life" data retention on tapes?
I may have been always unlucky, but in my little experience (frankly a bit dated and possibly related to some "older" generation of tape devices and definitely "consumer leve" ones, like HP DAT, "Travan" and QIC-3080) I had more failures in attempting restoring "aged" data from tape than I would have liked, without any actual record to check, I would say that around 50 % of the times tapes more than three years old gave me problems, sometimes solvable, but often not (and not necessarily caused by the actual tapes, but also by the actual drives).
From this little doc about LTO drives
http//
I can gather that new technologies are reputed to be "better", but I would like to hear about first hand experiences or "independent" reports.
Just for the record an earlier version (written when LTO were the new kid on the block)
http//
jaclaz
I followed up on the tape drive reliability piece a bit.
According to Gartner, 10-50% restores fail. Of the survey responders 77% of the tape users had restore failure.
Put that two number together, and tape no longer seems so competitive to to a case of 2TB drives.
Not very different from my personal experience/estimation.
The article mentioning those numbers should be this one
http//
but is the actual data/report available?
An interesting though only loosely related document
Preparing for the Worst
Managing Records Disasters
http//
jaclaz
Jhup, Once again you are 100% correct.
I would never use tape, taking away the elements (even in a safe) heat, cold, air, water. They are susceptible to physical damage as well as lengthy restores and I too have seen many a restore fail. Clients will either spring for hard drives or quite possibly face incredible sanctions from the court with reports/studies backing up the fail rates.
I followed up on the tape drive reliability piece a bit.
According to Gartner, 10-50% restores fail. Of the survey responders 77% of the tape users had restore failure.
Put that two number together, and tape no longer seems so competitive to to a case of 2TB drives.
Let's be accurate about those two numbers - 10-50% is a big swing, and 10-50% plus 77% does not make a greater than 100% chance of failure.