The Cost of Storing...
 
Notifications
Clear all

The Cost of Storing Digital Images

16 Posts
6 Users
0 Likes
1,665 Views
 Andy
(@andy)
Posts: 357
Reputable Member
 

Hi Mark, its a Cedar Rimage…… I can't remember where we got it from. Some snake oil salesman duped my previous manager into throwing good money away on it 🙂

Andy

 
Posted : 28/06/2005 9:12 am
(@akaplan0qw9)
Posts: 69
Trusted Member
Topic starter
 

In researching the storage options, I made contact with Rob Caffey of Chase Laboratories 310-577-1702. He is an expert on tape backup. His equipment and supplies are not cheap, but they could be made to fit into the budget. I found him to be very helpful in spite of the fact, I decided against the tape option. I had previously pretty much given up on DVD which take up too much of my time.

As I analyzed it, my hardware infrastructure set the limitations and was really the deciding factor.

Some of you guys are working with elaborate networks that are set up to image on RAID drives and have servers dedecated to backups. My laboratory consists of one very good and one mediocre desktop, both of which I made myself. In addition to both being licenced for several different CF applications, those machines are also used a variety of investigative tasks, business administration and personal tasks.

My field unit is a middle of the road HP laptop. When not in the field, that unit is part of my "Network" that consists of trying to share a printer and accessing the internet. Probably 90% of my imaging takes place out in the field. Both my Lab units and my field units have drive locks and a variety of adapters. My images are placed on a 300 GB Maxtor external HD in the field and transported back to the office. (We have 10 of those in service.) That is the point at which the backup decision has to be made. If I go the DVD route, my personal time and 50% of my laboratoy is (assuming a 250GB image) tied up for at least 11 hours. To use modern tape technology I would probably have to bring in another computer and enhance my network at a cost of about $10,000.

After considering all the options and risks I have decided to place all of my backup images on to one of those external HDs, take it out of service, tag it, seal-it and put it in my SD box at the bank. My cost will be a minimum of $1/GB depending upon the number and size of the backup images I put on each drive. That cost is being partially offset by a $1/GB storage surcharge I am charging my client.

How long will one of those HDs last if it is stored unpowered in a bank vault? I don't know! In fact, I'm not sure how long I want to store them.

Al

 
Posted : 30/06/2005 2:16 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

One huge difference in private sector work and Law Enforcement work is the time allowed for acquisitions. I never appreciated how much a luxury it was to be able to start an acquisition, lock up the lab, and come in and find it complete Monday morning. If it hung up somewhere, so what, I could do it again. The benefit being I could take the extra time to compress images. I remember imaging a 120gb drive (which turned out never to have been used) with full compression into less than 1 gb worth of evidence files. Based on this experience I would suppose that one could achieve compression (using Encase) of unused space to 1/100th of its original size. Some of these huge drives we are seeing could be compressed way down since people rarely use all that space (In my experience 40gb of allocated space on a drive is rare). I'm going to put in a feature request with Guidance Software that a "recompression" feature be built in. The image can be acquired in the fastest manner (no compression) then compressed later over night or a weekend for archival.

Another possibility would be to mount the image with one of the utilities out there that can do this and re-acquire the mounted image with full compression. It would be an interesting verification test to see if the hashes would match. I'm not sure how the various mount image applications would cache the necessary writes to the drive and whether that cache would be part of the mounted drive or not. If it is then the new md5 wont match the original. I've got a couple of cases here that I'll try it out on. If anyone's interested I'll post the results.

 
Posted : 30/06/2005 2:49 pm
andy1500mac
(@andy1500mac)
Posts: 79
Trusted Member
 

Hi All,

Winhex backup manager allows for images to be compressed and hashed with an integrity check done when restoring the image to its original size.

The compression will obviously differ depending on the data contained within the image but testing has shown anywhere from 15-85%. I haven’t been able to test on many bigger drives but I would think the same results will hold true.

You actually have the option to save as .whx backups with compression and encryption, raw images with no compression or Encase .e01 image files compressed but encryption unavailable.

All splittable at your discression (650mb for example for cd's)..which sort of answers my earlier questions on spanning of images..

Thanks for the above posts as they piqued my interest into the image archival aspect of forensics…which I hadn’t much looked into.

-Andrew

 
Posted : 30/06/2005 5:51 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

I received a quick reply from Guidance stating that "recompression" (they call it re-acquisition) has been possible for some time now. So I guess you learn something every day. It will be my standard practice now.

 
Posted : 30/06/2005 8:28 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

Reacquiring the data worked great. I reacquired a DD image of a 120 gb hard drive (111 actual gb) and compressed it down to just over 13gb. Took about 4 1/2 hours.

 
Posted : 02/07/2005 2:21 am
Page 2 / 2
Share: