I recently spent some time in a computer forensics lab of a gov. agency and see that they are all using Mac Pro workstations as their primary forensic machines. They are running bootcamp with Win7. FTK 3.x is running on the the Win7 partition. I was impressed with the processing speed.
Anyone have any thoughts or experience simliar to this? I am thinking of pushing for Mac workstations as our next for foresic machines in the corporate world.
Thanks
I couldn't conceive of running a machine without eSATA for forensics any more. My custom built system has 1 on the board in the back, 1 slot in the back, and 1 in the front. Sad that neither eSATA nor USB3 are on the Mac Pros. That's a bottleneck right there.
Check OWC for a Newer Technology esata extension cable and dual port set for the MacPro. Yes it does have esata connectors on the motherboard, they are just a little hard to find ( behind the fans).
Unfortunately, the early 2011 MacBook Pro's don't have the express card slot (except in the 17" version) for the esata adapter.
They do have the thunderbolt port, but there are no vendors so far that I know of that have a thunderbolt to esata connector. (Does anyone know of one… or two… or…) *sigh* have to wait for them to develop something.
I run FTK3 on a MacPro with 3 drives, an SSD for the OS, a 10k Raptor for the Oracle database and a 7.2k RPM SATA for a temp drive. It runs fairly well, I only have 16Gb RAM and am waiting for another 16. That should speed it up fairly well.
I also use an external 4 drive SATA hot swap bay running off a PCI-e SATA card with four ports. I use this for the case storage drive. I seldom use more than one port - but I have them.
For imaging, I use whatever write blocker I need connected on FW800. Will move to USB3 when the blockers catch up.
It's a nice machine.
We use Mac's in our office as our processing machines as well and I would probably say avoid them, although our office is very split on this issue.
If your office doesn't have anyone skilled in building your own computers, then mac's may be a good choice as they are pretty much idiot proof.
They are however a little limited in terms of maximum 3 hard disks + system disk, most of us here are running a dual esata dock as well as 4 hard disks to cope with the amount of data. Also the esata seems terrible on them and you have to restart your machine to get it to see the esata disks occasionally/regularly. This is a common gripe in our office.
Also some forensic software doesn't appear to work on them, not tried it myself but a colleague from another force told me VFC2 wont work on them. Anyone else found this btw?
If however you have someone who can properly (and i don't mean just throw one together) build PC's, I would go that way as you can tailor them better to what you need for a fraction of the cost.
Oh and you can have a damn button on your optical drive to open it if you build your own, why Mac never put a button on their optical drives I will never know!
Also the lack of PCI expansion ports is incredibly annoying, you only have 2 after the 2 graphics cards taken into account, we have an esata and a fibre optic network card in an now we have none left.
an SSD for the OS, a 10k Raptor for the Oracle database
You should try flipping that. I run a Velociraptor for my OS/Apps and an SSD for my DB. I don't care if it takes a few seconds longer to load the apps, I care much more how long it takes FTK3 to produce results to my searches, and that's where DB on SSD rocks.
From what i've seen the new OCZ Vertex 3's look like very nifty SSDs across all measures of performance. Now if only I could have a small scratchcard win to afford one. )
(no I dont buy scratchcards really)
MBP's are nice, but eSATA/USB3/Thunderbolt are the ways of the future.
I think the OP is asking about a Mac Pro. A Macbook Pro being an entirely different kettle of fish.
I have noticed a number of (possibly overfunded D ) LE units utilising Mac Pros. In there current guise you could buy an almost like for like system (with the obvious omission of OSX) built from Supermicro parts for about 30% less than a Mac Pro. That 30% could be spent on a Mac notebook for when you must have a Mac to examine Mac artefacts.
Having said that (and noting the comments with regards to eSata) when the Mac Pro is refreshed with Sandybridge processors and thunderbolt it will be a seriously good machine.
When thunderbolt storage becomes available this storage will replace eSata and USB3 at the leading edge of fast attached storage.
With regards to the eSata connection problems many motherboards treat eSata devices in the same way as they do internal hard drives. They are not seen as removable devices and are not hot swappable on these boards. I do not know how the esata ports on the Mac Pros are supposed to behave.
Regards Richard