Hello,
I receive a lot of hard drives with large capacities.
For the moment, I store them either in my PC, or in disks that I insert in an internal rack to take advantage of the SATA.
I am looking for other solutions to avoid manipulations of hard disks.
Do some of you centralize the images (E01) on a server and perform the analysis via the network?
If so, what material is used? server, network cards etc...
Thank you
Even with a good network the latency will be much higher than an internal drive.
Depending on the work you are doing and the exact hardware it might be 10x slower across the network. So only good for long term storage or small jobs.
Not in typical forensic workflows nor with the corresponding forensic software, but I'm using large disk images and other TB sized files over the network. It is a different infrastructure approach at a different price point, but I don't see a general performance drawback.
Especially for large jobs, how would it be done otherwise? 48, 96 or more disks aren't easily squeezed into a forensic workstation, which also wouldn't allow shared access for a team.
As a minimal setup I consider a decent RAID with 8 disks or more (RAID 10 or 6), to give the server a noticeable advantage over single disk access. If you make it available via 10G Ethernet (optical, if your WS is not in the same rack), it substatially outperforms a single local SATA drive (with the caveat of any software quirk that I'm not aware of). If those 8 disks are all what you need and there is no team, then it is much better to build the disk array in your workstation, of course.
