YOU and your rigs video card

Main PC
32GB Ram
QUAD TFT output ATI RAD 4850x2
SSD PCI Hard Drive
15GB NAS
4GB iRAM
i7 3Ghz

Works for me.

then a smaller one just for imaging only

huh? ?

8 GTX 680's that's what I'm talkin about

Well, that might have been what you were thinkin about, but you never mentioned 'em till now.

jaclaz

With speed testing there are many stages in a process. The difficult thing can be to isolate the bottleneck. If you are developing the program it is possible to insert a dummy process (eg forget to write files to the disk) and hence find out if that process is slowing the others down.

Just because an item is fast, does not mean it will help. As an example, my car is meant to have a top speed of 140mph, but somehow, this does not help on my trip to Tesco a few minutes down the 30 mph road.

I used to work with tape a lot, and reading was fast, but saving the data on windows systems, and NAS was slow. Processing wise, hashing was a signficant CPU load.

One needs to track down the slowest element. It is also very important to try and stop thrashing on the hard drive - this normally means that reading and writing must be on different drives, and log files and indexes possibly on a third drive.

I still find disk I/O the slow point, often not helped a bit by slow, but very convenient USB2.0, or windows + NTFS when dealing with many small files.

It really depends on whether you're an Encase or FTK user as to whether CPU or disk IO governs your speed. Encase 6 is single threaded so it will never process fast enough for disk IO to make any difference, RAM and CPU speed are the key factors for an Encase build. FTK, however, is multithreaded and its bottleneck is IO. Using a fast RAID for FTK will help slightly but using an SSD, or several of them, is orders of magnitude better. (I ran my test image with FTK on a 4 disk RAID 5 and full processing took 26 hours; on a single SSD it took 3.5 hours)

Graphics cards are often overlooked by examiners because it is difficult to justify getting a £600 graphics card to the people holding the purse strings. If you try to justify the expense by using password attacks, do you really crack that many passwords? If it's because you routinely view 10million+ images on cases using C4P then it could be justified because a fast graphics card could speed up the whole process of you viewing them significantly - as long as the people who wrote that software, or Encase or FTK or whatever you're using, allow you to take advantage of GPU power.

(I ran my test image with FTK on a 4 disk RAID 5 and full processing took 26 hours; on a single SSD it took 3.5 hours)

Were you reading and writing to the same RAID? This would be slow, but fast on an SSD as the SSD can process accesses on any area of the disk as the same speed. ie seek time should be close to zero.

It really depends on whether you're an Encase or FTK user as to whether CPU or disk IO governs your speed. Encase 6 is single threaded so it will never process fast enough for disk IO to make any difference, RAM and CPU speed are the key factors for an Encase build. FTK, however, is multithreaded and its bottleneck is IO. Using a fast RAID for FTK will help slightly but using an SSD, or several of them, is orders of magnitude better. (I ran my test image with FTK on a 4 disk RAID 5 and full processing took 26 hours; on a single SSD it took 3.5 hours)

Graphics cards are often overlooked by examiners because it is difficult to justify getting a £600 graphics card to the people holding the purse strings. If you try to justify the expense by using password attacks, do you really crack that many passwords? If it's because you routinely view 10million+ images on cases using C4P then it could be justified because a fast graphics card could speed up the whole process of you viewing them significantly - as long as the people who wrote that software, or Encase or FTK or whatever you're using, allow you to take advantage of GPU power.

The I/O bottleneck is not the size of the data it can handle (Mps) but the number of IOPS, or read and write operations per second.

Encase 6 can easily generate 500 IOPS, but a single sata disk can only deliver around 80 (opinions vary). This leads to queing and pushes the CPU usage up and is often mistaken for a CPU issue. You would need a raid of 5 or 6 disk to eliminate the bottle neck. Of course this is an example, and it depends on how many sessions you re running etc. I've seen well in excess of 1000 IOPS in my environment.
This is why we benefit from SSD's. Yes, the megs per second is impressive, but the IOPS figures are more so.

A £50 graphics card runs C4P just as well as a £500 one. The only justification that stands up is for password cracking.

As a general statement, the biggest bottlenecks in 90% of the forensic systems i've seen are

1) I/O
2) Memory
3) CPU

I can highly recommend getting to know perfmon to find out what your systems are really doing against your own real world workload.

348 billions 😯 NTLM passwords per second !
http//securityledger.com/new-25-gpu-monster-devours-passwords-in-seconds/

jaclaz

Ahhh, derived from the video games.

"Titan derives the majority of its oomph—more than 90%—from technology originally developed for the video-game industry. Half of its 37,376 processors are ordinary CPUs. But the other half are graphics processing units, or GPUs. These are specialised devices designed to cope with modern video games, which are some of the most demanding applications any home machine is ever likely to run."

348 billions 😯 NTLM passwords per second !
http//securityledger.com/new-25-gpu-monster-devours-passwords-in-seconds/

jaclaz

i want one
although the boss rejected my proposal for rigging 200 ps3s together like the US DoD (I think) has….

Rak-a-tak's seem to do ok though. They have like 100 something GPUs in them.