±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35750
New Yesterday: 1 Visitors: 157

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

The Cost of Storing Digital Images

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

andy1500mac
Senior Member
 

Re: The Cost of Storing Digital Images

Post Posted: Jun 23, 05 03:12

Thanks for that Greg,

As with a lot who are starting out I am not quite ready for the $$$ of Encase and have been doing much of my work on Winhex and others.

This does however seem like another good feature and as I move along I will surely delve into Guidance’s software and add it to my toolkit... I have the demo CD which many have stated gives you an idea of the software but can be a bit frustrating...

Thanks again for the info, it cleared up some of my fogginess on the subject.

Andrew-  
 
  

Andy
Senior Member
 

Re: The Cost of Storing Digital Images

Post Posted: Jun 23, 05 11:20

femur, we use SAIT (Super AIT) which transfers at 500GB (that's manufacturers GB) at 30MB/s (uncompressed). It has a larger capasity than DLT.

To my knowledge SDLT 600 transfers at 300GB at 36MB/s. Slightly faster but its not got the storage.

I actually don't have much to do with the tape backup we use, as a colleague has taken ownership of archiving, but he tells me that many factors come into play with using tape, such as, where on the network we place the drive?, what software is used? etc.

If you are not storing vast amounts of data (we currently have about 5 Terabytes, with room for 5 more or there abouts), then I agree with Greg, DVD is a realistic option. But be careful of the DC/DVD burning robots, as we've had one for a couple of years, and its been a complete waste of money. It hardly ever worked right.

Andy  
 
  

mark777
Senior Member
 

Re: The Cost of Storing Digital Images

Post Posted: Jun 27, 05 20:59

Andy

It wasn't from fernico was it
_________________
Mark 
 
  

Andy
Senior Member
 

Re: The Cost of Storing Digital Images

Post Posted: Jun 28, 05 09:12

Hi Mark, its a Cedar Rimage...... I can't remember where we got it from. Some snake oil salesman duped my previous manager into throwing good money away on it Smile

Andy  
 
  

akaplan0qw9
Senior Member
 

Re: The Cost of Storing Digital Images

Post Posted: Jun 30, 05 14:16

In researching the storage options, I made contact with Rob Caffey of Chase Laboratories 310-577-1702. He is an expert on tape backup. His equipment and supplies are not cheap, but they could be made to fit into the budget. I found him to be very helpful in spite of the fact, I decided against the tape option. I had previously pretty much given up on DVD which take up too much of my time.

As I analyzed it, my hardware infrastructure set the limitations and was really the deciding factor.

Some of you guys are working with elaborate networks that are set up to image on RAID drives and have servers dedecated to backups. My laboratory consists of one very good and one mediocre desktop, both of which I made myself. In addition to both being licenced for several different CF applications, those machines are also used a variety of investigative tasks, business administration and personal tasks.

My field unit is a middle of the road HP laptop. When not in the field, that unit is part of my "Network" that consists of trying to share a printer and accessing the internet. Probably 90% of my imaging takes place out in the field. Both my Lab units and my field units have drive locks and a variety of adapters. My images are placed on a 300 GB Maxtor external HD in the field and transported back to the office. (We have 10 of those in service.) That is the point at which the backup decision has to be made. If I go the DVD route, my personal time and 50% of my laboratoy is (assuming a 250GB image) tied up for at least 11 hours. To use modern tape technology I would probably have to bring in another computer and enhance my network at a cost of about $10,000.

After considering all the options and risks I have decided to place all of my backup images on to one of those external HDs, take it out of service, tag it, seal-it and put it in my SD box at the bank. My cost will be a minimum of $1/GB depending upon the number and size of the backup images I put on each drive. That cost is being partially offset by a $1/GB storage surcharge I am charging my client.

How long will one of those HDs last if it is stored unpowered in a bank vault? I don't know! In fact, I'm not sure how long I want to store them.

Al
_________________
Alan M. Kaplan, ACE
Nevada PI License #220
AKaplan @ LasVegasPI.com 
 
  

gmarshall139
Senior Member
 

Re: The Cost of Storing Digital Images

Post Posted: Jun 30, 05 14:49

One huge difference in private sector work and Law Enforcement work is the time allowed for acquisitions. I never appreciated how much a luxury it was to be able to start an acquisition, lock up the lab, and come in and find it complete Monday morning. If it hung up somewhere, so what, I could do it again. The benefit being I could take the extra time to compress images. I remember imaging a 120gb drive (which turned out never to have been used) with full compression into less than 1 gb worth of evidence files. Based on this experience I would suppose that one could achieve compression (using Encase) of unused space to 1/100th of its original size. Some of these huge drives we are seeing could be compressed way down since people rarely use all that space (In my experience 40gb of allocated space on a drive is rare). I'm going to put in a feature request with Guidance Software that a "recompression" feature be built in. The image can be acquired in the fastest manner (no compression) then compressed later over night or a weekend for archival.

Another possibility would be to mount the image with one of the utilities out there that can do this and re-acquire the mounted image with full compression. It would be an interesting verification test to see if the hashes would match. I'm not sure how the various mount image applications would cache the necessary writes to the drive and whether that cache would be part of the mounted drive or not. If it is then the new md5 wont match the original. I've got a couple of cases here that I'll try it out on. If anyone's interested I'll post the results.
_________________
Greg Marshall, EnCE 
 
  

andy1500mac
Senior Member
 

Re: The Cost of Storing Digital Images

Post Posted: Jun 30, 05 17:51

Hi All,

Winhex backup manager allows for images to be compressed and hashed with an integrity check done when restoring the image to its original size.

The compression will obviously differ depending on the data contained within the image but testing has shown anywhere from 15-85%. I haven’t been able to test on many bigger drives but I would think the same results will hold true.

You actually have the option to save as .whx backups with compression and encryption, raw images with no compression or Encase .e01 image files compressed but encryption unavailable.

All splittable at your discression (650mb for example for cd's)..which sort of answers my earlier questions on spanning of images..

Thanks for the above posts as they piqued my interest into the image archival aspect of forensics…which I hadn’t much looked into.

-Andrew  
 

Page 2 of 3
Page Previous  1, 2, 3  Next