CFRO - Independent Reviews of Forensic Hardware & Software

Testing Rigs:

Check out the specifications of our machines, they will change over time.

We will be doing some "get the best out of your hardware" articles in the near furture, you don't need to spend megabucks on hardware when processing small cases (less than 20 custodians).

Stick around, you may pick up some useful tips !

Meet the WOPR Mk. 5

The WOPR is my workhorse server which has the following specifications

RAM: 256GB DDR3 ECC

CPU: Intel Xeon E-4830 2.1Ghz 12 Core x 4

Disk: 8TB RAID-0 (2 Drives)

Disk: 1TB NVME PCIE Samsung Evo SSD (Database)

Disk: 512GB MSATA3 Samsung Evo SSD (OS)

DIsk: 256GB MSATA3 Samsung Evo SSD (Scratch)

This hardware (apart from the drives) is old school compared to what is available now on EBay from resellers of retired ex-corporate hardware, however the performance is stunning, with 4 cpus and 48 physical cores there is nothing you can throw at this which swamps the available cpu time (your disk IO will become the bottle neck before that happens!).

Expect to pay around £500-£700 for a server with plenty of grunt - check out our Advertisers Links page - we have resellers listed!

Pro Tip: Always have a spare duplicate processing machine available, you can then quickly resume processing with minimal reconfiguration when it dies!

Meet DAVID

David is my fall back machine for when the WOPR Mk. 5 is busy.

He has a very modest specification, but still gets the job done when he was built he was within 20% of the performance of Intels high end i7 part - but less than half the price.

We find that the WOPR Mk.5 finishes jobs in hours, whereas David takes days sometimes (on long indexing jobs) so the advantages of using multiprocessor servers are huge.

David's Specifications:

Ram: 24GB DDR3 Non-ECC

CPU: AMD Phenom II 1090T 3.2Ghz 6 Core

Disk: 2TB SATA3 (Temp Drive)

Disk: 512GB SATA3 Samsung Evo SSD (OS Drive)

Disk: 256GB SATA3 Kingston SSD (Database Drive)

Pro Tip: On machines which have limited ram, ensure the page file is on its own dedicated SSD for maximum performance when RAM is exhausted by your forensic tool. Don't buy based on the maxumum read/write speeds of the SSD drive, look for the highest random 4k read and write speeds - as this is the size of memory pages that Windows writes to disk during paging operations.

Subscribe to the CFRO newsletter to receive updates when

new content is added to the site!