Thursday, March 15, 2012

Comparison of Hardware Requirements

This is a list of Hardware Requirements that I have been able to find concerning some of the leading tools.

A number of people have asked me during trainings, what is the hardware requirement of various tools.

I thought it would be nice to make a brief list of the these requirements, it was harder than I thought to find these.

*Please note this is what I have been able to dig up myself (and with help from the vendors now.)  I will not guess on anything (unless otherwise stated) and will only use data that I have found on the vendor websites.
**Guidance Software sent me an official specifications sheet today!  (16-Mar-2012)


EnCase

  EnCase 7 -  I am running it on my computer and am satisfied with the speeds.

Minimum Setup
  •  Dual-core Processor
  • 4 GB RAM
  • First Hard Drive for OS and Software with 300 MB available space
  • Second Hard Drive for cases
  • Windows XP Pro, Server 2003, Server 2008, Vista, 7 (32bit)
  • Gigabit network
Recommended Setup
  • Quad-core Processor (Intel Itanium is not supported)
  • 16 GB RAM
  • First Hard Drive for OS and Software with 300 MB available space (I really like the WD velociraptor for its speed of 10,000 rpm)
  • Second Hard Drive should be a RAID array for I/O speeds and redundancy
  • Windows 7 (64bit)
  • Gigabit network
What I am running it on.  I am satisfied with the speeds.
  • 2.67 GHz Quad-core processor (Intel Q9400)
  • 8 GB of RAM DDR3 PC3-10600
  • Velociraptor 10,000rpm Operating System Drive
  • 1 TB Drive for Cases
  • Windows 7 Professional (64 bit)

  EnCase 7 Processor - Guidance has released the following specifications:
  • CPU Quad-core i7
  • 16 GB of RAM
  • Drive 1: Operating System and Pagefile
  • Drive 2: Evidence
  • Drive 3: Primary Evidence Cache (This drive should be as fast as possible)
  • Windows 7 (64bit) or Windows Server 2k8 R2 (64bit)
  • (Make sure you have a Gigabit network before trying this)

FTK 3 and FTK 4

  Minimum Setup
  • One Computer with
  • Quad-core processor 
  • 2 GB RAM per core.  A Quad-core would have 8 GB RAM
  • First Hard Drive with FTK and 500 MB of free space
  • Second Separate large Hard Drive for the database
  • (I have found no recommendation for Windows but with the RAM constraints it must be a 64bit install)
  • (I have attempted this with FTK 3.0.  It was extremely bogged down.  I would personally recommend a minimum of a dual quad-core with 16 GB of RAM if you are going to run this on a single computer.)
   Recommended Setup
  • Separate Computers (You must have a Gigabit network for this to work properly)
  • First Computer runs FTK
  • Dual Quad-core (8 cores)
  • 2 GB RAM per core.  Dual Quad-core would have 16 GB RAM
  • 5 GB available space for install of FTK
  • (I have found no recommendation for Windows but with the RAM constraints it must be a 64bit install)
  • Second Computer
  • Dual Quad-core (8 cores)
  • 2 GB RAM per core.  Dual Quad-core would have 16 GB RAM
  • Separate HDD RAID 5 or 6 for Database
  • (I have found no recommendation for Windows but with the RAM constraints it must be a 64bit install)
  • Third+ Computer/s can be added as processors
What I am running it on.  Speeds are acceptable, however I would prefer to have the database on a seperate computer.
  • Dual Quad-core Xeon 2.5Ghz
  • 16 GB RAM DDR3
  • First Hard Drive 7200rpm for OS and Software
  • Second Hard Drive RAID 5 for redundancy and I/O speeds.  This is the database drive array.
  • Windows 7 Ultimate (64bit)

 I hope this helps anyone who has been curious.

~Hew

www.h11dfs.com

matt@h11dfs.com

2 comments: