Disk Imaging Job X and the Voom Hardcopy 3P

It’s rare for Digital Trust to endorse a product; exceptional products are scarce, and the normal information outlets cover them well enough.  But Job X was special and we like to give credit where credit is due.

This Job was a high volume, high speed imaging affair, with only two days warning.  We’d been contracted to image all the drives in a small business with, or course, minimal disruption.  About 40 drives, or so we thought.  Normally, we could parallel image either across the network or via multiple boot and intern combinations, but not in this case.  We had to get the physical disks.

The lack of prep time is normal, but not for a job this size.  We had on hand one Voom Hardcopy 3P and two Tableau’s, which would require laptops.  One of the nice things about the Voom units is they are standalone.  They are also considerably faster than a low end portable forensic imaging system.  PCMCIA SATA cards are okay, but not nearly as fast, and just one more device in the loop for Murphy to break.  Hardcopy’s transfer SATA to SATA, at drive interface speeds and are astonishingly easy to use.

Job time estimation isn’t rocket science for imaging.  It takes ~3 hours to copy a 1TB drive (at the time of this report).  A Hardcopy 3P runs at ~3GB per minute with MD5 hash (real world observations, not marketroid fluff) on an average older 80GB drive (what we had at this job).  The faster the source drive, the faster the Hardcopy; it’s limited by the drive speed.  We see 5+GB/m on a more current 7200rpm 1TB drive.  Time varies based on the quality of the source and target drives.  So given 40 average office drives, one Hardcopy would take 40drivesx80GB/3GB/m/60m=17 hours if the world was perfect.  Then there’s the overhead of locating the drives, removing them from their housings, hooking up the drives, labeling everything, recording in the logbook, putting them back, and trying to fend off questions while dealing with the inevitable, most notably, failing drives, which drastically alters the 3GB/m rule, as retries eat up exponential time.  Such is life.  Our best working estimate at this time is that 8 hours of imaging with no major issues takes two people at least 12 hours.  Which meant we needed two days with two people, and it would still take longer if things didn’t go as planned, which they never do.

Given the volume of drives, and the distressing estimation from above, we opted to try and find additional high speed equipment.  So we picked up the phone and called (651-998-1618) the nice people at Voomtech, who have been a pleasure to deal with in the past.  Unfortunately, the didn’t have any on hand, which put a crimp in our plans, but only for a moment.  They reached out to a reseller who had some in stock, and arranged for the dealer to overnight two to us, on reputation alone.  That’s awesome customer service.

Having 3 Hardcopy’s on hand would definitely make this a simple Job.  Which is when Murphy showed up.  Turns out there were a bit more than 40 drives.  There were 70.  If you follow the math, you realize that 3 Hardcopy’s are a bit of overkill for 40 drives in two days.  Even 70 would normally not be a stretch, until you factor in Murphy’s sister, who arranged for 30% of the drives to have errors, some fatally so, and to top off the adventure, the on site contact supplied imaging drives from a manufacturer we normally don’t use, because they are not as good as Seagate.  No drive maker is perfect, but some are better than others.  We like (at this point in time) to rely on Seagate.  The other drives cost us half a day dealing with their quality issues until we bit the bullet, trotted over to Staples, and picked up half a dozen big Seagate’s.

What happened to the Tableau’s?  They got used trying to figure out how to deal with the failing drives.  Once a Voom reported a problem with a drive, we moved it to the laptops and tried to finagle a viable image out of the drive.  Right tool for the job, and all that.  Hardcopy’s are faster than Tableau’s, but Tableau’s give you the ability to work with the drive using other tools.  We don’t think of it as Voom versus Tableau.  While Tableau’s can be used to acquire images, the Hardcopy’s are so much faster, they are the obvious choice for imaging.

Back at the Job, once we had the Seagate’s in place accepting data, we started thinking things might work out okay.  For two days we transferred md5 checked images from source to Seagate via the Hardcopy’s, and they were good.  Hardcopy 3P’s are wonderfully simple devices for quickly acquiring images.  One of the features we like is that they pull all the identification off the hard drive and store it in a txt file with the image file and md5 checksum file.  Saves more time.  Couple that with a vendor willing to talk to you, and you get a great option for data collection.

The assembly line of drive copying finally ended the second day at 6PM, having imaged or attempted 70 drives in 24 hours.  The Voom Hardcopy 3P’s were definitely cost effective.  There’s just something so nice about its simplicity, and even better about a vendor that treats you well.  Digital Trust highly recommends the Voom Hardcopy 3P.