Optane 905p file carving digital forensics

[MSchn8]

Hello

It might be a noob question, but the search did not help me till now. There are many reports about the optane, but somehow I do not finde the answer or I do not understand it then.

As NVME SSD's are extrem fast with i/o, I am not sure if the intel optane 905p PCIe will accelerate file carving on large raw or compressed files. As I learned, it depends on the queue depth and the size. But also about the garbish on ssd. Let's assume the file to carve is saved on optane or in the second case on an nvme drive. Will the optane be much faster than the nvme drive if all the other hardware (workstation) is the same?

Thanks for helping me to understand the subject.

[n_scott_pearson]

Optane is a caching technology. This means that it accelerates the reading of frequently-accessed files stored on the HDD. It cannot truly accelerate the writing of files (not if continuous writing is occurring) nor can it help with the reading of non-cached content. This is why, if you are using a NVMe SSD as your System drive, it doesn't make that much sense to use an Optane module to accelerate accesses to a secondary HDD (which presumably contains offline and multimedia content).

...S

[MSchn8]

Thank you Scott. So the optane will accelerate a raid 5 with common HDD. But the threated data will be anyway limited by the delivery speed of the RAID as the evidence file is usual from very big size.

The optane push the i/o speed and then actually the read / write speed is less important. Right?

[n_scott_pearson]

Don't read more into my answers that I specifically state! I *never* said anything about using Optane with a RAID5 array.

Again, Optane provides you with a very fast read -- not read/write -- cache. It does not help with write speeds.

...S

[MSchn8]

You are 100% right. I concluded for myself that HDD RAID5 not as system drive will profit of Optane. Now when I read my response again, I might not have translated it not correctly in English language.

The part with NVME system disk is clear. Also about write speed. I conclude again for myself:

If I have a large imaga file on a RAID5 (HDD), let's say 1500GB cutted in 2GB peaces, which need to be carved by forensic software, the optane drive might not help that much because there are no common files. Right?

The software itself might be fast enought already, if run on an NVME drive. Only the cache drive, if the software support this, could be an optane. Right?

I ask this all, because processing that large files takes many hours or even days. So a speed boost cuts down the time and saves money.

I don't want to upset you in any way. Sorry if I have done.

[n_scott_pearson]

Regarding "If I have a large image file on a RAID5 (HDD), let's say 1500GB, divided into 2GB chunks, which need to be analyzed by forensic software, the Optane drive might not help that much because there are no common files. Right?" and "The software itself might be fast enough already, if run on an NVMe drive. Only the cache drive, if the software support this, could be an Optane. Right? I ask this all, because processing that large files takes many hours or even days. So a speed boost cuts down the time and saves money."...

You are essentially correct (if awkwardly stated). The advantage of caching technology comes when a cacheable file is subsequently read repeatedly. Because it has been cached in the Optane memory, it can be (re-)read subsequently at Optane's much faster speeds. If the file is very large and not cacheable or is changing and thus is not cached, however, there is no advantage; it is going to have to be read from the HDD, at the slower HDD speeds.

Upset me? No. It takes a *lot* more than this

...S

[MSchn8]

So that's it. Thank you. I see it on your profile picture. One might to stress you a lot to make you upset :-)

[Robert_A_Intel]

Intel SSD person here (though not one of the communities folks) -

Just to comment on this response, I don't believe you're correct in this case. When you state Optane is a caching technology that's 100% correct when you're referring to Intel Optane Memory and the RST caching solutions. But the original question is about accessing files on the drive, and an Intel Optane 905p SSD, though the poster does mention caching, which this drive does not do inherently. The 905p is an SSD, not a cache solution, and does have very fast read and write IOs. Any random operations happening on data on that drive will be performing significantly faster than on a NAND based SSD solution.

Rob

[MSchn8]

Hi Rob,

I did some testing meanwhile. I chose a 72GB .raw file and startet an analyse with the sleuth kit. Once with the file saved on HDD raid 5 and once on SATA SSD 860 pro 512gb. There was a significant boost with the ssd. I must check it on Monday again which part of the process was faster. ** EDIT: The Extraction Process was boosted the most*** . The whole process was 33% faster with the ssd.

So i might not use the optaine as catching drive but as source drive.

Av. Queue lengt was 1 or less. This is what I have seen in Windows Performance manager.

I think a NVME would boost even more because of higher i/o. So the Optane 905p should top the nvme again. But not because of i/o, because of the latency.

Its a dam expensive investion to maybe find out an nvme would be enought.