Research into Forensic Acquisition Performance

The acquisition of digital evidence has needed more time than in the past, even though the maximum forensic acquisition rates of systems have increased. Certainly, one of the causes of longer acquisition times has been that disk capacities have increased at a greater rate than data transfer rates. However, it appears that inefficient techniques are another cause of slower forensic acquisitions.

The goal of the research has been to identify performance bottlenecks in forensic acquisitions. I have recently published a paper entitled Characteristics of Forensic Imaging Performance in the Journal of Forensic Sciences on some of the findings of this research.

This website is based upon that research, and provides a summary of some of the key findings. The menubar above provides access to charts highlighting the research findings, along with the raw data and software created to perform the testing. Available data includes acquisition timing data for dd and ewf on SSD and traditional hard disk drives. Data is also available for the impact of the output filesystem on overall acquisition time.

This research revealed that the factors listed below contribute greatly to the overall performance of a forensic acquisition. As an example, consider this chart showing the impact on performance when using a writeblocker.