Solid State Drive Acquisition

DD vs EWF via SATA interface

The solid state disk drive is capable of a maximum sustained transfer rate of 12GB/minute. This rate is approximately twice as fast as the traditional hard disk drives. The solid state drive that was tested was still slower than a 1.5Gbs SATA connection, meaning that the bottleneck was still the disk drive.

The chart below shows how long it took to copy 10GB of data from a solid state disk drive to /dev/null with dd and with varying expert witness formats(EWF). Expert witness runs that used a buffer size of 4096 bytes were chosen as, on average, they performed the best. The results show that dd is significantly faster than any of the expert witness acquisitions. The best ewf run took twice as long as dd to acquire 10GB from a solid state drive

Note that in most cases, the ewf acquisition type was sensitive to the input data. It took longer to acquire 10 GB of random data as opposed to 10GB of zeroed data from the same disk drive, using the same acquisition system. The effect was more pronounced with compression, which indicated that compressing random data imposes a penalty relative to acquiring a disk that has been zeroed. The implication here is that using compression when acquiring an encrypted disk drive will take longer than acquiring the same drive without compression.