This talk discusses in detail several measurement and performance issues that will assist the average eForensic investigator in improving job throughput and making cost effective purchasing decisions. PCIe interfaces, USB3 speeds, competing buss issues, parallelization, and collection over ethernet will be discussed and data on observations made public for future use. In addition, strategies for different types of collection will be discussed, relating to manpower needed, model throughput, and cost effectiveness. The data and discussion topics come from actual ePreservation and eForensic collection work performed by Digital Trust, and while discussing specific vendors in several areas, the company and personnel presenting have zero ties or opportunities for personal enrichment, and the information is presented solely for the betterment of the forensic community practitioners.

Recorded at AIDE 2013