Solution Guide

Analyze 79
between one another within the group. Distributed processing is not the same as
parallel processing, which refers to the use of multiple processors that share a
single memory asset.
Consider the following, which will give you a rough idea of the advantages of
the Dell Solution using a distributed processing installation, using distributed
processing, completing an analysis of five 200 GB files may take only 3.5 hours
while processing a single 200 GB file on a standalone workstation might take
roughly 7-8 hours to accomplish.
Moving evidence data processing from the analyst’s workstation to the server
isn’t the end; the Dell Solution also offers the option of running analytical
software itself, such as FTK and EnCase on the server, allowing the workstation
to become an integrated interface that is able to run multiple instances of
different forensics software packages under concurrently-viewed operating
systems with no client performance degradation.
Using Distributed Processing in FTK 3.1
Distributed Processing allows you to apply the additional resources of up to
three additional computers at a time to the processing of your cases. Once you
have installed and configured the Distributed Processing Engine, you can reduce
your case processing time exponentially.
NOTE: As a rule of thumb, using Distributed Processing does not reduce
processing times unless the number of objects to be processed exceeds 1,000 times
the number of cores that exist within the system. For example, on a system with
eight cores, the additional distributed processing engine machines may not lower
processing time unless the evidence contains more than 8,000 items.
NOTE: For information on installing and configuring the Distributed Processing
module as part of your Solution, refer to the appropriate section of the FTK User
Guide.
1 Make sure the case folder is shared before trying to add and process
evidence. If you are following Dell’s recommended filenaming conventions,
the case folder should be located on your workspace drive,
W:/ . If you are
unsure where your case folder is located, contact your systems administrator.