Maybe it is not relevant to most investigators, but knowing your devices and your hardware can help in determining how long an acquisition or indexing of an evidence might take. Measuring the performance of the storage devices are just as important as analyzing a case for relevant evidence. You have to be detailed enough and have the drive to understand technology in order to move toward becoming an expert. The first step of education is to ask questions and find the best answers possible, but not by "googling" for answers other did.
In this case, we examine out storage device transfer rate in a USB 2.0 and in USB 3.0 ports. I'm lucky enough to have both of these ports on my laptop to test these ports, but if you ignore the port speed then you will never know why sometimes you get better performance.
USB 1.x supports rates of 1.5 Mbit/s (Low-Bandwidth) and 12 Mbit/s (Full-Bandwidth).
USB 2.0 supports higher maximum signaling rate and limited to effective throughput of 280 Mbit/s. The port is usually black, but the USB symbol might be the best way to distinguish the port types. In the image below, I have a USB 3.0 on the left side while only a USB 2.0 on the right side. Thus, plugging a device in one port vs. the other will have a huge performance difference.
USB 3.0 ( SuperSpeed mode ) usable data rate of up to 4 Gbit/s. A USB 3.0 port is usually colored blue, and is backwards compatible with USB 2.0. In the image below, you can see that it will not matter which port to use on this side of the laptop since both of the ports are USB 3.0.
You can see in Windows what port the device is plugged in.
So, what are the effective transfer rates on actual devices and not just in theory. There are many ways to test performance and most of them will not result in very accurate results, but will give a good indication of device transfer rates to calculate with. In many cases, the approximation of data transfer rate is good enough to calculate and prepare a quote for clients.
One way is to use the Windows System Assessment Tool ( winsat ) utility to do this test. Since we are talking about sequential writes of the data, we can test the sequential write rate of E:\ drive, in my case, like this.
winsat disk -seq -write -count 6 -v -drive E
Sequential reads are just as easy to test.
winsat disk -seq -read -count 6 -v -drive E
Another way would be to use SQLIO Disk Subsystem Benchmark Tool.
You can create a script to test the performance of the drive with many different configurations in order to find the optimal settings.
I have the following in my batch file:
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s10 -frandom -o8 -dE -b8 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -frandom -o8 -dE -b64 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -frandom -o8 -dE -b128 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -frandom -o8 -dE -b256 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -frandom -o8 -dE -b512 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -fsequential -dE -o8 -b8 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -fsequential -o8 -dE -b64 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -fsequential -o8 -dE -b128 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -fsequential -o8 -dE -b256 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kW -s360 -fsequential -o8 -dE -b512 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -frandom -o8 -b8 -dE -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -frandom -o8 -dE -b64 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -frandom -o8 -dE -b128 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -frandom -o8 -dE -b256 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -frandom -o8 -dE -b512 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -fsequential -dE -o8 -b8 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -fsequential -o8 -dE -b64 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -fsequential -o8 -dE -b128 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -fsequential -o8 -dE -b256 -LS -Fparam.txt
timeout /T 10
"C:\Program Files (x86)\SQLIO\sqlio" -kR -s360 -fsequential -o8 -dE -b512 -LS -Fparam.txt
The param.txt file does not have anything else, but a single line showing where to copy teh file to, in this case to E: drive since that is the drive I'd like to test.
e:\testfile.data 2 0x0 100
The testfile.dat was created with dcfldd like this:
C:\>dcfldd-1.3.4.x86win32\dcfldd.exe pattern=61 of=tesfile.data bs=8388608 count=1
The results can be then added to a spreadsheet to chart the data for easier analysis.
USB 3.0 performance.
USB 2.0 performance.
The best performance results are highlighted with read, but we can see that USB 3.0 have much less latency issues than USB 2.0, so we should definitely use USB 3.0 whenever we can.
So, no matter how obvious the outcome is or how much you know about technology, you should always aim to find a way to test your devices and have performance data available to chart your results to see a pattern that might not emerge just by looking at a data itself. This is the process of determining an answer by empirical data analysis. You can never get closer to a scientific thinking unless you realize the power of testing and measuring. This way, you will always be confident of your conclusions since these are data points you have created, documented, and analyzed.
Let me know if you any better ways to have a reliable testing of storage device performance.
Appendices
A. System Environment
> Command Line 'winsat disk -seq -write -count 6 -v -drive E'
> DWM running... leaving it on
> System processor power policy saved and set to 'max performance'
> Running: Feature Enumeration ''
> Gathering System Information
> Operating System : 6.3 Build-9600
> Processor : Intel(R) Core(TM) i7-4702HQ CPU @ 2.
20GHz
> TSC Frequency : 0
> Number of Processors : 1
> Number of Cores : 4
> Number of CPUs : 8
> Number of Cores per Processor : 4
> Number of CPUs Per Core : 2
> Cores have logical CPUs : YES
> L1 Cache and line Size : 32768 64
> L2 Cache and line Size : 262144 64
> L3 Cache and line Size : 6291456 64
> Total physical mem available to the OS : 15.9 GB (17,078,214,656 bytes)
> Adapter Description : Intel(R) HD Graphics 4600
> Adapter Manufacturer : Intel Corporation
> Adapter Driver Provider : Intel Corporation
> Adapter Driver Version : 10.18.10.3345
> Adapter Driver Date (yy/mm/dd) : 2013\10\31
> Has DX9 or better : Yes
> Has Pixel shader 2.0 or better : Yes
> Has LDDM Driver : Yes
> Dedicated (local) video memory : 0MB
> System memory dedicated as video memory : 0MB
> System memory shared as video memory : 1792MB
> Primary Monitor Size : 1600 X 900 (1440000 total pixels)
> WinSAT is Official : Yes
Mode Flags = 0x02000001
Disk Number = 2
Iterations = 6
IO Count = 1000
Sequential IO Size = 65536
Random IO Size = 16384
B. Drive tested
C:\>wmic diskdrive get name, size, model
Model Name Size
WD My Passport 0748 USB Device \\.\PHYSICALDRIVE2 2000363420160
C. User Manual and downloads
