New Forensic computer - need assistance

[4n6pi]

I have put together a new system for forensic work only biggest issue is processing data. I am testing the PC and no matter how much data I put through it the processor and memory never go above 20% CPU and around 8 to 12 gigs of RAM. I am no PC expert so I was hoping someone here is and can explain why my software never uses all of the resources that is available to it.
the system consists of the following:

Motherboard: Intel DH67CL
Intel Processor Number: i7-2600
# of Cores: 4
# of Threads: 8
Clock Speed: 3.4 GHz
Max Turbo Frequency: 3.8 GHz
Intel® Smart Cache: 8 MB
Bus/Core Ratio: 34
24 gigs of RAM
western digital caviar Blue drives

thanks

James

 

[idriss]

Im no expert but i beleive that the software cant use anymore system resources. Basically you have lots of horsepower and that software has asked for as much as it can take if that helps. Take my advice with a grain of salt though im new to computers aswell

 

[rgd1101]

what software is it? maybe it not multi-thread.

 

[nukemaster]

First off you need to understand that not all software can use the extra cores/threads of modern systems.

That software seems to be unable to use more then 2 cores. On the plus size, you get to take full advatnage of turbo, on the negative side, HT seems to have no effect on your software meaning a 2500 could have done just as well.

If you have a 2600K(maybe you missed the K?), [strike]you can overclock it to gain more speed[/strike], but the 20% will most likely stay at 20% either way because it can not talk to more then 2 cores at once.

This same issue effects Games and other software and it is not a defect of any kind. Those extra cores and threads are free to do other things.

20% = about 40% actual cpu usage(If you turn off HT you will see the effect, but loose no performance in this case) because the HT(fake cores) are shown(in windows) as full cores but they are not.

 

[JamesSneed]

It could be a couple things. One like Idriss posted the software isn't making use of the hardware properly. Likely the software inst multi-threaded so its just using one core which in your case with the i7-2600 4 cores/ 8 thread CPU using one core at 100% would report in Windows to be 20% CPU usage. This seems most likely. Try to find if the software your running supports multiple threads(maybe an update from the vendor) and if not maybe find new software.

The other is your possibly IO bound by the slower hard drives which seems unlikely with the information you have given.

 

[4n6pi]

Guidance software's EnCase forensic V 6 and 7 does support multithreading. I think my issue may be the cpu is not being feed data as fast as it should be. the OS is on a western digital blue, the evidence is on a usb 3, and the destination drive is usb 3. from what i have been able to find there are some tweaks to the usb 3 that can be performed?? are you aware of any of that?

thanks for the reply I appreciate it.

 

[nukemaster]

If you NEED to feed it faster, get some SSDs to store the evidence and destination. SSDs are amazing at taking little bits of data a high speeds.

USB3 flash drives vary greatly in speed and quality.

If your data set can fit in ram(I am doubting it, but what do I know ), use a ramdisk it will FLY!!!.

2TB Black(Short Stroked), M4 128 and RAM drive(with "slow" memory).

 

[JamesSneed]

Their are USB 3.0 tweaks however you wont notice much of a difference if at all. Your using the two blue USB 3.0 ports on the back of the PC/motherboard? The two USB devices are USB 3.0 compatible?

You may contact the vendor and see what they say. Im not familiar with this software package but It may make since to write the forensic data locally then copy to the slower destination USB 3.0 device.

EDIT: The SSD Idea is a very good one, you may not have control over the input device but im assuming you can change out the destination device to whatever you want.

 

[4n6pi]

Thanks guys, I appreciate the replies, I am checking out RAMDisk and yes I am using the blue USB 3 ports and two USB 3 drives. getting alot of great feedback from you and the software vendor so I hope to get the best speed possible by the end of the week. thanks again

 

[bliq]

First off you need to understand that not all software can use the extra cores/threads of modern systems.

That software seems to be unable to use more then 2 cores. On the plus size, you get to take full advatnage of turbo, on the negative side, HT seems to have no effect on your software meaning a 2500 could have done just as well.

If you have a 2600K(maybe you missed the K?), you overclock it to gain more speed, but the 20% will most likely stay at 20% either way because it can not talk to more then 2 cores at once.

This same issue effects Games and other software and it is not a defect of any kind. Those extra cores and threads are free to do other things.

20% = about 40% actual cpu usage(If you turn off HT you will see the effect, but loose no performance in this case) because the HT(fake cores) are shown(in windows) as full cores but they are not.

If this is for work, as in, you make money with this computer, I highly recommend not overclocking. Time is money and you can't afford downtime caused by pushing equipment beyond specifications, even if the chip was specifically designated as unlocked.

 

[nukemaster]

If this is for work, as in, you make money with this computer, I highly recommend not overclocking. Time is money and you can't afford downtime caused by pushing equipment beyond specifications, even if the chip was specifically designated as unlocked.

in hindsight, I can not help but agree, my bad.

I will go black that out

 

[4n6pi]

Thanks for the info, the cpu is i7 2600 3.40GHz 8MB cache (no K) got a little confused on the HT portion overclocking I understand not to use and the turbo is in the BIOS correct? thanks for all this info I appreciate it

 

[nukemaster]

The Turbo is perfectly safe to use.

HT is just a way of making a single cpu perform 2 tasks. Intel used it with the P4's long pipeline to improve performance with multi-threaded apps. They removed it for Core2 and then brought it back for some i-series cpus. It does not hurt anything, but can lead to it looking like the system is working less hard then it is, but with the right software can help performance.

Overclocking beyond what the factory sets could be called to be unsafe. After all, if I crash my system because it is overclocked too far(I have not yet, but did not push it too hard), nothing is lost(Ohh noes, my game crashed...see no harm).

For you stability is EVERYTHING.

 

[4n6pi]

that is for sure!! thats is why companies use me. reliability is key...