Selecting a computer to host your Vound software

    It is always important to select a computer with ample resources to run the software that will be installed on the host machine, as well as the various tasks the system will be supporting. With today’s large case sizes, this is especially important when you are choosing a computer that will be running any form of ESI processing software. Below are the most important hardware elements to consider when selecting a computer to host Intella and Connect/Investigator: 

    • The Processor – The processor or CPU is often the first component that comes to mind when discussing the performance of a PC. The processor carries out the instructions of the applications running on the PC. Any sort of software application that deals with a great amount of data analysis will require high quality, and high performance processor(s). However, when the memory and hard drive used do not meet or exceed the recommended standard, the processor can easily become underutilized. We discuss more about memory and hard drives below. As a general rule, only processors designed for desktop or server use should be considered for your host computer. Do not use processors which have been designed for mobile devices. More cores, and higher specs will provide better performance if budget permits, but it always comes down to that saying, "you get what you pay for". 
    • Memory – Specifically referred to as RAM, your computer requires a certain amount of memory to temporarily store the data and code it is working on. Simply put, the more memory you have, the more data your computer can work with at once, otherwise it must constantly utilize your hard disk for temporary storage or postpone certain tasks. Using the hard disk as memory is a lot slower than using RAM, so this can greatly slow down your computer.
      Anything less than 8GB for our entry level products should not even be considered. Also know that since the release of Windows Vista, Windows may use the memory that is considered as “free” as a disk cache. This greatly increases the performance of your PC, but may leave less memory for Intella to use. While memory chips can come in different speeds, more memory typically beats faster memory when using Intella. 
    • The Hard Drive – There are a few important elements to consider when making an allowance for hard drives. 
      • Localized drives: The drives used for the Case, Evidence and Optimization folder should all be local drives. E.G. these drives should be internal, and connected directly to the motherboard. We do not recommend using network or USB connected drives for processing and indexing activities. We have seen a number of issues in support where network and USB drives are used.
      • Storage space: In addition to the space required for your operating system and applications, you need room to store your evidence files and for Intella to store its case files.  On average you should allow two times the size of your evidence files for storage space for the case files. 
      • Data access speed: It is important not to overlook the speed of your drives. Different technologies play a big part in data access rates for drives. An example of this is the spin speed of the drive. Laptops, and most eco-friendly drives spin much slower (e.g. 5,400 RPM) than high performance drives (7,200 - 10,000+ RPM). In simple terms this means it will take longer to read or write data to those drives. 
    As an example, here are the (minimum) hardware recommendations for different Intella products. 


    For Intella Connect Plus, we recommend at least 128GB+ of RAM.

    **The optimization drive is not a requirement, but it is an option to increase processing performance.

    There are better technologies available these days. Solid state drives (SSD) are much faster at read/write processes based on there being no moving parts, and data is read/written directly from/to solid state memory chips, as opposed to magnetic rotating platters. Also, there are other factors to take into consideration such as the drives transfer rates and hard drive cache sizes. As mentioned above, you get what you pay for. Therefore, if you want performance, you should invest in high performance components. 


    A RAID configuration for your hard drives can add redundancy and fault tolerance to your computer. This can protect your data if one of the drives fail. A RAID configuration may also increase the speed of your read and write operations providing better performance. Fault tolerance, speed improvements or both depends on the specific RAID configuration that you use. How to configure a RAID is beyond the scope of this guide and you should discuss these options with your IT team.


    • Operating System - Our products are supported on these desktop operating systems - Windows 10/11. Our products can be installed on a number of Windows Server products such as Server 2016, 2019 and 2022 also. A 64-bit operating system is pretty much required, as the 32-bit version of these operating systems cannot accommodate more than 4 GB of memory. The “Home” or “Starter” editions are not recommended as they again limit the maximum amount of memory and CPUs. Please use the “Pro”, “Enterprise” or “Ultimate” versions instead.
      Although our products can be installed on a number of Windows Server products such as Server 2016 and 2019, our products do not require a server operating system, and they run perfectly well on the listed desktop operating systems. For server installations, we only support our applications. We do not provide support for the server itself. Server security settings may need to be configured, and ports may need to be opened for some of our products to operate on a server platform. These settings need to be addressed by your IT team to ensure that security of the system is maintained.
      We do not support our products when installed on operating system deemed end of life by the manufacturer. For example, these would include platforms such as Windows XP and Server 2008 / 2012.
    • Microsoft Office – Office 2007 or a newer version (such as 2010 or 2013) is required if you intend to export your results to a PST file.
    • Lotus Notes – Lotus Notes 9.0 or higher is required for indexing NSF files. Check the user manual for specific minor versions that are not recommended. 

    Below are the suggested minimum specifications that we recommend for each of our products. It is better to exceed the minimum requirements listed for better performance. Naturally, larger datasets require more processing time and have higher requirements for system resources than smaller datasets. These specifications are based on a 500 gigabyte (or less) case.

    Intella Desktop Versions

    Intella Investigator, Node, & Connect/Connect Plus

    * See the 'Operating system' section above regarding server operating systems.

    ** Up until version 2.4.2 Microsoft Outlook 2007 or later was required on the system to be able to export to PST format. From version 2.5.0 Microsoft Outlook 2007 or later is not required to export items to PST format. 

    *** These drives are not technically required. They are mentioned as a place where you can copy cases which have already been indexed. E.g. indexed cases can be copied from the Node machine to the Connect machine to free up space on the Node system for other indexing tasks.


    Additional notes: 

    For Pro, Investigator, Connect and Node systems, the requirements should be increased for:

    • Case size
    • Number of concurrent users
    • Number of shared cases 

    Use of QNAP devices

    Several users have reported issues when using QNAP NAS devices to store and access cases. Please note that our products may not work seamlessly with QNAP devices by default, and the standard configuration of the device may require changes. We do not provide support for configuring QNAP systems, and we recommend that users contact QNAP for assistance.

    Some examples of the issues that have been reported:
    • The Intella log files may contain an error message stating that "Insufficient system resources exist to complete the requested service." We have identified that this error is caused by the underlying Linux file system, which has a limit of 4096 open files. Unfortunately, this limit cannot be modified by QNAP users, and can only be changed by QNAP's support department. Although this limit may suffice for a single, moderately sized case, it quickly becomes a bottleneck when multiple cases are accessed concurrently. Devices with such limits were not designed for database access patterns, where large amounts of files are accessed simultaneously.
    • Intella may display an "inaccessible" status for a shared folder on a QNAP device. However, this issue can be resolved by configuring the QNAP device to allow anonymous access to shared folders and adjusting certain Windows registry settings.
    Please consider these factors when opting for a QNAP device.

    Some other items to consider

    • Case sharing - Intella Connect and Investigator are designed for simultaneous case sharing and indexing workflows, with separate system roles for Connect/Investigator and Node. To ensure optimal performance and prevent case corruption, we recommend running these products on separate systems that are in close proximity to each other. Slow network connectivity between Connect/Investigator and Node systems can negatively impact indexing performance and cause data drop-outs. Therefore, it is important to avoid running Connect/Investigator and Node on the same system.

    • Case sizes - The specifications in the table above are based on a case size of 500 gigabytes or less. For larger cases, it is recommended to increase the physical memory and CPU cores to enhance the performance and stability of the applications. If your system has more resources than the minimum requirements, you can configure our products to utilize these resources. To learn more about how to configure memory and crawler settings for better performance, please refer to this article.  https://support.vound-software.com/#knowledge_base/1/locale/en-us/answer/71/

    • Type of data - The type of data or evidence being processed is a significant factor in determining the speed of processing. Delays can occur if Intella encounters corrupted files. Compressed files are expanded and processed, which means that Intella usually processes more data than the size of the evidence. For more information on evidence, please refer to the following post.
    • Intella Connect review systems - To effectively review a case hosted by Intella Connect, client PCs should meet certain requirements. These include a minimum of 8 GB RAM and an up-to-date web browser, such as Microsoft Edge, Mozilla Firefox, or Google Chrome. It is important to note that specific browser versions may have limitations, so please refer to the online documentation for more information. See the online documentation for notes on the limitations of specific browser versions.
    • Intella Investigator review systems - The same specifications apply to Intella Investigate review systems as to Intella Connect review systems.
    • Network storage - Vound recommends processing data on local drives that are located in the processing system. After processing, users can review the data on that same system. Although copying the indexed case to a reliable network drive for review is possible, it's important to note that we have seen several errors in support caused by interrupted network traffic or permissions while reviewing cases from a network storage location. While using a reliable network drive is an option, users should be aware that any network issue, regardless of size, can potentially cause irreversible database corruption that may render the case unrecoverable.
    • Case file size requirements - The recommended amount of storage space for each processed case depends on various factors, including the number of indexed items, the total size of data, and the expected length and type of reviews. It is recommended to allocate at least double the size of the evidence file set for each case.
    • Intella memory configuration - For more information on configuring memory settings in Intella for better performance, visit this link.

    What exact computer should I get to use with Intella? 

    When it comes to choosing a computer for Intella, it's not a straightforward decision. While a high-spec system is important, there are other factors to consider for a successful job. In our opinion, there are five key factors that shouldn't be ignored. Even with a top-of-the-line computer, neglecting these factors could jeopardize your success.

    The user/reviewers experience. 

    To enhance the user/reviewer experience, it's crucial to have both experience and proper system management. Skilled users can work effectively even with modest computer specifications, provided they manage their system efficiently. This involves planning their workload, training reviewers to avoid needless tasks (such as tagging a quarter-million items without a clear purpose), refraining from exporting unnecessary data, and avoiding running multiple taxing applications simultaneously. Ultimately, users need to be mindful of how their actions impact other reviewers and think critically about optimizing the system for all involved.

    The evidence

    The 80/20 rule applies to data indexing as well. While 80% of your data is likely to index with ease, the remaining 20% may take just as long as the other 80% if it is corrupted or incompatible with other data. In such cases, the user's experience is of utmost importance. They must be able to identify, spot, and repair any issues that may arise.
    To ensure thorough indexing of your data, it's essential to check for any missed items or pre-processing needs. For example, anti-virus software can block up to 20% of your data, and some files may require pre-processing before Intella can read them, such as encrypted, OCR, custom metadata fields, and older mail formats. You should also consider the data's composition, such as the ratio of zipped files to text files, which can significantly impact the case. To achieve optimal results, you need to understand the data you're indexing. Mail containers like PST/OST/NSF require more resources than loose documents; thus, the system specifications needed for 1TB of mail containers will differ significantly from 1TB of loose documents.

    The system specifications and usage

    When it comes to system specifications and usage, it is important to consider the nature of the job as well as other factors. For instance, if you are dealing with complex data that inexperienced users may not fully understand, it is critical to provide comprehensive training. Additionally, if a lawyer or reviewer insists on adding many items to a tag and exporting them all to PDF/TIFF, it can put a strain on the system. In such cases, it may be necessary to prioritize the job's importance and consider the other four factors before proceeding. By doing so, you can ensure that your system is optimized for efficient and effective use.

    The software

    The performance of the software is directly impacted by the computer it's installed on. However, even the best software on earth can experience issues when used by inexperienced users or when data corruption occurs. Therefore, having a high-spec machine is not always a guarantee for a perfect outcome.

    The deadline - A.K.A the 2am factor

    The deadline is often the biggest factor in a digital forensics case. If the case needs to be done in a week, it is crucial to take the following steps:
    1. Spec the computer: Ensure that the computer being used for the case is up to the task and will not cause any problems during the investigation. 
    2. Plan the case: Determine which tags will be used, what will be tagged, and when and what will be printed or exported. Ensure that all users involved in the investigation are trained to follow the best practices that you specify.
    3. Look at the data: Analyze the data to determine its makeup. Are there a lot of files that will be of no use to you? Can you perform de-duplication ahead of indexing to reduce the volume?
    4. Agree on the load file format: If you are using load files, agree on a format prior to accepting or creating the load file. This will help avoid support questions that start with "My load file is not working".
    5. Back up the case: Finally, it is crucial to back up the case regularly. Failure to do so can result in data loss and ultimately, tears.
    By following these steps, you can ensure that the investigation is completed within the deadline without any major issues.

    Updated January 2024
    Tags
    Hardware How-To Intella Connect Intella Desktop Intella Investigator
    Published