{"id":4841,"date":"2020-12-10T16:06:18","date_gmt":"2020-12-10T14:06:18","guid":{"rendered":"http:\/\/blog.atola.com\/?p=4841"},"modified":"2023-01-16T12:22:18","modified_gmt":"2023-01-16T10:22:18","slug":"ecc-ram-in-forensic-imagers","status":"publish","type":"post","link":"https:\/\/atola.com\/blog\/ecc-ram-in-forensic-imagers\/","title":{"rendered":"The importance of ECC RAM in forensic imagers"},"content":{"rendered":"\r\n

When working with evidence drives, data integrity is critical. Using ECC RAM, which identifies and corrects common single-bit errors, would help dramatically improve data transfer reliability in digital forensic tools.<\/p>\r\n\r\n\r\n\r\n

Why use ECC memory<\/h3>\r\n\r\n\r\n\r\n

Electrical, magnetic or even radioactive interference inside a system, may cause a single bit of DRAM (Dynamic Random-Access Memory) to flip to the opposite state, resulting in an error. While the single-bit error in an ordinary situation could be harmless or have a comparatively mild effect (like a wrongly colored pixel in a .jpeg file), in forensic imaging, it means that the whole image you get is compromised. Because the hash of the image won\u2019t be identical to that of the source.<\/p>\r\n\r\n\r\n\r\n

ECC (Error Checking Code) memory provides extra reliability by adding a parity bit to each byte. This parity bit checks the remaining bits in the byte for integrity. In case one of the bits flips, ECC detects the error and corrects it on the fly.\u00a0<\/p>\r\n\r\n\r\n\r\n

That\u2019s why\u00a0most servers and computers where data corruption is not acceptable (e.g. at financial, scientific, medical), use ECC RAM. And the same should be true for digital forensics.<\/p>\r\n\r\n\r\n\r\n

\"\"<\/figure>\r\n\r\n\r\n\r\n

The research to back it<\/h3>\r\n\r\n\r\n\r\n

ECC RAM does have a much lower failure rate than standard non-ECC memory. The results of Kingston-held research (see graph above) remain valid. As well as this brilliant in-depth study named DRAM Errors in the Wild: A Large-Scale Field Study<\/a><\/strong>.<\/p>\r\n\r\n\r\n\r\n

\r\n

We find that in many aspects DRAM errors in the field behave very differently than commonly assumed. For example, we observe DRAM error rates that are orders of magnitude higher than previously reported, with FIT rates (failures in time per billion device hours) of 25,000 to 70,000 per Mbit and more than 8% of DIMMs affected per year. We provide strong evidence that memory errors are dominated by hard errors, rather than soft errors, which most previous work focuses on. <\/strong>We find that, out of all the factors that impact a DIMM\u2019s error behavior in the field, temperature has a surprisingly small effect. Finally, unlike commonly feared, we don\u2019t observe any indication that per-DIMM error rates increase with newer generations of DIMMs.<\/p>\r\n(C) DRAM Errors in the Wild: A Large-Scale Field Study
Bianca Schroeder Dept. of Computer Science University of Toronto Toronto, Canada
Eduardo Pinheiro Google Inc.
Wolf-Dietrich Weber Google Inc. <\/cite><\/blockquote>\r\n\r\n\r\n\r\n

 <\/p>\r\n\r\n\r\n\r\n

Atola TaskForce and ECC RAM<\/h3>\r\n\r\n\r\n\r\n

Because TaskForce is able to sustain 12+ imaging sessions<\/a> with the cumulative throughput of 15 TB\/hour and the system handles enormous amounts of data<\/a>, we made sure to back its smooth and accurate operation with the best hardware<\/a>. That\u2019s why our engineers enhanced the reliability of TaskForce with ECC memory. It helps avoid even the tiniest chance of data corruption during imaging, hashing, wiping, etc.\u00a0<\/p>\r\n\r\n\r\n\r\n

Here is what the ECC RAM module we install in Atola TaskForce looks like:<\/p>\r\n\r\n\r\n\r\n

\"\"<\/figure>\r\n\r\n\r\n\r\n

To ensure that your image is acquired and hashed correctly, TaskForce\u2019s ECC RAM does the following:<\/p>\r\n\r\n\r\n\r\n