Thunderbolt Ripe for Forensics

USB3 is a nice-to-have option for portable forensics as it is becoming more mainstream in external hard drives. With a raw performance of 4 Gbps (more like 3 Gbps after overhead, and I’m not counting the “SuperSpeed” 5 Gbps implementation), it’s a nice alternative to eSATA as it’s included on more and more laptops that still don’t have eSATA. There have been some awesome USB3 devices demoed recently, like the new Patriot Supersonic Magnum. I personally can’t wait to have 128 GB of storage that drops 200 MB/s speeds in my pocket (there’s probably a good joke in that statement somewhere).

I’ve been very pleased with eSATA in my lab for the past couple years, and I’m not ready to make any changes just yet, but boy did Thunderbolt (née Light Peak) take me by surprise. I’m quite certain I read something last year about Light Peak, but I didn’t get the impression it was going to show up this soon. I’m sure Apple fanboys are very excited about the thought of this being present on new MacBook Pros, because it out-specs any other removable storage tech for laptops out there. I’m excited that other vendors will be forced to pick it up now that Apple has implemented it (not that I don’t like Apple products, but they’re generally not my first choice due to various limitations). The designers of Thunderbolt plan for the bandwidth to reach 100 Gbps in the next ten years. Of note, the latest spec of DisplayPort is already humming at 17 Gbps, but DisplayPort is solely used for video; Thunderbolt will be extremely versatile in its uses. If you work in forensics and you’re not gushingly excited by faster transfer rates for external storage, I might have to ship you a defibrillator.