A digital forensics company based in Canada called ellwood Evidence collects digital evidence on behalf of clients. It needed a solution which would allow it to flexibly relocate data between storage performance tiers and facilitate easy multi-site disaster-recovery/ cloud-bursting for extra processing capacity, should the need arise. William Ellwood, CISO of ellwood Evidence, explains why the company chose storageless data from Hammerspace and how it has simplified the handling of file data across multiple sites and the cloud.
ellwood Evidence is a 100% Canadian-owned digital forensics company based in Toronto that provides forensics and litigation support services across Canada. iPhones and Android smartphones, computers, security systems, tablets, photographs and videos, cloud-based social media services, cloud-based file storage services, USB sticks and backups along with filing cabinets of paper and archive boxes – it’s all potential evidence. ellwood Evidence has expertise in the preservation, analysis, review and presentation of modern evidence.
Today, ellwood Evidence uses an Edge, data centre, cloud multi-site topology to collect digital evidence on behalf of clients. Clients depend on ellwood to safely store digital evidence onto its systems for analysis, preservation and presentation while maintaining a strict and auditable chain of custody.
Storageless data solves ellwood Evidence’s multi-site data management and automation challenges
“Hammerspace is the file data platform we were looking for to build out our sophisticated hybrid cloud infrastructure,” said William Ellwood, CISO of ellwood Evidence. “We collect an enormous amount of data to preserve, analyse and present as evidence for our clients.
“It is essential to our business that the automation of data management makes it easy to maintain a transparent chain of custody. At the same time, we need that sensitive data readily available across multiple sites and the cloud for analysis and disaster recovery, with complete visibility across all sites and storage systems, while capacity costs are kept under control.”
Storageless data from Hammerspace uses a global file system enabling multi-site data management to reduce infrastructure complexity and cost while improving automation. With support for standard protocols NFS v4.2, v3 and SMB, Hammerspace easily supports all sorts of enterprise storage platforms making it the perfect solution for ellwood to service the diverse infrastructures of its client base.
ellwood Evidence increases automation while reducing complexity in a hybrid cloud environment
ellwood Evidence has greatly simplified the handling of file data across multiple sites and the cloud. With support for multiple open-standard protocols, like NFS and SMB, it has the flexibility to non-disruptively mobilise data on-demand across sites for archival, disaster recovery and analysis. Using metadata-based technology simplifies the file-granular automation of its data management workflows. This reduces the risk involved with human intervention which could potentially contaminate digital evidence.
Capacity costs are kept low as data is automatically tiered and optimised according to objectives defined in the metadata, while also maintaining critical data protection and availability across the hybrid cloud infrastructure, effectively making data storageless. Additionally, Hammerspace easily integrated into the existing infrastructure while opening a path for future development free from the limitations of a storage centric architecture.
Hammerspace helps ellwood Evidence maintain a leadership position in the field of digital forensics as it leverages advanced technologies like Global File System to extract the maximum value from its clients’ data.
William Ellwood, CISO of ellwood Evidence, tells Intelligent SME.tech more about how the storageless data from Hammerspace has helped the company grow.
How did you store data before?
We use Ceph and ZFS and we have not stopped using the existing storage. We still leverage Ceph and ZFS but instead of addressing each one as a silo, Hammerspace allows us to address and leverage all resources as a single logical pool of storage.
Why did you realise you needed a new system?
Hammerspace allows us to reuse and repurpose any existing storage, thus avoiding any disruption or painful data migration. Hammerspace allowed us to consolidate resources and automate our processes through Hammerspace’s unique data management capabilities.
What were the main reasons why you chose Hammerspace?
Firstly, to leverage our existing infrastructure and extend it with cloud services. We have internally built a strong existing open-source storage system, managed in-house. As our storage volumes grew and we matured as a firm, we wanted a solution which would allow us to flexibly relocate data between storage performance tiers and facilitate easy multi-site disaster-recovery/ cloud-bursting for extra processing capacity, should the need arise.
We wanted to continue using our existing storage infrastructure and afford ourselves the opportunity to incorporate new storage technologies as they arise into our existing stack, without any disruption to our production services. Many alternative vendors wanted to sell us either a hardware appliance or lock us into its own managed cloud systems. This would both entail a significant reconfiguration of our production systems and did not give us the flexibility we were looking for.
It has also allowed ‘plug-and-play’ backend storage changes without affecting users with downtime or disruptions.
How easy was the implementation?
The base implementation was very fast – we had it set up and functioning in an afternoon. However, we initially deployed it in a test environment and under-specced the storage. We scheduled our main production cut-over during the new year’s break, where we kicked off assimilation from our old servers, modified DNS entries and allowed the process to run. Linux permissions in our environment were correctly assimilated by Hammerspace on the fly (our own Samba servers were fudging the backend permissions a little for clients, so that needed to be corrected after assimilation was completed and Hammerspace was in control).
We used read-only assimilation on our existing servers, so that if anything went wrong, we could revert the change and go back to using our old servers. Thankfully, this was not necessary. We had a basic set of placement policies which met our immediate needs in the first week of testing, but it’s a very powerful system and now that we have been in production for six months and I have observed our application interactions ‘in-the-wild’, I have more policy/objective tuning planned.
How will the new storage enable ellwood Evidence to grow as a company?
Availability, integrity and confidentiality are key cornerstones in digital forensics. Hammerspace preserves and enhances availability through a global file system that makes data available ubiquitously throughout an organisation. Hammerspace programmable custom metadata ensures data integrity, protecting evidence from cross-contamination. Confidentiality is preserved by Hammerspace encryption capabilities which supports military-grade encryption and External Key Managers (EKM). This ensures that data remains confidential even when stored in public cloud.
Does it make life easier for employees? If so, how?
A global file system that offers multi-protocol access with global undelete and granular administrative declarative control ensures smooth operations and make life easier for staff. A global file system is a single source of truth, making it much easier to store, categorise and find data. Searching for data in a typical organisation is like looking for a leaf in a forest. Searching for data with Hammerspace Global File System is akin to looking for a leaf in a single tree. This saves time and enables employees to accomplish tHeir work faster and without frustration. For ellwood Evidence this translates to higher productivity and profitability.