How Much RAM Does a Forensic Workstation Need?

🔍 Short answer: 128GB is the working standard, 256GB is the heavy-caseload tier, and 64GB is an imaging station, not an analysis machine. Here's how to tell which one you are — and why the number on the software box won't tell you.

Why the minimum spec is misleading

Every forensic suite publishes a minimum RAM requirement, and every one of them is technically true — the software will open. What the minimum describes is a machine that can load a demo dataset. It does not describe a machine that can process a 2TB drive image with two phone extractions attached, build the index, and let you search it the same afternoon.

Forensic tools are memory-hungry in a specific way: processing engines cache artifact databases, indexes, and carved media in RAM because reading them off a drive is orders of magnitude slower. When RAM runs out, the machine doesn't crash — it swaps to disk and your processing time stretches from hours into days. Nobody reports "my workstation is slow." They report "this case took a week." It's usually the same sentence.

The four tiers, honestly

64GB — the imaging station. Dedicated acquisition box: write-blocked imaging, hash verification, light review of small cases. Perfectly good at that job. It stops being enough the day you ask it to process a modern multi-device case while you work on another.

128GB — the working standard. This is where a full-time examiner should start. One major case processing in AXIOM, FTK, or X-Ways while you examine another, run reports, and keep a browser and Office open without the machine negotiating with itself. Most single-examiner workstations we build sit here, because most caseloads do.

256GB — the heavy caseload tier. Multiple devices per case — computer plus two phones plus cloud returns — large media collections for tools like Griffeye, or a suspect image running in a virtual machine beside your processing job. If your unit's backlog is measured in months, this is usually the tier that's missing.

512GB — the lab hub. Shared processing machines, several cases or VMs running concurrently, and analysis of large RAM captures at scale. Not an everyday examiner spec — a deliberate purchase for a deliberate role.

Two things that matter more than the number

Bandwidth feeds cores. A 32-core processor reads memory through channels. An 8-channel platform (Threadripper PRO on WRX90) moves roughly four times the data of a dual-channel desktop — capacity without bandwidth starves the CPU you paid for. This is why workstation platforms, not gaming platforms, are the right starting point.

Buy the DIMMs you'll finish with. Workstation boards run memory at full rated speed with one DIMM per channel. If you think you'll end at 512GB, buy 64GB DIMMs now — filling every slot with small sticks means throwing them away to upgrade. RAM you buy twice is the most expensive RAM there is.

The rule we give every lab

Spec for the case you'll get in year three, not the case on your desk today. Devices get bigger, extractions get deeper, and the workstation you buy this year will meet its hardest case two years from now. RAM is the cheapest performance in the entire build — and the most expensive thing to run short of.

Every Ordertek workstation ships with ECC Registered memory — when your output may be read back in court, memory that silently corrects its own errors isn't a luxury. Built in Canada, priced in Canadian dollars, 3-year hot-swap warranty. Tell us your caseload and we'll tell you your tier.