search

fox-it / dissect.target

The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).
GNU Affero General Public License v3.0
38 stars 42 forks source link

Guestmount x10 times faster than dissect.target #682

Closed avizack18 closed 2 months ago

avizack18 commented 2 months ago

We've observed that Guestmount can be up to 10 times faster than dissect.target when processing certain workloads. While the exact cause needs further investigation, here are two potential explanations:

Multithreaded Support: Guestmount might be leveraging multithreading capabilities more effectively than dissect.target. This could allow Guestmount to distribute the workload across multiple cores, significantly improving processing speed on modern CPUs.

Faster Parsing: It's possible that Guestmount implements a faster parsing algorithm for the specific data format being processed. This could lead to significant performance gains compared to dissect.target.

Schamper commented 2 months ago

Hi @avizack18, thanks for reaching out. Good observation that guestmount can be faster in certain workloads. It's important to note that guestmount and dissect.target fulfill two very different purposes. Dissect is more focused on IR workloads where hackability and flexibility are often more important than raw performance. That of course doesn't mean that we don't value high performance - we still improve performance where we can.

As this issue doesn't address anything specific, I will close it. If you have any specific topics or points of improvements in the future, feel free to create another issue!