How a legal technology and digital forensics provider escaped generic virtual desktop limitations and gained the performance, flexibility, and cost control forensic operations demand.
Orbital Data Consulting Inc. was spending too much on AWS Workspaces while getting too little performance. Generic virtual desktops weren't built for forensic workloads. The compute and storage maxed out on large cases, and the access model frustrated investigators. After migrating to Stratus, they gained the performance forensics demands, the flexibility for two distinct teams, and $1000/month in automatic savings all while maintaining ISO 27001 accreditation.
This case study is for:
Orbital initially adopted AWS Workspaces as a default solution from their AWS intermediary, what seemed like a straightforward path to cloud-based forensics was anything but. As their operations matured, the limitations of a generic virtual desktop solution became increasingly apparent:
"We'd hit a ceiling with Workspaces, every time we took on a larger case or tried to scale up, we ran into another limitation. We needed something built for forensics, not re-purposed office desktops."
AWS Workspaces offered limited instance types that weren't optimised for forensic processing. Processing large mobile extractions or running multiple forensic tools simultaneously would bring workstations to a crawl, extending case timelines significantly. Processing a large iPhone extraction that should take 6 hours would stretch to 12+ hours, delaying case timelines and frustrating clients. There were limited opportunities to increase the compute capacity.
The storage options available through Workspaces couldn't keep pace with modern evidence volumes. Investigators resorted to awkward workarounds like splitting evidence across multiple volumes or shunting data to S3 manually, adding friction to every large case.
Workspaces' access model didn't align with typical forensic workflows. The dedicated client requirement meant investigators couldn't quickly jump on from a different machine during court testimony prep or when collaborating with colleagues. The 1:1 user/workspace model made it impossible for multiple analysts to review the same evidence, a common need in complex cases.
Orbital selected Stratus as their new forensics platform, infrastructure designed specifically for digital forensics workloads, not adapted from generic virtual desktop services.
A key requirement was that their forensic practitioners shouldn't need to learn AWS. Stratus delivers exactly that: point-and-click provisioning of compute and storage resources. Investigators select what they need from a simple interface, no VPCs to configure, no IAM policies to understand, no AWS console access required. The platform abstracts away the cloud complexity while providing access to the full range of AWS compute power and storage performance.
Orbital set up their own admins with the permissions to provision resources, resize volumes, and manage the platform. No tickets to an AWS intermediary, no waiting on external IT teams. When a case suddenly requires more storage or a high-performance workstation, their team handles it immediately. The forensic operation stays in control of its own infrastructure without needing AWS expertise or depending on outside approval cycles.
"The self-service aspect was critical for us. We can't wait 24 hours to approve a storage increase when we've just received a 4TB evidence dump. Our designated admins handle it in minutes, and our investigators stay productive."
Orbital operates two distinct teams, an e-discovery, and digital forensics with different operational models, and Stratus accommodates both seamlessly:
Both teams work within the same Stratus platform, with unified management and visibility, but with workflows tailored to their specific operational needs.
Stratus provides a natural barrier that isolates forensic analysis in a safe, known environment critical when handling potentially malicious evidence or sensitive case data. At the same time, enterprise SSO integration means investigators authenticate through Orbital's existing identity provider, with full support for conditional access policies and centralised user management. Security and convenience, without compromise.
Orbital maintains ISO 27001 certification, renewed again this year, and Stratus fits seamlessly within their information security management framework. The platform's audit logging, access controls, and documented processes support ongoing compliance without creating additional administrative burden.
The migration from AWS Workspaces to Stratus was completed without disrupting ongoing casework:
"The switch was remarkably smooth. Our investigators were productive on day one. The interface is intuitive and they didn't need any AWS training. It's exactly what practitioners need."
One of the most immediate benefits was clear insight into infrastructure costs. Stratus provides real-time dashboards showing exactly where spend is going, with per-workstation and per-team breakdowns.
The auto-stop feature has delivered significant savings. Stratus intelligently detects when workstations are idle but understands forensic workflows, and won't shut down machines with active processing jobs. When investigators finish for the day or step away, workstations automatically power down, eliminating the cost of forgotten running instances.
"The cost visibility alone was eye-opening, now we finally understand exactly where our infrastructure spend goes, and the auto-stop feature pays for itself. We're getting more capability for less money."
| Metric | AWS Workspaces | Stratus |
|---|---|---|
| Monthly cost (20 instances) | ~$2,000+ | ~$1,000 |
| Large case processing time | 12+ hours | 6 hours |
| Storage per workstation | Limited to bundle | Up to 64TB |
| AWS expertise required | Moderate | None |
| Setup for new investigator | 30+ min | < 5 min |
As a cloud-native platform, Stratus has shielded Orbital from the storage and memory price increases that have hit on-premise labs over the past 18 months. While labs with physical infrastructure face budget pressure from rising hardware costs, Orbital's monthly spend with Stratus has remained stable, and with auto-stop savings, actually decreased.
For labs evaluating capital expenditure versus cloud operations, this pricing stability represents predictable budgeting without the risk of hardware refresh cycles coinciding with market volatility.
Under the hood, investigators have access to the full spectrum of AWS compute options and high-performance storage. But from their perspective, it's simply selecting the resources they need from a clean interface:
This is exactly what forensic practitioners need: enterprise-grade capability without enterprise-grade complexity.
| Capability | AWS Workspaces | Stratus |
|---|---|---|
| Compute Performance | Workspaces instance limits | Full AWS instance range |
| Storage Capacity | Workspaces volume limits | Up to 64TB, 256K IOPS |
| Access Method | Dedicated client required | Any modern browser, SSO |
| AWS Knowledge Required | Moderate (workarounds needed) | None (point-and-click) |
| Team Flexibility | One-size-fits-all | Traditional & ephemeral models |
| Cost Visibility | Limited | Real-time dashboards, auto-stop |
| Resource Management | IT tickets required | Self-service admin controls |
"How much we were leaving on the table with Workspaces. We thought we were being cost-effective by using Workspaces, but between the performance limitations forcing us to run cases longer, and instances running 24/7 because there was no smart shutoff, we were actually overspending for under-performance. Stratus flipped that equation. Being able to self-manage resources without logging tickets means we move at the speed of the investigation, not the speed of someone else's IT queue."
Stratus provides turnkey cloud infrastructure for digital forensics labs. Deploy forensics workstations anywhere in the world through a browser, no complicated setup, no vendor lock-in, no AWS expertise required. Maintain complete control over your evidence while we handle all infrastructure complexity.
Whether you're exploring cloud forensics for the first time or looking to optimize an existing deployment, we're here to help.