±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 30794
New Yesterday: 8 Visitors: 106

±Latest Articles

RSS Feed Widget

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News   Forums   Articles

why is Imaging data folder size not equal to the total size

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 9:27 am

why is Imaging data folder size not equal to the total size of contents? (Using FTK imager Lite 3.1.1)

I have a folder with excel,word,and nsf e-mail files inside and then I got imaging by FTK Imager Lite and created AD1 files.
When I select the Original folder properties and check the folder data size (not size on disk), it is 950GB .
However, After aquired image ,if I select AD1 image data folder and check the total sizes of the files (not size on disk), it is 690GB .

This should be caused something different. My question is why is the size of a AD1 image file folder not equal to the total size of original contents?

Please advice. Thank you in advance.  

Kyoko
Newbie
 
 
  

Re: why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 9:34 am

Did you enable/select compression?
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 

mscotgrove
Senior Member
 
 
  

Re: why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 10:01 am

- mscotgrove
Did you enable/select compression?


Thank you for your advice mscotgrove.

I didn't know "compression flag" . Is the compression flag default value True? (compress enable?)

This is my first acquisition server data and using FTK Imager Lite.

Thanks.  

Kyoko
Newbie
 
 
  

Re: why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 1:54 pm

With much of forensic investigation it is understanding tools, what they can do etc etc.

Look at the program again and work out this process can be comnpressed.

I do not use FTK but I am aware that many image formats do have comnpressed versions.
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 

mscotgrove
Senior Member
 
 
  

Re: why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 8:18 pm

- mscotgrove
With much of forensic investigation it is understanding tools, what they can do etc etc.

Look at the program again and work out this process can be comnpressed.

I do not use FTK but I am aware that many image formats do have comnpressed versions.


mscotgrove
Thank you very much your advice.  

Kyoko
Newbie
 
 
  

Re: why is Imaging data folder size not equal to the total s

Post Posted: Sun Nov 25, 2012 10:39 pm

default is an initial compression level of 1 is on and listed as "fastest" go to 0 for no compression.
_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 

armresl
Senior Member
 
 
  

Re: why is Imaging data folder size not equal to the total s

Post Posted: Mon Nov 26, 2012 10:22 am

- armresl
default is an initial compression level of 1 is on and listed as "fastest" go to 0 for no compression.


armresl Thank you for your advice.

I checked default value of "Contents of folder" compression:level 6
Additionally,physical drive acquisition compression :level=0 (default)

Thank you. Smile  

Kyoko
Newbie
 
 

Reply to topicReply to topic

Share this forum topic to encourage more replies




Page 1 of 1