±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 5
New Yesterday: 12
Overall: 26994
Visitors: 63

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Quicker Forensic Imaging?

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next 
  

Quicker Forensic Imaging?

Post Posted: Wed Apr 23, 2014 2:06 pm

Hello all,

My work is based around scene-of-crime data collection, and I am often frustrated by the speed of imaging hard drives, particularly if we need to leave the laptop/pc where it is.

Has anyone on here heard of, or used, Ballistic Imager? I've been doing some research and this seems like the fastest solution at the moment, claiming around 5 minutes for 128GB drive, forensically imaged.

I've pinged the company an email so I'll wait to hear from them too. Happy to post any feedback if it's any good, or has anyone already used it?

Cheers,

Mark  

markl1975
Senior Member
 
 
  

Re: Quicker Forensic Imaging?

Post Posted: Wed Apr 23, 2014 2:33 pm

Mark

Using any industrial imager device, has limitations and is dependable upon architecture, of the drive and equipment.

for example try getting that speed with a 200GB IDE drive.

now i have a PCIe SSD @ 1000mb/s and that will superseed that speed if imaged.

Ive had a look at the website and not really alot of valuable info.

I very rarely image now onsite, I request bag and tag. can do it then in the lab.


Mitch  

mitch
Senior Member
 
 
  

Re: Quicker Forensic Imaging?

Post Posted: Wed Apr 23, 2014 2:53 pm

Mitch,

Thanks for the reply. I agree, lab-based imaging is quicker, however the jobs I do are usually not bag-and-tag jobs. We often have to image quickly, and leave the target machines where they are.

FTK Imager and EnCase's Imager are OK, but not especially quick, and removing hard drives and imaging on-site with a TD3 or a Talon can be awkward.

I might see if I can get a demo from them to put it through it's paces.

Mark  

markl1975
Senior Member
 
 
  

Re: Quicker Forensic Imaging?

Post Posted: Wed Apr 23, 2014 6:08 pm

Imaging speed mostly depends on the speed of the drive.
From a coding point of view there are a few tricks, like doing large sequential reads and giving caching hints to the operating system. Beyond that however there isn't any magic fairy dust that will make the drive exceed it design specifications.

Pretty much any imaging tool will do 128GB drive in 5min, if the drive is fast enough. Most current solid state drives will get this kind of read performance.  

Passmark
Senior Member
 
 
  

Re: Quicker Forensic Imaging?

Post Posted: Wed Apr 23, 2014 6:50 pm

I'd be interested to see if the 128GB drive they used for testing contained any data, how much data and what type of data....

There are so many variables that can affect the imaging speed that any claim like that is always a 'best case scenario'.  

Adam10541
Senior Member
 
 
  

Re: Quicker Forensic Imaging?

Post Posted: Fri Apr 25, 2014 1:28 am

Hello,

I'm heading to the company next week for a demo.

They're not giving any demo software out at the moment, however I can go and see it running, and take some of my own hardware to run it against.

We'll see if it's any good.  

markl1975
Senior Member
 
 
  

Re: Quicker Forensic Imaging?

Post Posted: Fri Apr 25, 2014 2:16 am

Assuming they don't get you to sign an NDA or something, it would be interesting to hear your thoughts!  

Chris_Ed
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 10
Go to page 1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next