±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 13
Overall: 26773
Visitors: 69

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

why is Imaging data folder size not equal to the total size

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 9:27 am

why is Imaging data folder size not equal to the total size of contents? (Using FTK imager Lite 3.1.1)

I have a folder with excel,word,and nsf e-mail files inside and then I got imaging by FTK Imager Lite and created AD1 files.
When I select the Original folder properties and check the folder data size (not size on disk), it is 950GB .
However, After aquired image ,if I select AD1 image data folder and check the total sizes of the files (not size on disk), it is 690GB .

This should be caused something different. My question is why is the size of a AD1 image file folder not equal to the total size of original contents?

Please advice. Thank you in advance.  

Kyoko
Newbie
 
 
  

Re: why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 9:34 am

Did you enable/select compression?
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
  

Re: why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 10:01 am

- mscotgrove
Did you enable/select compression?


Thank you for your advice mscotgrove.

I didn't know "compression flag" . Is the compression flag default value True? (compress enable?)

This is my first acquisition server data and using FTK Imager Lite.

Thanks.  

Kyoko
Newbie
 
 
  

Re: why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 1:54 pm

With much of forensic investigation it is understanding tools, what they can do etc etc.

Look at the program again and work out this process can be comnpressed.

I do not use FTK but I am aware that many image formats do have comnpressed versions.
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
  

Re: why is Imaging data folder size not equal to the total size

Post Posted: Fri Nov 23, 2012 8:18 pm

- mscotgrove
With much of forensic investigation it is understanding tools, what they can do etc etc.

Look at the program again and work out this process can be comnpressed.

I do not use FTK but I am aware that many image formats do have comnpressed versions.


mscotgrove
Thank you very much your advice.  

Kyoko
Newbie
 
 
  

Re: why is Imaging data folder size not equal to the total s

Post Posted: Sun Nov 25, 2012 10:39 pm

default is an initial compression level of 1 is on and listed as "fastest" go to 0 for no compression.
_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 

armresl
Senior Member
 
 
  

Re: why is Imaging data folder size not equal to the total s

Post Posted: Mon Nov 26, 2012 10:22 am

- armresl
default is an initial compression level of 1 is on and listed as "fastest" go to 0 for no compression.


armresl Thank you for your advice.

I checked default value of "Contents of folder" compression:level 6
Additionally,physical drive acquisition compression :level=0 (default)

Thank you. Smile  

Kyoko
Newbie
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1