why is Imaging data...
 
Notifications
Clear all

why is Imaging data folder size not equal to the total size

7 Posts
3 Users
0 Likes
636 Views
(@kyoko)
Posts: 4
New Member
Topic starter
 

why is Imaging data folder size not equal to the total size of contents? (Using FTK imager Lite 3.1.1)

I have a folder with excel,word,and nsf e-mail files inside and then I got imaging by FTK Imager Lite and created AD1 files.
When I select the Original folder properties and check the folder data size (not size on disk), it is 950GB .
However, After aquired image ,if I select AD1 image data folder and check the total sizes of the files (not size on disk), it is 690GB .

This should be caused something different. My question is why is the size of a AD1 image file folder not equal to the total size of original contents?

Please advice. Thank you in advance.

 
Posted : 23/11/2012 7:27 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

Did you enable/select compression?

 
Posted : 23/11/2012 7:34 pm
(@kyoko)
Posts: 4
New Member
Topic starter
 

Did you enable/select compression?

Thank you for your advice mscotgrove.

I didn't know "compression flag" . Is the compression flag default value True? (compress enable?)

This is my first acquisition server data and using FTK Imager Lite.

Thanks.

 
Posted : 23/11/2012 8:01 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

With much of forensic investigation it is understanding tools, what they can do etc etc.

Look at the program again and work out this process can be comnpressed.

I do not use FTK but I am aware that many image formats do have comnpressed versions.

 
Posted : 23/11/2012 11:54 pm
(@kyoko)
Posts: 4
New Member
Topic starter
 

With much of forensic investigation it is understanding tools, what they can do etc etc.

Look at the program again and work out this process can be comnpressed.

I do not use FTK but I am aware that many image formats do have comnpressed versions.

mscotgrove
Thank you very much your advice.

 
Posted : 24/11/2012 6:18 am
(@armresl)
Posts: 1011
Noble Member
 

default is an initial compression level of 1 is on and listed as "fastest" go to 0 for no compression.

 
Posted : 26/11/2012 8:39 am
(@kyoko)
Posts: 4
New Member
Topic starter
 

default is an initial compression level of 1 is on and listed as "fastest" go to 0 for no compression.

armresl Thank you for your advice.

I checked default value of "Contents of folder" compressionlevel 6
Additionally,physical drive acquisition compression level=0 (default)

Thank you. )

 
Posted : 26/11/2012 8:22 pm
Share: