Destination drives ...
 
Notifications
Clear all

Destination drives smaller than the source drives

7 Posts
5 Users
0 Likes
565 Views
(@imsdal)
Posts: 17
Active Member
Topic starter
 

The day is finally here, usually we buy 3gb HDD's in bulk and the image process is no problem. However in one case right now the suspect had 4 disks, 8gb each. The destination drives is much smaller than the source drives.

How would you guys go ahead and image these? In fragments using FTK Imager? Won't that be a mess anyways? I would need to mount 3 Hdd's in order to index and examine the evidence.
How will the fragmented, i.e 01.E01, 02.E01 etc affect the hash values?

 
Posted : 16/05/2018 2:24 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

As calimelo suggested, since you need a temporary solution for this task only, having handy the original source drives if anything goes wrong, it is pretty safe to create a RAID0 (stripe) from the smaller drives you got.

For the long run I really suggest you to get drives big enough to handle your tasks. Please don't rely on a temporary solution like this, because if any fault occurs on any of the RAID0 members, it will cause total data loss!

 
Posted : 16/05/2018 7:01 pm
Passmark
(@passmark)
Posts: 376
Reputable Member
 

How full are the source drives?

And what kind of content do the source disks contain? Some file types compress really well, others won't compress at all as they are random data, encrypted data or already compressed.

If the disks aren't full then, if you were desperate, you could just take the files and ignore the free / allocated space (Sometimes called a logical image). Depends on the nature of the job as well.

If you don't have RAID hardware have a look at Storage Spaces in Win10
https://support.microsoft.com/en-au/help/12438/windows-10-storage-spaces
(note that I haven't tried it myself, but it seems like it should work)

 
Posted : 16/05/2018 10:20 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Hey guys, Dynamic Disks anyone?

They are around since Windows 2000, no need for fancy RAID hardware.

Of course a more recent Windows will be needed to use 3 TB disks, but anything Vista or later would do, and since OP is already using them, it means that he already has a 2TB+ compatible OS.

jaclaz

 
Posted : 17/05/2018 8:25 am
Passmark
(@passmark)
Posts: 376
Reputable Member
 

Dynamic disks are now considered deprecated.

See,
https://msdn.microsoft.com/en-us/windows/compatibility/vds-is-transitioning-to-windows-storage-management-api

 
Posted : 18/05/2018 1:58 am
(@athulin)
Posts: 1156
Noble Member
 

Dynamic disks are now considered deprecated.

That seems to be relevant for anyone creating storage solutions, i.e. using dynamic disk management APIs and tools as an architectural component in applications or systems. Basically, if you base your solution on VDS API, you may be in for a surprise as Microsoft is going towards WMI instead.

But is that the suggested usage here? I got the impression that it was more of a 'how do we solve this particular problem in this particular case?' question.

The 'depreciation period' mentioned in the cited page is not stated, it seems. The table suggests that it may be related to the transition from VDS API to WMI as well as the transition from Disk Management GUI to Powershell etc., but nowhere is there an indication that backwards compatibility will be lost entirely in a near future, only that current management solutions are being transitioned.

As long as it's a temporary solution, and in the absense of indications of disk structure support going end-of-life I wouldn't worry too much. If the images are something that needs to be archived for multiple years, support for dynamic disk on-disk structures will be necessary to keep track of, of course. But that is true for RAID solutions as well. I'd try to verify that some current Linux is able to read the resulting disc structure, and add a copy of it to the archive as a alternative access method in case Windows 11 drops support for dynamic disk HDDs altogether.

 
Posted : 18/05/2018 5:05 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Dynamic disks are now considered deprecated.

See,
https://msdn.microsoft.com/en-us/windows/compatibility/vds-is-transitioning-to-windows-storage-management-api

And … ? ?

It is not about starting the development of a new backend storage to a cloud and IOT based framework 😯 , it is just §@ç#ing storing temporarily some data in a convenient way for analysis.

I will go further, stating that Dynamic Disks worked just fine for at least 18 years, over at least 5 "major" Windows OS releases, whilst Storage Spaces, which most probably are indeed and nonetheless the third best thing in the world after sliced bread and icecream wink , are largely untested and far from being proven to be "reliable".

Also, even if admittedly Dynamic Disks have never been "popular" or "common", it is not like since 2017 all the data stored on hard disks using them has become unreadable …

To make an easy comparison, 16-bit computing has been deprecated since a lot of time (and they are starting to deprecate 32-bit) but it is not like a good ol' DOS program sopped working because of the deprecation [1].

jaclaz

[1] as a single data point, I keep using a very vertical accounting system that runs on DOS because it just works (and yes the Windows version of that same program has a lot of -fancy - more features that I don't need and like most of the competitors I tested it is much less straightforward in actual operation).
The underlying database is DBASEIII, that has been probably been "deprecated" circa 1995, yet it simply works (for the simple things it has to do).

 
Posted : 18/05/2018 9:52 am
Share: