±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 4 Visitors: 127

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Optimum E01 split

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

mrmoo28
Member
 

Optimum E01 split

Post Posted: Nov 06, 14 17:20

Hi all,

Just wondering if there was an optimum E01 file split size? In a previous company, we were instructed to set the E01 split at 2000/2048MB, however in my current company the standard seems to be to split at 1024MB.

Is there any optimum, or what factors are to be considered when deciding what size to split at? Or.... does it not really make much difference?

Thanks!  
 
  

keydet89
Senior Member
 

Re: Optimum E01 split

Post Posted: Nov 06, 14 17:48

Why split at all?  
 
  

mrmoo28
Member
 

Re: Optimum E01 split

Post Posted: Nov 06, 14 18:31

- keydet89
Why split at all?


Good question too - when I worked in eDiscovery in my previous job, we'd be splitting the E01s at acquisition, however when creating an L01 (or AD1 in some cases) for ingest into Nuix for data processing, we would ensure that it wasn't split at all!

Any further comments would be appreciated, just to satisfy my curiosity.  
 
  

4n6art
Senior Member
 

Re: Optimum E01 split

Post Posted: Nov 06, 14 20:40

I'm with KeyDet. Why split it?

The split option if I am not mistaken was when we did not have big-butt flash and hard drives so they could be burned to removable media. If you do not have a specific need to split your E01x I would keep it as one big file.

-=Art=-  
 
  

mrmoo28
Member
 

Re: Optimum E01 split

Post Posted: Nov 06, 14 20:52

Are there overheards then as a result of splitting the files? Say read access in EnCase, would it significantly improve if it's just one large file?

Thanks  
 
  

keydet89
Senior Member
 

Re: Optimum E01 split

Post Posted: Nov 06, 14 22:32

I'm not looking so much at performance/overhead, as simply the reason for splitting files in the first place.

I know that this used to be something that folks would do, particularly LE, as the images would be split into whatever the current serviceable size for CDs or DVDs might be. However, given the cost of storage, I'm not really sure that's much of an issue any longer.

I tend to go with a single raw/dd format file whenever I can, for simplicity sake and because it gives me the greatest possible range of compatibility.  
 
  

C.R.S.
Senior Member
 

Re: Optimum E01 split

Post Posted: Nov 06, 14 23:12

It's handy for any sort of portability: using space on smaller hard drives and network transfers which do not support resuming connections.
Let's say your network protocol supports resuming: Afterwards, the hash may indicate that your file is broken anyway - a 4 TB image, not one of more than 1.000 split files. The required hashing (file based, not image vs. source, of course) breaks down to individual split files, too.  
 

Page 1 of 1