Join Us!

DD disk image vs EW...
 
Notifications
Clear all

DD disk image vs EWF size confusion  

  RSS
Suai
 Suai
(@suai)
New Member

I've just recently begun imaging disks using Guymager which allows imaging in both raw DD and EWF.

I was told DD imaging produced an exact image bit for bit and hence the image size should occupy the same as the original disk. EWF on the other hand compressed the data (grouping strings of 0's) and hence image sizes were smaller but took a little longer.

To my surprise, I recently imaged a 1TB HDD in DD format outputting a 32GB image file. I'm obviously missunderstanding something here so I was hoping someone could clear this up and maybe explain pros and cons of either format.

Quote
Posted : 06/02/2020 10:55 am
jaclaz
(@jaclaz)
Community Legend

To my surprise, I recently imaged a 1TB HDD in DD format outputting a 32GB image file. I'm obviously missunderstanding something here so I was hoping someone could clear this up and maybe explain pros and cons of either format.

No you didn't. 😯

The dd image size is exactly the same size of the source, which means that either you did not image the whole source disk or that the source disk is 32 GB and not 1 TB.

Maybe you created an AFF image accidentally?

Or, if you prefer, this is correct

I was told DD imaging produced an exact image bit for bit and hence the image size should occupy the same as the original disk. EWF on the other hand compressed the data (grouping strings of 0's) and hence image sizes were smaller but took a little longer.

(though EWF/E01 compression is more complex than simply "grouping strings of 0's")

jaclaz

ReplyQuote
Posted : 06/02/2020 11:26 am
Suai
 Suai
(@suai)
New Member

Allright just double-checked, bad explanation on my side, at least I'm not going crazy here and my basic understanding is still correct. I just checked properties of the image file.

Size 1TB
Size on disk 32,5GB

A google search just explained size on disk is normaly larger than the actual size of the file however, sometimes, due to built in compression, the file is actually smaller on the disk. I'm surprised there's such a huge difference and will have to double check again to see how much space is being occupied and is actually still available on the disk.

ReplyQuote
Posted : 06/02/2020 12:13 pm
minime2k9
(@minime2k9)
Active Member

Most likely a sparse file, especially if its on an NTFS drive.

ReplyQuote
Posted : 06/02/2020 12:39 pm
jaclaz
(@jaclaz)
Community Legend

Most likely a sparse file, especially if its on an NTFS drive.

Well, "normal" dd cannot produce a sparse file, and I don't think that Guymager can, so I doubt it.

@Suai
How long (roughly) did the imaging process take?
I mean, a few minutes or several hours?

jaclaz

ReplyQuote
Posted : 06/02/2020 1:37 pm
minime2k9
(@minime2k9)
Active Member

DDrescue on Guymager is capable of creating a sparse image.

Because the imaging is using Guymager as opposed to using the actual DD software on Linux, it wouldn't surprise me if it used sparse images if it detects the destination is NTFS.

It would be easy enough to check, all we would need is a copy of the MFT record for the file )

ReplyQuote
Posted : 06/02/2020 2:31 pm
jaclaz
(@jaclaz)
Community Legend

DDrescue on Guymager is capable of creating a sparse image.

Because the imaging is using Guymager as opposed to using the actual DD software on Linux, it wouldn't surprise me if it used sparse images if it detects the destination is NTFS.

It would be easy enough to check, all we would need is a copy of the MFT record for the file )

I see ) , didn't know that Guymager could create sparse images, though it is unusual that it will "decide" itself to do that if the target is NTFS, without the operator explicitly asking for it, and I couldn't find any reference about this feature.

Anyway there is no need to get the $MFT, a simple look at the file properties under windows is enough, or use fsutil sparse
https://ss64.com/nt/fsutil.html

jaclaz

ReplyQuote
Posted : 06/02/2020 4:52 pm
Rich2005
(@rich2005)
Active Member

NTFS compression enabled on the destination drive?

ReplyQuote
Posted : 06/02/2020 4:55 pm
raydenvm
(@raydenvm)
Junior Member

Allright just double-checked, bad explanation on my side, at least I'm not going crazy here and my basic understanding is still correct. I just checked properties of the image file.

Size 1TB
Size on disk 32,5GB

A google search just explained size on disk is normaly larger than the actual size of the file however, sometimes, due to built in compression, the file is actually smaller on the disk. I'm surprised there's such a huge difference and will have to double check again to see how much space is being occupied and is actually still available on the disk.

Yes, it's a sparse file. It is absolutely normal. Hashes will match if you double-check.

ReplyQuote
Posted : 07/02/2020 7:51 am
Share: