sorry to thread jack but I have a question on Encase Compression. Using v. 6.10.2 I have acquired 2 120GB harddrives. Hardrive-A has 4.57GB used space indicated by Windows. After acquisition the size of the evidence file was only 3.57GB. Harddrive-B has 17.8GB used space indicated by Windows. After acquisition the size of the evidence file for HD-B was 52.7GB. This was done using Good compression. In case I need to testify, can someone interpret why this is so? Thank you so much for your help!!
sorry to thread jack but I have a question on Encase Compression. Using v. 6.10.2 I have acquired 2 120GB harddrives. Hardrive-A has 4.57GB used space indicated by Windows. After acquisition the size of the evidence file was only 3.57GB. Harddrive-B has 17.8GB used space indicated by Windows. After acquisition the size of the evidence file for HD-B was 52.7GB. This was done using Good compression. In case I need to testify, can someone interpret why this is so? Thank you so much for your help!!
My posting earlier in this thread also applies to your situation
- the data on the source drive can impact the 'compressibility' of the image, for example a drive that has been wiped with zeroes before installing an OS on it will result in a smaller image than a drive that has been wiped with random data
You have to realise that the data in your image does not only contain the used space that Windows indicates, but also the unallocated space (freespace/slackspace). Any data remnants in that space will thus have to be compressed as well and the result of that depends on the type of data.