I have read here someday about a comparison of Encase generated images speed versus the size of the disk image.
Unfortunately I can't find this thread.
Anybody knows what I am talking about or maybe has done or seen such tests?
Such comparison depands on many factors of course but gives some info what compresion should be chosen if any.
Thanx )
I have read here someday about a comparison of Encase generated images speed versus the size of the disk image.
Unfortunately I can't find this thread.
Anybody knows what I am talking about or maybe has done or seen such tests?
Such comparison depands on many factors of course but gives some info what compresion should be chosen if any.
Thanx )
You sure it was Encase?
I remember this recent one (which is about FTK imager)
http//www.forensicfocus.com/Forums/viewtopic/t=10963/
jaclaz
https://
This one??
Those are my testing results.
i have some more tools to add to the list (time permitting).
if anyone has other tools they would like me to add to the list please let me know
Exactly this was mentioned topic jaclaz.
Great thanx. )
Now I see FTK Imager has been tested, not Encase, maybe this is the reason why I couldn't find correct topic.
Anyway well done test Larry, thanx.
@mscotgrove
I haven't seen this spreadsheet yet. Very interesting, thx )
Those are my testing results.
i have some more tools to add to the list (time permitting).
if anyone has other tools they would like me to add to the list please let me know
Dear Eric,
Very nice work.
Just have a question on the spreadsheet concerning FTK imager. How many times of verification were taken place? One on the suspect drive and another one on the acquired image? I ask this becoz the FTK imager took so much time comparing with other tools.
Ivan
No verification was done for any of the tools to keep things consistent. Ftk is just Ftk I'm guessing