Have a project coming up that will require imaging storage media that is reported to have only PST files and associated attachments from a corporate email server.
Volume is at least 1 TB and may be greater (should know more later on how large the volume actually is).
Likely going to acquire at least one external 2TB storage device (or multiple drives as needed); this will be a rush agency purchase in the next week or so.
If multiple drives need, any suggestions to deal with incomplete files due to storage limitations?
- What advice can you provide for this project?
- Any recommended drives? Open to HDD but I would like agency to obtain SSD, since my agency laptop has Thunderbolt 4Â
- Any recommended tools? Â
Roughly how much time should it take to image each TB of .PST+ files?
Â
Â
i think its better to use one hd if you can get ssd its better and analyse it with nuix or axiom and then to relativity for the ediscovery its will take you time 2 tb its a lot off media
For imaging speed with reasonable hardware see this post
https://www.forensicfocus.com/forums/forensic-software/fastest-forensics-disk-image/#post-6605637
We managed to do 0.5TB drive in 4min 35sec. So 1TB would be ~9min. This was USB3.2. Thunderbolt 4 is in theory faster.
But don't use E01 format if speed is important. Could be 20x slower.
Do use E01 if your destination drive is a little too small however.
I suspect you will be limited by the hardware speed of the source drive however. Which sounds like it is out of your control.
While there are convoluted schemes for splitting images across multiple drives you save a lot of time (and thus money) by having a single big enough destination drive.
Also do you need a full disk image? Maybe you can take logical image (i.e. just the PST files) if time, money & storage space are an issue.
Â
Â