why is Imaging data folder size not equal to the total size of contents? (Using FTK imager Lite 3.1.1)
I have a folder with excel,word,and nsf e-mail files inside and then I got imaging by FTK Imager Lite and created AD1 files.
When I select the Original folder properties and check the folder data size (not size on disk), it is 950GB .
However, After aquired image ,if I select AD1 image data folder and check the total sizes of the files (not size on disk), it is 690GB .
This should be caused something different. My question is why is the size of a AD1 image file folder not equal to the total size of original contents?
Please advice. Thank you in advance.
Did you enable/select compression?
Did you enable/select compression?
Thank you for your advice mscotgrove.
I didn't know "compression flag" . Is the compression flag default value True? (compress enable?)
This is my first acquisition server data and using FTK Imager Lite.
Thanks.
With much of forensic investigation it is understanding tools, what they can do etc etc.
Look at the program again and work out this process can be comnpressed.
I do not use FTK but I am aware that many image formats do have comnpressed versions.
With much of forensic investigation it is understanding tools, what they can do etc etc.
Look at the program again and work out this process can be comnpressed.
I do not use FTK but I am aware that many image formats do have comnpressed versions.
mscotgrove
Thank you very much your advice.
default is an initial compression level of 1 is on and listed as "fastest" go to 0 for no compression.
default is an initial compression level of 1 is on and listed as "fastest" go to 0 for no compression.
armresl Thank you for your advice.
I checked default value of "Contents of folder" compressionlevel 6
Additionally,physical drive acquisition compression level=0 (default)
Thank you. )