Hi all
Ive got a huge imaging job on over 300 exhibits. I have created DD's of the drives.
Question is can I zip the DD files to reduce space I have purchased over 15 3TB hard drives to accomodate the images.
Im just worried of failure etc. any ideas?.
I think It would be ok for small images, but I dont think it would be benificial on a 500GB Image ?
Mitch
Hm. I dunno - but one option could be to require them using e.g. FTK Imager and then choose to compress them into .e01 files?
Hi all
Ive got a huge imaging job on over 300 exhibits. I have created DD's of the drives.
Question is can I zip the DD files to reduce space I have purchased over 15 3TB hard drives to accomodate the images.
Im just worried of failure etc. any ideas?.
I think It would be ok for small images, but I dont think it would be benificial on a 500GB Image ?
Mitch
Convert the images to an EWF/E01 format.
Same compression format as zip but with error checking.
Checkout the tools from libewf
http//
I know that, I started doing that last night converting to e01, just wondered if there was any other alternatives.
Little hard drives not a problem, but 2 and 3tb are a nightmare re time
Regards
Mitch
AFF also has compression options, and I think they also have error checking.
There is no magical compression scheme that is going to make 2 or 3 terabytes shrink down substantially (to a greater percentage than any other drive). Big drives compress down to big files. Just a fact of life.
You could do a test of E01 and AFF to see which will make for a smaller resulting files. I'd be interesting in hearing your results.
If you like the examiner that you are sending this to, for the love of all that you hold dear, do not zip a split DD.
I received a multipart zip of a split DD and it took a long time to unzip and then to recombine, it took a lot of disks and did I mention that it took a LOT of time.
As was previously suggested, use E01 with compression in 2GB chunks and then copy as many chunks onto a disk as will fit. Then the person that has to use them will just need to mount all the drives so they have access to the E01s or copy them to a RAID.
Presuming you are not working on the image, why would you not compress the image?
Hi all
Ive got a huge imaging job on over 300 exhibits. I have created DD's of the drives.
Question is can I zip the DD files to reduce space I have purchased over 15 3TB hard drives to accomodate the images.
Im just worried of failure etc. any ideas?.
I think It would be ok for small images, but I dont think it would be benificial on a 500GB Image ?
Mitch
Question is can I zip the DD files to reduce space I have purchased over 15 3TB hard drives to accomodate the images.
Im just worried of failure etc. any ideas?.
You can. But you take some added risks.
A hard drive failure will lose the entire drive contents (though with some possibilitiues of recovery – at a cost). You face that risk regardless of if you compress the drive or not. (So *large* single drives would mean large loss when disaster strikes.)
Zip compression makes the single files more sensitive to bit errors a single bit error will throw a simple-minded stream compression method totally off course from that point for that one file in the zip archive (spanned files are different). With a block compression method, the error will be restricted to the block – surrounding blocks will not be affected.
Not sure about .E01 files – I think compression is block-based, and synchronized with the checksummed data blocks, but I'm not entirely certain.
When the error happens, it's a question of what options you have to recover. If you use only zip, you lose the contents of the file in which the error appears (for spanned files, I believe you lose the part in that ZIP archive . And you will need some pretty good connection between the unzip software (which must continue to extract data), and your forensics platform, which needs to be told of the lost sectors.
With E01 (assuming block-encryption), you lose whatever number of sectors you have configured – default is 64. And again, you may need to ensure that your software platform does the right thing, but in this case it is easier to do the right thing from the start. That is, you lose a part of the case, corresponding to that number of sectors. For very small cases, with large block sizes, compression may consequently be more of a threat than a solution.
If you use, say, a RAID 1-based storage solution to let the raid handle these first-level problems – recovery is easy, also if an entire HDD dies on you. And that is entirely independent of compression. On the other hand … you need twice the storage size.
It's a question of what risks you are prepared to take, and what kind of insurance and at what level you want to buy.