Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20112

Forensic Hardware: anyone knew more about TD2 e01 Compression Methodology?

$
0
0
I don't have a TD2 to test with, but the TD1 uses empty block compression when imaging to E01. Basically, when it reads in a chunk of data, it evaluates it to see if it is all zeroes. If so, it will compress that chunk/block, if not it writes it out as is (no compression). Note that the entire chunk/block read must be all zeroes or no compression is used. You can test this yourself by wiping a disk to all zeroes and imaging, then wipe the disk with another bit pattern (0xFF for example) and image again. The zero wiped disk will compress to almost nothing and the 0xFF disk will have no compression at all.

Viewing all articles
Browse latest Browse all 20112

Trending Articles