0

I am using a forensic disk imaging tool to make an Encase (E01) disk image of a 4TB hard drive. 3.19TB of space is actually used on this disk. The resultant disk image is 2.82TB in size. No compression options were employed, so why is the disk image smaller than the used space on the HDD?

One hypothesis of mine is that by default the format does compress null data, and that because the disk contains 288,137 files, there are enough partially used blocks, that collectively add up to the 370GB difference. Then again, this would equate to roughly 1,284,111 bytes per file, which simply doesn't add up.

Also worth noting that I've "unpacked" the disk image, and did a diff of the file listing between the source and the original disk, and there are no files of significance on the disk that were omitted from the image (just a few hidden OS X files that were likely created after the imaging process).

Any thoughts? What's up with that 370GB difference?

2
  • Which disk imaging tool did you use to create the disk? It might be useful to look at Joachim Metz's EWF specification included in libewf for potential leads about why this might be the case. Feb 17, 2016 at 16:17
  • Thanks @anarchivist! We're using the Mac CLI version of FTK Imager
    – dongle
    Feb 17, 2016 at 16:21

0

You must log in to answer this question.

Browse other questions tagged .