I want take a forensic image of an hard disk. However I am a little confused on which format should I take the image. DD (raw) or E01? What are the advantages and disadvantages of each?
1 Answer
It comes down to what you want to do with the image once you've created it. If you're going to be using Encase Forensic to dig through it, or performing lots of searches on it, you're probably better off going for E01 format, since it is optimised for those use cases. It also has built in checksumming, which is important if you are copying data over less than ideal means.
On the other hand, if you're looking to investigate the image using standard Linux tools, you can mount a raw image and operate on it without any third party tools. However, that's pretty much the only way to operate on it - which gets unwieldy with larger images.
E01 has built in compression support, when used with Encase software, but raw images can be compressed using third party software (although the amount of compression will vary massively based on the image contents). E01 files can also contain metadata, which is useful when you want to add notes to, for example, deleted files.
A good place to look for information on forensic tools and software is the Forensics Wiki - which has a list of different file formats and their pros and cons.
-
I read somewhere that searching is comparatively fast in raw format. Is there any truth to it? I will be using ftk for my analysis Mar 29, 2016 at 16:34
-
2If there's the slightest chance legal gets involved use E01 due to the checksumming mentioned here. There are utilities for converting E01 to alternative formats though keep the original E01. Mar 29, 2016 at 17:15