1

I want take a forensic image of an hard disk. However I am a little confused on which format should I take the image. DD (raw) or E01? What are the advantages and disadvantages of each?

Improve this question

1 Answer 1

Reset to default
2

It comes down to what you want to do with the image once you've created it. If you're going to be using Encase Forensic to dig through it, or performing lots of searches on it, you're probably better off going for E01 format, since it is optimised for those use cases. It also has built in checksumming, which is important if you are copying data over less than ideal means.

On the other hand, if you're looking to investigate the image using standard Linux tools, you can mount a raw image and operate on it without any third party tools. However, that's pretty much the only way to operate on it - which gets unwieldy with larger images.

E01 has built in compression support, when used with Encase software, but raw images can be compressed using third party software (although the amount of compression will vary massively based on the image contents). E01 files can also contain metadata, which is useful when you want to add notes to, for example, deleted files.

A good place to look for information on forensic tools and software is the Forensics Wiki - which has a list of different file formats and their pros and cons.

Improve this answer
2
  • I read somewhere that searching is comparatively fast in raw format. Is there any truth to it? I will be using ftk for my analysis
    – Airbourne
    Mar 29, 2016 at 16:34
  • 2
    If there's the slightest chance legal gets involved use E01 due to the checksumming mentioned here. There are utilities for converting E01 to alternative formats though keep the original E01.
    – user2320464
    Mar 29, 2016 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .