datahaze
Data Recovery Novice
Posts: 76
Joined: Mon Jul 16, 2018 7:14 pm

Default to raw format?

Sat Aug 25, 2018 1:01 am

Is there a way to have the Data Extractor store data in raw/dd format by default? Exporting images every time is getting to be a bit dull.

User avatar
Jared
Forum Admin
Posts: 3492
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Default to raw format?

Sat Aug 25, 2018 8:46 am

Yes, just select "External File" as the destination. That'll image to just a raw image. However, there's a major drawback to this. If you try to skip ahead, say to start imaging from the higher LBAs, it'll hang for a really really really long time while it zero fills up to that area. So if you're trying to image a 1Tb drive from the back to the front, it'll hang until it's done writing 1Tb of zeros.

The other option is to just mount the task in DE, but that's a bit slow for scanning.

If you expect to do a lot of logical scanning afterward, it's probably best to use a physical drive as the destination rather than image files.

datahaze
Data Recovery Novice
Posts: 76
Joined: Mon Jul 16, 2018 7:14 pm

Default to raw format?

Sat Aug 25, 2018 2:10 pm

Thanks Jared and good to know about it pre-filling the spots, that's a pretty major drawback.

datahaze
Data Recovery Novice
Posts: 76
Joined: Mon Jul 16, 2018 7:14 pm

Default to raw format?

Wed Nov 07, 2018 4:33 pm

Update: The pre-filling problem doesn't happen for me. "External file" works just fine, I assume it's just making a sparse file. This is on a NTFS destination.

hdd00
Data Recovery Noob
Posts: 45
Joined: Fri Apr 10, 2015 4:37 am

Default to raw format?

Thu Nov 08, 2018 12:02 am

It happens only when you do backward imaging and it depends off the size of the drive....On bigger drives it takes very long time before it actually start to image.

datahaze
Data Recovery Novice
Posts: 76
Joined: Mon Jul 16, 2018 7:14 pm

Default to raw format?

Thu Nov 08, 2018 12:24 am

I've done this with 4TB drives and going backwards it starts reading in a matter of seconds. Maybe you're writing to a filesystem that doesn't support sparse files like a network share? Sparse files eliminate any need to pre-allocate all the space. Well, you do pre-allocate, but instead of writing "0" ten million times, you just have to write "0x10,000,000". This is an over-simplification but you get the idea.

Return to “PC-3000 Forum”

Who is online

Users browsing this forum: No registered users and 0 guests