Default to raw format?

datahaze

Member
Is there a way to have the Data Extractor store data in raw/dd format by default? Exporting images every time is getting to be a bit dull.
 

Jared

Administrator
Staff member
Yes, just select "External File" as the destination. That'll image to just a raw image. However, there's a major drawback to this. If you try to skip ahead, say to start imaging from the higher LBAs, it'll hang for a really really really long time while it zero fills up to that area. So if you're trying to image a 1Tb drive from the back to the front, it'll hang until it's done writing 1Tb of zeros.

The other option is to just mount the task in DE, but that's a bit slow for scanning.

If you expect to do a lot of logical scanning afterward, it's probably best to use a physical drive as the destination rather than image files.
 

datahaze

Member
Update: The pre-filling problem doesn't happen for me. "External file" works just fine, I assume it's just making a sparse file. This is on a NTFS destination.
 

hdd00

Member
It happens only when you do backward imaging and it depends off the size of the drive....On bigger drives it takes very long time before it actually start to image.
 

datahaze

Member
I've done this with 4TB drives and going backwards it starts reading in a matter of seconds. Maybe you're writing to a filesystem that doesn't support sparse files like a network share? Sparse files eliminate any need to pre-allocate all the space. Well, you do pre-allocate, but instead of writing "0" ten million times, you just have to write "0x10,000,000". This is an over-simplification but you get the idea.
 
Top