Default to raw format?

[datahaze]

Is there a way to have the Data Extractor store data in raw/dd format by default? Exporting images every time is getting to be a bit dull.

 

[Jared]

Yes, just select "External File" as the destination. That'll image to just a raw image. However, there's a major drawback to this. If you try to skip ahead, say to start imaging from the higher LBAs, it'll hang for a really really really long time while it zero fills up to that area. So if you're trying to image a 1Tb drive from the back to the front, it'll hang until it's done writing 1Tb of zeros.

The other option is to just mount the task in DE, but that's a bit slow for scanning.

If you expect to do a lot of logical scanning afterward, it's probably best to use a physical drive as the destination rather than image files.

 

[datahaze]

Thanks Jared and good to know about it pre-filling the spots, that's a pretty major drawback.

 

[datahaze]

Update: The pre-filling problem doesn't happen for me. "External file" works just fine, I assume it's just making a sparse file. This is on a NTFS destination.

 

[hdd00]

It happens only when you do backward imaging and it depends off the size of the drive....On bigger drives it takes very long time before it actually start to image.

 

[datahaze]

I've done this with 4TB drives and going backwards it starts reading in a matter of seconds. Maybe you're writing to a filesystem that doesn't support sparse files like a network share? Sparse files eliminate any need to pre-allocate all the space. Well, you do pre-allocate, but instead of writing "0" ten million times, you just have to write "0x10,000,000". This is an over-simplification but you get the idea.