Page 1 of 1

Default to raw format?

Posted: Sat Aug 25, 2018 1:01 am
by datahaze
Is there a way to have the Data Extractor store data in raw/dd format by default? Exporting images every time is getting to be a bit dull.

Default to raw format?

Posted: Sat Aug 25, 2018 8:46 am
by Jared
Yes, just select "External File" as the destination. That'll image to just a raw image. However, there's a major drawback to this. If you try to skip ahead, say to start imaging from the higher LBAs, it'll hang for a really really really long time while it zero fills up to that area. So if you're trying to image a 1Tb drive from the back to the front, it'll hang until it's done writing 1Tb of zeros.

The other option is to just mount the task in DE, but that's a bit slow for scanning.

If you expect to do a lot of logical scanning afterward, it's probably best to use a physical drive as the destination rather than image files.

Default to raw format?

Posted: Sat Aug 25, 2018 2:10 pm
by datahaze
Thanks Jared and good to know about it pre-filling the spots, that's a pretty major drawback.

Default to raw format?

Posted: Wed Nov 07, 2018 4:33 pm
by datahaze
Update: The pre-filling problem doesn't happen for me. "External file" works just fine, I assume it's just making a sparse file. This is on a NTFS destination.

Default to raw format?

Posted: Thu Nov 08, 2018 12:02 am
by hdd00
It happens only when you do backward imaging and it depends off the size of the drive....On bigger drives it takes very long time before it actually start to image.

Default to raw format?

Posted: Thu Nov 08, 2018 12:24 am
by datahaze
I've done this with 4TB drives and going backwards it starts reading in a matter of seconds. Maybe you're writing to a filesystem that doesn't support sparse files like a network share? Sparse files eliminate any need to pre-allocate all the space. Well, you do pre-allocate, but instead of writing "0" ten million times, you just have to write "0x10,000,000". This is an over-simplification but you get the idea.