Academic Journals Database
Disseminating quality controlled scientific knowledge

Can compression reduce forensic image time?

Author(s): Brian Cusack | Jon Pearse

Journal: Journal of Applied Computing and Information Technology
ISSN 2230-4398

Volume: 15;
Issue: 1;
Date: 2011;
Original page

Keywords: Compression | Time Trade-off | Forensic | Imaging

Creating a forensic copy (image) of a hard disk drive is one of the fundamental tasks a computer forensic analyst must perform. Time is often critical, and there is a need to consider a trade-off between a number of factors to achieve best results. This paper reports the results from an exploratory study into the impact of using disk drive compression on the time needed to image (and verify) a hard disk drive. It was found that time reduction may be achieved once the trade-off of contributing variables was properly estimated. The findings led the investigators to suggest a step-by-step decision making process for analysts when considering disk compression as a means for reducing total image processing time.

Tango Jona
Tangokurs Rapperswil-Jona

     Affiliate Program