Can compression reduce forensic image time?

Abstract

Creating a forensic copy (image) of a hard disk drive is one of the fundamental tasks a computer forensic analyst must perform. Time is often critical, and there is a need to consider a trade-off between a number of factors to achieve best results. This paper reports the results from an exploratory study into the impact of using disk drive compression on the time needed to image (and verify) a hard disk drive. It was found that time reduction may be achieved once the trade-off of contributing variables was properly estimated. The findings led the investigators to suggest a step-by-step decision making process for analysts when considering disk compression as a means for reducing total image processing time.

Keywords

• Compression
• Time Trade-off
• Forensic
• Imaging