Is ‘good old’ Expert Witness Format still the preferred choice?
In the recent years huge centralized storage has become pretty much a standard everywhere. And pretty much everywhere EWF has become standard for forensics imaging.
I wonder if this is still the most optimal combination from the perspective of storage-efficiency.
How does deduplicating perform on ewf-images compared to raw? In fact, my assumption is: The more raw images saved to a deduplicating volume, the more efficient duplicating will do its job.
Let’s bring them to the test!
EnCase
After booting up with a Windows 7 machine, I imaged the boot disk using EnCase 6. (run 1)
Immediately after, I initiated a second acquisition using the same EnCase session (run 2)
All settings for acquisition are kept to default, using ‘Good compression’ and a split size of 640MB.
FTK Imager
After EnCase finished both acquisition sessions successfully, I started two acquisition sessions with FTK Imager using the same approach: Start one, When it runs, start session number two.