Image File Question

[KaelaKM]

I can't find the answers in my computer forensics book. I used FTK Imager Lite, but I think this is more a general question. When imaging a physical device, for example a small flash or USB drive, will the image file be larger, smaller, or the same size as the source and why?

 

[JaredDM]

Depends on a lot of factors, such as image type, compression, etc.

If you image to a RAW or "dd" file type, it's just a binary copy, so it'll technically be the exact same size. This doesn't however mean you'll be able to save an 8Gb image file to an 8Gb thumbdrive, because there is overhead from the file system that takes up some space for file tables, sector bitmap, etc.

If you use the .e01 format, you can enable compression which can greatly shrink the size of the image file, especially if there is a lot of unused empty space. With the compression disabled I think that .e01 files may be slightly larger than the source disk, but it's negligible.