Choosing the right target device

Introduction

From a data Recovery Perspective, images and disk clones are the same thing.

If disk image hasn’t many fragments on FileSystem where is located, performances also are similar.

Disk Image Advantages:

  • No Risks of Data Alteration
  • Chance to save several images/tasks on same file system
  • Forensically Correct
  • No Need to Perform Security Erase Tasks

Disk Clone Advantages:

  • Maximum Performance
  • Flexibility
  • Chance to use disks as fast iSCSi targets ( RAID RECOVERY TASKS )
  • Reduced Data Loss in case of Disk Damage
  • Cheaper in a Data Recovery Facility Environment
  • Data Recovery Tasks can be performed on Dedicated Environment
  • Can be used the same source size capacity drive

Challenger Rocket Disk Image Types

Rocket offers several disk image options, from most compatible, to best performance proprietary disk images.

_images/imagetype.png

Standard Flat Image Disk ( dsk )

The standard dsk image file is a linear file with regular mapped offsets with no compression.

In standard dsk disk image the sector 0 is located at offset 0x00, and the sector 2048 is located at offset 0x100000 ( exactly sector number x sector size offset ).

Standard disk images can be mounted as disk images with losetup command in a linux environment or analyzed from any data recovery or forensic tool.

Hint

If you planned to recover device sectors with rocket, and external data analysis tool is required, the Standard Flat Image is the right choice.

The weakness of a flat disk image are fragments. In a imaging data recovery process, disk image will grow while reading, and GuestOS have no idea of final size of file. So fragmentation will occur of course.

If you created an imaging task and you are analyzing file system targetting into a linear dsk file, fragmentation effects will be stronger.

Splitted Preallocated Image Disk ( 001 )

001 Image standard is a set of images of fixed size, that meets the 001 standard.

Every Image has a fixed preallocated size and a sequential extension based on its index.

This kind of image, will be useful in slow performance target positions, like some USB2 target device or into network location positions.

Note

If you created an imaging task and you are analyzing file system targetting into a Splitted Preallocated Image Disk file, rocket will create only requested block relative .001 image.

This will give you excellent performance and reduced fragmentation of single tokens.

If you need opening 001 images with external analysis tool, take in mind that most tools will consider only sequential images, so a full device acquisition will be required.

Using fixed size splitted images will be mandatory when imaging into FAt32 formatted devices, where maximum file size is limited to 4096 MB.

Note

001 images are considered a forensic standard but will not be supported by all data recovery and forensic tools.

Splitted Dynamic Image Disk ( img )

Dynamic Splitted Images are write-optimized images with a fixed size of 1000000 lbas.

Every File Token is named with its relative offset.

“000000000000.img” file contains sectors from 0 to 999999

“000001000000.img” file contains sectors from 1000000 to 1999999

Hint

Using fixed size splitted images will be mandatory when imaging into FAt32 formatted devices, where maximum file size is limited to 4096 MB.

Challenger Virtual Disk Image ( cvd )

Challenger Rocket CVD is an exclusive optimized Disk Image File.

CVD Images are much like Vmware VMDKs, or HYPER View VHDs virtual disk images.

The main CVD goal is writing data on demand and optimizing file size and reading performances.

Hint

CVD Images Will be useful on Selective Data Recovery Tasks where there’s no need to perform a complete image of damaged device.