±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 162

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

FTK Image Properties

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

nbhe
Newbie
 

FTK Image Properties

Post Posted: Jun 26, 19 19:15

obtained an AD1 image and it was compressed. I have been asked by an individual to obtain the uncompressed size of the image. Tried to open in FTK Imager under the view tab, clicked properties. However, it only gives me size on individual folders and some folders register as zero file size when I know there are PDF's in the folder. I am currently running against File Size 8 to get the size. Aside from digging back in to the server where the image came from, sure could use some suggestions.

vr  
 
  

mcman
Senior Member
 

Re: FTK Image Properties

Post Posted: Jun 26, 19 19:22

Reacquire the image uncompressed? Open the compressed AD1, reacquire all the files within (metadata and all should be maintained), then either provide the size or the actual uncompressed container. I don't really understand the reason for the individual's request but that will provide the solution. It's like asking for the size of a zip at different compression levels, you won't know the answer until you do each one.

Also, the folder size might be zero but the content of the folder is not necessarily zero.

Jamie  
 
  

watcher
Senior Member
 

Re: FTK Image Properties

Post Posted: Jun 26, 19 20:22

Try mounting the AD1 image as a drive instead of viewing it. FTK Imager or Mount Image Pro should be able to mount an AD1,  
 
  

redcat
Senior Member
 

Re: FTK Image Properties

Post Posted: Jul 01, 19 10:20

Just mount the AD1 in FTK Imager as you have done and then image the contents uncompressed to another AD1 or whatever container you prefer to use. Then the size is the size.

But I agree, this is a slightly boneheaded question to begin with. Did it come from a lawyer by any chance? Laughing  
 
  

nbhe
Newbie
 

Re: FTK Image Properties

Post Posted: Jul 15, 19 20:08

@REDCAT... LOL... a project manager and a lawyer ! ! ! ! LOL  
 

Page 1 of 1