Re: [sleuthkit-users] Why is block size important

[Rich T. <te...@ya...>]

Well I found that setting the block size determines
how big a chunk of data dd is going to process at one
time.  I did some testing and found a significant
increase in speed of imaging based on larger block
sizes.  If I remember correctly speed increased until
It flattened out above 32k (I got the same imaging
speed when setting bs=32k and bs=1m)

I could forward the white paper I wrote about it if
you'd like.

Have a great day,
Richard Thompson
Applied Forensics
www.apfor.com

--- Fra...@ps... wrote:

> This is a two part question...
> 
> Why is block size important when imaging a drive or
> partition?  (ie.  dd 
> if=/dev/hda of=./hda.dd bs=2k, provides a file in
> blocks of 2048-bytes)
> 
> Also, how do you know which block size to use for
> the image?
> 
> Frank Kenisky IV, CISSP, CISA, CISM 
> Information Technical Security Specialist 
> (210) 301-6433 or (210) 887-6985