Re: [sleuthkit-users] Extracting partions from dd image

[Lisa M. <34....@gm...>]

On 6/27/05, Aaron Stone <aa...@se...> wrote:
> On Mon, Jun 27, 2005, ""Barry J. Grundy"" <bg...@im...> said:
> > In short, the blocksize is important because it sets the unit size for
> > your "count" (or skip, etc.).
>=20
> This is something I've always wondered: if you set the blocksize to, say,
> 8192, but do not specify a skip or a count, and capture an entire
> partition, is there a downside to setting the larger blocksize? My
> understanding is that it can make the capture faster because you're
> reading and buffering larger blocks. Scaling up to the size of the disk
> cache should get faster, no?

Yes, optimising the bs size will yield faster imaging times, bs=3D512 is
a little slow at he best of times.

The way I had remembered this / some other thread on the list was that
an NTFS partition was DD'd and wasn't loadable, but by redoing it with
bs=3D512 it was.

Probably just bad memory in my case!

Lisa.