-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 2015-09-09 22:25, Carlos E. R. wrote:
On 2015-09-09 21:07, Greg Freemyer wrote:
...
I can try, I guess...
I'm installing now libewf2 and libewf2-tools to try.
Awfully slow. :-( minas-tirith:/mnt/nfs_telcontar/data/aux_01/Minas-Tirith # time ewfacquire -l test.log -t testimage /dev/sda ewfacquire 20130416 Device information: Bus type: ATA/ATAPI Vendor: ATA Model: ST9500325AS Serial: ***** Storage media information: Type: Device Media type: Fixed Media size: 500 GB (500107862016 bytes) Bytes per sector: 512 Acquiry parameters required, please provide the necessary input Case number: 1 Description: testing ewf accquire Evidence number: Examiner name: CER Notes: Media type (fixed, removable, optical, memory) [fixed]: Media characteristics (logical, physical) [physical]: Use EWF file format (ewf, smart, ftk, encase1, encase2, encase3, encase4, encase5, encase6, linen5, linen6, ewfx) [encase6]: Compression method (deflate) [deflate]: Compression level (none, empty-block, fast, best) [none]: fast Start to acquire at offset (0 <= value <= 500107862016) [0]: The number of bytes to acquire (0 <= value <= 500107862016) [500107862016]: Evidence segment file size in bytes (1.0 MiB <= value <= 7.9 EiB) [1.4 GiB]: The number of bytes per sector (1 <= value <= 4294967295) [512]: The number of sectors to read at once (16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768) [64]: The number of sectors to be used as error granularity (1 <= value <= 64) [64]: The number of retries when a read error occurs (0 <= value <= 255) [2]: Wipe sectors on read error (mimic EnCase like behavior) (yes, no) [no]: The following acquiry parameters were provided: Image path and filename: testimage.E01 Case number: 1 Description: testing ewf accquire Evidence number: Evidence number: Examiner name: CER Notes: Media type: fixed disk Is physical: yes EWF file format: EnCase 6 (.E01) Compression method: deflate Compression level: fast Acquiry start offset: 0 Number of bytes to acquire: 465 GiB (500107862016 bytes) Evidence segment file size: 1.4 GiB (1572864000 bytes) Bytes per sector: 512 Block size: 64 sectors Error granularity: 64 sectors Retries on read error: 2 Zero sectors on read error: no Continue acquiry with these values (yes, no) [yes]: Acquiry started at: Wed Sep 9 23:39:57 2015 This could take a while. Status: at 0%. acquired 32 KiB (32768 bytes) of total 465 GiB (500107862016 bytes). Status: at 1%. acquired 4.6 GiB (5001084928 bytes) of total 465 GiB (500107862016 bytes). completion in 21 hour(s), 58 minute(s) and 21 second(s) with 5.9 MiB/s (6259172 bytes/second). The destination drive is an NFS mount, using gigabit cable network, so not the issue. I see the network being mostly iddle, then a burst of activity. CPU is mostly iddle on both machines, with bursts of 100% of one core at source machine, coupled with disk read activity. This is unusable. I think I will use one of the dd-rescue variants instead. - -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iF4EAREIAAYFAlXwrXEACgkQja8UbcUWM1xEKwEAm9XjWtUcxnFGO9svQZucIqA+ CARXJ3mTWtPodXB+SRgBAINIDxvddEpU5sfIcEoTfyDWNbEWwScqgEmHKvmAISr5 =aG4c -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org