Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: Sergioramos
New Today: 0
New Yesterday: 3
Overall: 29353

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 A question for students and newbies
 E-DISCOVERY & DATA RECOVERY? WHICH ONE IS BETTER?
 Computer Forensic in e-commerce
 Computer Forensic as component in Information Security
 Small Business - Do You Prepared?

Computer Forensics World Forums


Pages Served
We received
51206129
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - blocksize
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

blocksize

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Forensic Software and Tools
View previous topic :: View next topic  
Author Message
joker-alb
Newbie
Newbie


Joined: Aug 02, 2015
Posts: 1

PostPosted: Wed Aug 05, 2015 8:11 pm    Post subject: blocksize Reply with quote

Hello, maybe its a newbi question but , it isn't clear to me why to use the blocksize option when doing an hdd imaging.
example: dcfldd if=/dev/sdb1 of=/home bs=512

Why use blocksize, any advantages ?


PS: If bashing about not knowing is your answer please don't reply. I am here to learn Wink
Back to top
View user's profile
athulin
Newbie
Newbie


Joined: Oct 19, 2007
Posts: 238

PostPosted: Thu Aug 06, 2015 12:30 am    Post subject: Re: blocksize Reply with quote

joker-alb wrote:
Hello, maybe its a newbi question but , it isn't clear to me why to use the blocksize option when doing an hdd imaging.
example: dcfldd if=/dev/sdb1 of=/home bs=512

Why use blocksize, any advantages ?


You're asking about a specific piece of software -- I can't answer that, except by assuming the documentation is correct.

However, in 'dd', bs is used to determine just how large blocks are read/written. However, this is how dd splits the job up -- the operating system may be more intelligent and request a longer sequence of sectors from the disk in one single read.

With modern 4k-sector drives, for example, reading/writing in 512-byte chunks probably isn't the fastest option. The software will probably read 4k, and then have to split it up into bs-sized chunks. Which may be a waste of time.
And reading bs=715 sized blocks from a 512-byte sector size disk is probably going to cause various alignment problems, and lots of buffer management.

In the presence of errors, however, the bs-size may affect the result, say, like zeroing out all data read in that particular block (or just dropping all data from the point the read error ocurred.) In such situations, you may lose information due to too large block size.

In the very particular situation you ask about, i.e.

dcfldd if=/dev/sdb1 of=/home bs=512

I see no use for it, and I would not include it myself. (Unless you're doing some kind of benchmark, or the default value is something weird. I think bs=512 is default, though.)

However, if you had included the command line option 'conv' and it's suboptions 'sync' and/or 'notrunc', it would have been another situation. In those cases, bs (or ibs/obs) are important to know.

But for an explanation of those, I'm going to refer you to the man page for dcfldd.

Then you also see that I have simplified my answer a little, as the number of blocks read in one go is decided by the count= option, which I think defaults to 20.
Back to top
View user's profile
wookieshaver
Newbie
Newbie


Joined: Sep 02, 2009
Posts: 1

PostPosted: Sat Aug 15, 2015 4:03 am    Post subject: Block size Reply with quote

The syntax of this command is very similar to DD, which we use very often in the computer forensic lab at work. The advantage of using the blocksize is moving data from one piece of media to another. While both may happen to have the same Sector size or I/O size you often run into situations where they differ. The TL;DR of it is using a smaller blocksize of 512 is that the data will copy easier in smaller chunks from differentiating blocksize media as they both will support the smaller chunks.
Back to top
View user's profile Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Forensic Software and Tools All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.