Filesytem Baseline

Filesystem vs Blocksize results

When a forensic image is created, it is typically written to a file. Often, this forensic image is written as a series of files that are each approximately 2GB in size. As the output files are limited in size, the files can be written to a FAT32 file-system, as well as an NTFS or Linux Ext2, Ext3 or Ext4 filesystem.

The charts below show how long it took to copy 2GB of data to a file with varying buffer sizes and varying file-systems and varying disk interfaces (usb and sata). For all file-systems, it appears that buffer sizes less than 128 bytes are inefficient. Next, it appears that the NTFS filesystem is less efficient than the FAT32 and the Linux Ext filesystems.