Difference between pages "Raw Image Format" and "Compression"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(Deflate/Inflate)
 
Line 1: Line 1:
The RAW Image Format is used to store a disk or volume image.
+
{{Expand}}
  
== File types ==
+
== LZ-based ==
Some variants of the RAW Image Format split the data among multiple segment files, which is also known as split RAW.
+
  
There are various naming schemes for RAW Image Format files, some of the more common used for disk or volume images are:
+
=== Deflate/Inflate ===
* PREFIX.dd
+
Used in:
* PREFIX.dmg
+
* [[Gzip|gzip]]
* PREFIX.img
+
* PREFIX.raw
+
* PREFIX.0 - PREFIX.#; variations: starting with either 0 or 1, consisting of multiple digits e.g. PREFIX.000
+
* PREFIX0 - PREFIX#; variations: starting with either 0 or 1, consisting of multiple digits e.g. PREFIX000
+
* PREFIXaa - PREFIXzz; variations: consisting of more letters e.g. PREFIX.aaa
+
* PREFIX.1of5 - PREFIX.5of5; variations: consisting of multiple segment files
+
* PREFIX001.asb - PREFIX###.asb
+
* PREFIX-f001.vmdk - PREFIX-f###.vmdk; variations: starting with 001
+
  
 +
=== LZNT1 ===
 +
Used in:
 +
* [[NTFS]]
 +
* [[Windows SuperFetch Format]]
  
Note that there are also RAW Image Formats specific to the storage media, e.g. RAW optical disc image.
+
=== LZXPRESS ===
 +
Used in:
 +
* [[Extensible Storage Engine (ESE) Database File (EDB) format]]
  
These often are accompanied by a table of contents file often in the [[CUE Sheet format]], e.g.
+
=== LZXPRESS Huffman ===
* BIN/CUE
+
Used in:
* ISO/CUE
+
* [[Windows SuperFetch Format]]
  
== Contents ==
+
== External Links ==
The RAW Image Format is basically a bit-for-bit copy of the RAW data of either the disk or the volume, without any additions or deletions.
+
* [http://en.wikipedia.org/wiki/Lempel-Ziv Wikipedia: Lempel-Ziv]
 +
* [http://www.coderforlife.com/microsoft-compression-formats/ Microsoft Compression Formats]
  
There is no [[metadata]] stored in RAW Image Format files. However sometimes the metadata is stored in additional files.
+
=== Deflate/Inflate ===
 +
* [http://en.wikipedia.org/wiki/DEFLATE Wikipedia: DEFLATE]
 +
* [https://tools.ietf.org/html/rfc1950 IETF: RFC1950 - ZLIB Compressed Data Format Specification]
 +
* [https://tools.ietf.org/html/rfc1951 IETF: RFC1951 - DEFLATE Compressed Data Format Specification]
  
The RAW Image Format was original used by [[dd]], but is supported by most of the computer forensics applications.
+
=== LZ1 ===
 
+
* [http://andyh.org/LZ1.html LZ1]
== See Also ==
+
* [[Disk Images]]
+
 
+
== Tools ==
+
* [[Dd|dd]]
+
* [[dc3dd]]
+
* [[dcfldd]]
+
* [[dd_rescue]]
+
* [[ddrescue]]
+
 
+
[[Category:Forensics File Formats]]
+

Revision as of 08:56, 21 June 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

LZ-based

Deflate/Inflate

Used in:

LZNT1

Used in:

LZXPRESS

Used in:

LZXPRESS Huffman

Used in:

External Links

Deflate/Inflate

LZ1