Disk Imaging Time Calculator
Estimate forensic disk acquisition time from capacity, sustained read rate, write-blocker overhead, compression and hash verification.
Inputs
SATA HDD 120–200, SATA SSD 500, NVMe 2000–7000 MB/s
Hardware blockers cost 5–15%; USB 3.0 bridges more
SHA-256 ≈ 0.5 GB/s software, 1.5–2 GB/s with SHA-NI
Total Acquisition Time
4.36hours
Imaging Time
3.44hours
Verification Time
0.93hours
Effective Throughput
166MB/s
Stored Image Size
1,250.0GB
Limiting Factor
Source read rate through the write blocker
Scheduling Verdict
Overnight job — start it before you leave
Step by step
Values used
Source drive capacity = 2,000 GB; Sustained source read rate = 180 MB/s; Write-blocker overhead = 8 %; Target write rate = 250 MB/s; Image compression = E01 fast compression — 1.6×; Hashing throughput = 1.20 GB/s; Verification passes = Two — hash source and image
Disk Imaging Time
imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification.
Image size on the evidence target
storedImageSize = sourceCapacity ÷ compressionRatio
Total Acquisition Time
= 4.36 hours
Imaging Time
= 3.44 hours
Verification Time
= 0.93 hours
Effective Throughput
= 166 MB/s
Stored Image Size
= 1,250.0 GB
Limiting Factor
= Source read rate through the write blocker
How it works
Acquisition is throughput-bound at whichever end is slower: the source drive read rate after the write blocker takes its cut, or the destination write rate multiplied by the compression ratio, because compression means fewer bytes actually reach the target. Verification is a separate serial pass — hashing the source and the image to prove they match costs capacity ÷ hash rate for each pass. Imaging a 2 TB spinning disk is a four-to-six hour commitment before anyone starts analysis, and knowing that up front is the difference between a plan and a missed court deadline.
Formulas
Disk Imaging Time
imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification.
- capacity
- Source drive size in GB
- blockerOverhead
- Throughput lost to the hardware write blocker
- compressionRatio
- Bytes in per byte written
- passes
- Hash passes — source, image, or both
Image size on the evidence target
storedImageSize = sourceCapacity ÷ compressionRatio
- compressionRatio
- 1.0 for raw dd, 1.5–2.2 for typical E01
Frequently Asked Questions
How is Disk Imaging Time calculated?
imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification. Acquisition is throughput-bound at whichever end is slower: the source drive read rate after the write blocker takes its cut, or the destination write rate multiplied by the compression ratio, because compression means fewer bytes actually reach the target. Verification is a separate serial pass — hashing the source and the image to prove they match costs capacity ÷ hash rate for each pass.
Why does Disk Imaging Time matter?
Imaging a 2 TB spinning disk is a four-to-six hour commitment before anyone starts analysis, and knowing that up front is the difference between a plan and a missed court deadline.
What values do I need to enter?
This calculator takes 7 inputs: Source drive capacity, Sustained source read rate, Write-blocker overhead, Target write rate, Image compression, Hashing throughput, Verification passes. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why is a compressed image sometimes faster to acquire?
Because the bottleneck moves. Compression reduces the bytes written, so if your destination is slower than the source, compressing at 2× can nearly double effective throughput — as long as the CPU keeps up. On a fast NVMe target, compression only costs CPU and saves space.
Should I hash during acquisition or afterwards?
During, if the tool supports it: modern imagers compute the source hash inline and the image hash on write, which makes verification almost free. Set passes to 0 in that case and treat the imaging figure as the total.
You might also need
- Backup Recovery CalculatorCommonly used together
- Hash Verification CalculatorCommonly used together
- Evidence Transfer Time CalculatorCommonly used together
- Memory Dump Size CalculatorCommonly used together
- Forensic Evidence Storage CalculatorCommonly used together
- Ransomware Impact CalculatorAlso in Forensics & Emerging Threats