Skip to content
ENExplore Calculators

Disk Imaging Time Calculator

Estimate forensic disk acquisition time from capacity, sustained read rate, write-blocker overhead, compression and hash verification.

About Disk Imaging Time Calculator

Acquisition is throughput-bound at whichever end is slower: the source drive read rate after the write blocker takes its cut, or the destination write rate multiplied by the compression ratio, because compression means fewer bytes actually reach the target. Verification is a separate serial pass — hashing the source and the image to prove they match costs capacity ÷ hash rate for each pass. Imaging a 2 TB spinning disk is a four-to-six hour commitment before anyone starts analysis, and knowing that up front is the difference between a plan and a missed court deadline.

Formulas

Disk Imaging Time

imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification.

capacity
Source drive size in GB
blockerOverhead
Throughput lost to the hardware write blocker
compressionRatio
Bytes in per byte written
passes
Hash passes — source, image, or both

Image size on the evidence target

storedImageSize = sourceCapacity ÷ compressionRatio

compressionRatio
1.0 for raw dd, 1.5–2.2 for typical E01

Worked example

With the default values below, Disk Imaging Time Calculator returns Total Acquisition Time of 4.36. Change any input above and every figure here is recalculated in your browser.

Inputs used

Source drive capacityaccepts 1–200,000 GB
2,000 GB
Sustained source read rateaccepts 1–8,000 MB/s
180 MB/s
Write-blocker overheadaccepts 0–90 %
8 %
Target write rateaccepts 1–8,000 MB/s
250 MB/s
Image compressionone of Raw dd or E01 uncompressed — 1.0×, E01 fast compression — 1.6×, E01 best compression — 2.2×, AFF4 with deduplication — 2.8×
E01 fast compression — 1.6×
Hashing throughputaccepts 0.05–10 GB/s
1.2 GB/s
Verification passesone of None — acquire only, One — hash the image, Two — hash source and image
Two — hash source and image

Results

Total Acquisition Time
4.36 hours
Imaging Time
3.44 hours
Verification Time
0.93 hours
Effective Throughput
166 MB/s
Stored Image Size
1,250.0 GB
Limiting Factor
Source read rate through the write blocker
Scheduling Verdict
Overnight job — start it before you leave

Step by step

  1. 1Values used
  2. 2Disk Imaging Time
  3. 3Image size on the evidence target
  4. 4Total Acquisition Time= 4.36 hours
  5. 5Imaging Time= 3.44 hours
  6. 6Verification Time= 0.93 hours
  7. 7Effective Throughput= 166 MB/s
  8. 8Stored Image Size= 1,250.0 GB
  9. 9Limiting Factor= Source read rate through the write blocker

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Disk Imaging Time calculated?

imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification. Acquisition is throughput-bound at whichever end is slower: the source drive read rate after the write blocker takes its cut, or the destination write rate multiplied by the compression ratio, because compression means fewer bytes actually reach the target. Verification is a separate serial pass — hashing the source and the image to prove they match costs capacity ÷ hash rate for each pass.

Why does Disk Imaging Time matter?

Imaging a 2 TB spinning disk is a four-to-six hour commitment before anyone starts analysis, and knowing that up front is the difference between a plan and a missed court deadline.

What values do I need to enter?

This calculator takes 7 inputs: Source drive capacity, Sustained source read rate, Write-blocker overhead, Target write rate, Image compression, Hashing throughput, Verification passes. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is a compressed image sometimes faster to acquire?

Because the bottleneck moves. Compression reduces the bytes written, so if your destination is slower than the source, compressing at 2× can nearly double effective throughput — as long as the CPU keeps up. On a fast NVMe target, compression only costs CPU and saves space.

Should I hash during acquisition or afterwards?

During, if the tool supports it: modern imagers compute the source hash inline and the image hash on write, which makes verification almost free. Set passes to 0 in that case and treat the imaging figure as the total.

Related Calculators

Disk Imaging Time Calculator | Calcrivo