Skip to content
Calcrivo

Disk Imaging Time Calculator

Estimate forensic disk acquisition time from capacity, sustained read rate, write-blocker overhead, compression and hash verification.

Inputs

GB
MB/s

SATA HDD 120–200, SATA SSD 500, NVMe 2000–7000 MB/s

%

Hardware blockers cost 5–15%; USB 3.0 bridges more

MB/s
GB/s

SHA-256 ≈ 0.5 GB/s software, 1.5–2 GB/s with SHA-NI

Total Acquisition Time

4.36hours

Imaging Time

3.44hours

Verification Time

0.93hours

Effective Throughput

166MB/s

Stored Image Size

1,250.0GB

Limiting Factor

Source read rate through the write blocker

Scheduling Verdict

Overnight job — start it before you leave

Step by step

  1. Values used

    Source drive capacity = 2,000 GB; Sustained source read rate = 180 MB/s; Write-blocker overhead = 8 %; Target write rate = 250 MB/s; Image compression = E01 fast compression — 1.6×; Hashing throughput = 1.20 GB/s; Verification passes = Two — hash source and image

  2. Disk Imaging Time

    imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification.

  3. Image size on the evidence target

    storedImageSize = sourceCapacity ÷ compressionRatio

  4. Total Acquisition Time

    = 4.36 hours

  5. Imaging Time

    = 3.44 hours

  6. Verification Time

    = 0.93 hours

  7. Effective Throughput

    = 166 MB/s

  8. Stored Image Size

    = 1,250.0 GB

  9. Limiting Factor

    = Source read rate through the write blocker

How it works

Acquisition is throughput-bound at whichever end is slower: the source drive read rate after the write blocker takes its cut, or the destination write rate multiplied by the compression ratio, because compression means fewer bytes actually reach the target. Verification is a separate serial pass — hashing the source and the image to prove they match costs capacity ÷ hash rate for each pass. Imaging a 2 TB spinning disk is a four-to-six hour commitment before anyone starts analysis, and knowing that up front is the difference between a plan and a missed court deadline.

Formulas

Disk Imaging Time

imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification.

capacity
Source drive size in GB
blockerOverhead
Throughput lost to the hardware write blocker
compressionRatio
Bytes in per byte written
passes
Hash passes — source, image, or both

Image size on the evidence target

storedImageSize = sourceCapacity ÷ compressionRatio

compressionRatio
1.0 for raw dd, 1.5–2.2 for typical E01

Frequently Asked Questions

How is Disk Imaging Time calculated?

imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification. Acquisition is throughput-bound at whichever end is slower: the source drive read rate after the write blocker takes its cut, or the destination write rate multiplied by the compression ratio, because compression means fewer bytes actually reach the target. Verification is a separate serial pass — hashing the source and the image to prove they match costs capacity ÷ hash rate for each pass.

Why does Disk Imaging Time matter?

Imaging a 2 TB spinning disk is a four-to-six hour commitment before anyone starts analysis, and knowing that up front is the difference between a plan and a missed court deadline.

What values do I need to enter?

This calculator takes 7 inputs: Source drive capacity, Sustained source read rate, Write-blocker overhead, Target write rate, Image compression, Hashing throughput, Verification passes. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is a compressed image sometimes faster to acquire?

Because the bottleneck moves. Compression reduces the bytes written, so if your destination is slower than the source, compressing at 2× can nearly double effective throughput — as long as the CPU keeps up. On a fast NVMe target, compression only costs CPU and saves space.

Should I hash during acquisition or afterwards?

During, if the tool supports it: modern imagers compute the source hash inline and the image hash on write, which makes verification almost free. Set passes to 0 in that case and treat the imaging figure as the total.

You might also need