Estimate forensic disk acquisition time from capacity, sustained read rate, write-blocker overhead, compression and hash verification.
Acquisition is throughput-bound at whichever end is slower: the source drive read rate after the write blocker takes its cut, or the destination write rate multiplied by the compression ratio, because compression means fewer bytes actually reach the target. Verification is a separate serial pass — hashing the source and the image to prove they match costs capacity ÷ hash rate for each pass. Imaging a 2 TB spinning disk is a four-to-six hour commitment before anyone starts analysis, and knowing that up front is the difference between a plan and a missed court deadline.
Disk Imaging Time
imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification.
Image size on the evidence target
storedImageSize = sourceCapacity ÷ compressionRatio
imagingTime = capacity ÷ min(sustainedRead × (1 − blockerOverhead), targetWrite × compressionRatio), then add capacity × passes ÷ hashRate for verification. Acquisition is throughput-bound at whichever end is slower: the source drive read rate after the write blocker takes its cut, or the destination write rate multiplied by the compression ratio, because compression means fewer bytes actually reach the target. Verification is a separate serial pass — hashing the source and the image to prove they match costs capacity ÷ hash rate for each pass.
Imaging a 2 TB spinning disk is a four-to-six hour commitment before anyone starts analysis, and knowing that up front is the difference between a plan and a missed court deadline.
This calculator takes 7 inputs: Source drive capacity, Sustained source read rate, Write-blocker overhead, Target write rate, Image compression, Hashing throughput, Verification passes. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because the bottleneck moves. Compression reduces the bytes written, so if your destination is slower than the source, compressing at 2× can nearly double effective throughput — as long as the CPU keeps up. On a fast NVMe target, compression only costs CPU and saves space.
During, if the tool supports it: modern imagers compute the source hash inline and the image hash on write, which makes verification almost free. Set passes to 0 in that case and treat the imaging figure as the total.