(03-16-2025, 12:55 AM)Froggie Wrote: I believe sector-by-sector imaging can easily include compression... and probably does. Since the compression is lossless, there should be no need to NOT COMPRESS the data, even if it's a full forensic copy.
And in fact, with OSes using active TRIM on SSDs, and SSDs returning either all ZEROs or all same DATA (most of them on the market) for "unused sectors," those sectors are very compressible. It's the used encrypted sectors that are not very compressible.
You're right, sector-by-sector imaging does support compression as well, and the compression rate for unused sectors is theoretically very high. However, when imaging an encrypted partition sector by sector, the program can't exclude page, hibernation, swap, etc., so the resulting image file will be larger.