We previously tested disk imaging speeds using high-performance storage devices. But raw speed is only part of the equation. Even under ideal conditions, getting a fully correct and complete image can be tricky. And achieving peak speed consistently is even harder – many factors can slow things down, and sometimes even corrupt the results. In this article, we explore the key reasons why both speed and accuracy can fall short during disk imaging.

Testbed configuration: why speeds drop

Fast hardware does not always deliver fast results. One common issue is imbalance: if your source drive is faster than your target (say, imaging an NVMe drive to a slow HDD or NAS), throughput suffers.
Hardware layout matters too. Devices sharing the same USB bus or even a USB hub can bottleneck each other, even when the bandwidth looks sufficient on paper.

Then there’s system performance. A weak CPU, limited RAM, overheating, or even running on battery power can all reduce stability and throughput. Background software – notorious antivirus tools, monitoring utilities, backup agents or anti-cheating tools – can also interfere by delaying or blocking disk access.

Even cables and write blockers can introduce problems. Low-quality cables or overheating adapters will degrade performance. We’ve covered this before – and yes, cables matter too.

Source drive condition and contents

What’s on the drive matters. For E01 imaging with compression enabled, compressible content affects not just the final image size, but also the imaging speed. SSDs may “fake” reads on empty space for speed, but performance still varies based on how free and used blocks are handled (more here).

HDDs, meanwhile, have mechanical quirks – outer tracks are faster than inner ones. And if the source drive has unstable sectors, expect retries, hangs, or even full failures. Failing drives need specialized tools, not standard write blockers.

Imaging software settings

Tool configuration matters. Thread count, temp file locations, hash algorithms, and error handling logic can make or break your performance. Some tools lack advanced settings altogether, preventing proper optimization for your hardware or case.

Target drive bottlenecks

Your destination matters just as much. Writing to slow drives or networks often becomes the bottleneck, especially if you’re using a traditional HDD or a low-end SSD. Track layout, caching behavior, and controller model can drastically impact performance – especially once initial caches fill up, which is a real issue even on the fastest pSLC-cached NVMe drives.

Can you ever get 100% speeds?

Even with a perfect setup, 100% performance isn’t always achievable. Small changes in config or disk state can lead to variation. Often the culprit isn’t hardware – it’s the software logic, OS behavior, or firmware quirks.

And in the real world, no one wires source and target drives straight to PCIe – we need write blockers. Most of them top out at 10 Gbps – far below what modern NVMe drives can handle. So “100%” is always relative.

Our own tool

That’s why we’re building our own imaging tool. Our tool will work in Windows and Linux; while Linux sers have dc3dd and guymager, those tools aren’t fast enough to our liking. We’ve studied existing products and know where they struggle: performance issues, error handling, or compression tradeoffs. We’ve focused on fixing these – flexible retries, better threading, stable operation even in edge cases. Is it perfect yet? No. Competing with established tools like OSForensics is tough. But we’re optimistic.

Conclusion

Disk imaging isn’t just about speed. It’s about consistency, correctness, and understanding where things break down. Knowing your tools – and your bottlenecks – is what makes reliable imaging possible.
Our upcoming tool is already solving some of these challenges, and we’re excited to share more soon. Stay tuned – a first release is on the way.