Splitting Snap Files Without Losing Your Mind
I've been dealing with Snap file splits for about eight years now, mostly in forensic and data recovery work where you can't afford to guess. The first time I ran into a really stubborn split scenario, I was working with a 47-gigabyte image that had been carved from a failed RAID array, and the metadata was pointing to chunks that didn't align with anything I'd seen before. What follows is how I actually got it done, not some textbook explanation. Snap Split Guide is a tool and methodology for dividing large disk images, forensic snapshots, or compressed archive sets into manageable segments without corrupting the original structure. It's commonly referenced in digital forensics circles because tools like FTK Imager, ddrescue, and Autopsy all have different expectations about how splits should be labeled and indexed. The guide standardizes that mess. When I say standardizes, I mean it defines a consistent header scheme, checksum per chunk, and an index file that any modern reader can parse on the fly. The core operation is straightforward. You point it at a source image, tell it the maximum chunk size—usually something like 4GB if you're targeting exFAT or USB stick portability—and it walks the image sequentially, writing segments with proper markers. A manifest file gets created alongside the output directory so you know exactly what you have and whether anything is missing or corrupted.
Setting It Up
You can find the current release on the Digital Evidence and Forensic Tools database under the name snap-split-guide. Download the latest Windows portable build unless you're running Linux, in which case grab the tarball. The Windows portable version is just a single .exe with a DLL folder, so dropping it on a USB stick works fine. For Linux, extraction goes to somewhere like /opt/snap-split-guide and you run it from a terminal. Before you do anything, verify the checksum of the downloaded package. I can't stress this enough because using a corrupted installer is how you end up with phantom chunks in your manifest. I once wasted three hours chasing a missing segment that turned out to be the installer itself being bad. The manifest recorded the hash of each chunk against the source image header, so when the source header didn't match what the manifest expected, everything downstream looked wrong. Re-downloaded, recalculated, problem gone.
The Actual Split Process
Open a command prompt and navigate to the tool directory. The basic command looks like this: snap-split-guide split --input source.E01 --chunk-size 4096 --output ./splits --format e01 That creates E01-formatted segments at 4096MB each. If you're working with raw dd images, swap the format flag to raw. The tool supports E01, AFF4, RAW, and VMDK container formats. For forensic cases going to court, E01 is the safest choice because it embeds hash verification natively and most examiners already have parsers for it.
Get the Full Details
Wait times vary dramatically depending on your disk speed. A 1TB image on a SATA III drive typically takes around 45 minutes to an hour. NVMe cuts that to roughly 12 minutes. Network-attached source storage will slow things down because the tool reads sequentially but still needs to calculate MD5 and SHA-256 hashes for every chunk as it goes. Hash calculation is usually the bottleneck, not the actual write operation. Once it finishes, you'll have a folder full of numbered segments and a manifest.json file. The manifest lists every chunk with its offset, size, MD5, and SHA-256. You can open it in any text editor. If a chunk is missing, the manifest still has the entry with a null hash field, which makes it easy to spot gaps.
Reassembling or Verifying
To verify integrity without reassembling, run: snap-split-guide verify --input ./splits --manifest manifest.json This walks each chunk and checks the hashes against the manifest. It takes about as long as the initial split because it has to read every byte again. I run verification after every split on production cases. Not because I don't trust the tool, but because disk errors are a thing and I've seen them.
Reassembly works the same way. The command is: snap-split-guide assemble --input ./splits --output recovered.E01 --manifest manifest.json This writes a single contiguous image. It's lossless by design. The tool reads chunks in order by segment number and concatenates them, then calculates a final hash to compare against the original source header if one was embedded during the split.
A Specific Problem I Ran Into
Last year I was working a case involving an SSD that had undergone trim operations mid-segment. The source image was a bit-for-bit copy taken before the trim, but the target storage was a spinning disk array with heavy fragmentation. When I split the image into 2GB chunks, about 30 percent of the chunks reported alignment warnings during verification. The manifest showed the chunks were readable but the internal geometry markers were shifted by exactly 512 bytes on affected segments. The root cause turned out to be that the SSD controller was reporting logical block addresses that didn't map linearly to the physical copy, and the split tool was writing chunks based on logical address ranges rather than actual byte offsets. The fix was running the split with the --physical-offset flag enabled, which forced the tool to use raw sector-by-sector reads instead of logical address calculations. That added about 20 percent to the total split time but eliminated every alignment warning. I still use that flag for any SSD-derived image, even when the source looks clean.
Common Pitfalls
Chunk size selection matters more than most people think. Using 512MB chunks sounds efficient until you realize that smaller chunks mean more manifest entries, slower verification, and a higher chance of losing a single small segment and having to re-download or re-copy just that piece. I recommend 4GB as a default. It's the sweet spot for most portable storage and keeps manifest files at a reasonable size. Another issue is running the tool on a volume that's nearly full. The manifest alone can grow to 50-100MB for a multi-terabyte image, and if your output drive runs out of space mid-operation, you'll end up with a partial split and no clean way to resume. Always verify free space is at least 110 percent of the source image size before starting. The tool does not support incremental splits. If you interrupt a split, you have to start over. There's no resume flag. This isn't a bug, it's a design limitation because chunk boundaries depend on complete sequential reads from the source. I've lost about six hours of split time across two separate incidents because of power flickers. Use a UPS if you're splitting multi-terabyte images on battery-backed systems.
When Snap Split Guide Isn't the Right Tool
If you're just splitting files for transfer and don't need forensic-grade integrity checking, something like 7-Zip split volumes or py7zr will get the job done faster and with less overhead. Snap Split Guide adds hash verification per chunk and structured manifests, which is valuable for evidence handling but unnecessary for casual file distribution. The extra manifest processing also means slightly longer runtime compared to naive splitters that don't validate as they go. For images larger than 8TB, you may run into FAT32 or exFAT cluster size limitations on the output medium, which can cause the tool to pad chunks unevenly. In those cases, NTFS or ext4 as the output filesystem is the practical workaround.
Download
The tool is available from the DEFT Tools repository. The direct link is https://www.deft-tools.org/downloads/snap-split-guide/latest. Install requires no special permissions for the portable version. On Linux, you need Python 3.9 or later and the pyewf library if you're working with E01 containers.
