Summary: The word "imaging" when applied to disks is often misused and subject to some interpretation. Imaging can mean different things to different programs.
A utility I have offers two methods of saving a disk: imaging or copying. What's the difference?
•
When talking about backing up your hard drive we often throw around a lot of different terms. "Imaging" is one of them, and it's frequently misused.
Let's look at the differences, and when you might want to use one over the other.
•
In its strictest, most correct sense, a disk image is a perfect copy of everything on the disk. And in this case I do mean everything. A true disk image is a sector-by-sector copy of the contents of the disk, paying no attention to the contents of those sectors.
That means a couple of interesting things:
-
A true disk image includes "copies" of the contents of all of the unused areas on the hard disk as well as the areas that currently contain data.
-
A true disk image, when restored, puts data back in the exact same location on the disk as it was when the image was created. For example any fragmentation is unaffected and preserved.
The neat thing about this type of disk imaging is that the tool doesn't need to understand the contents of the disk that it's operating on. It simply operates on the disk at a level below the operating system or filesystem to simply copy the raw data.
The bad thing about a true disk image is that it includes the entire disk, whether or not there's data. If you have a hard drive with a capacity of 250gigabytes, then 250gigabytes is what the image will contain, no matter how much data you actually have on the drive. The actual image may be smaller, of course, due to compression, but the fact is all 250 gigabytes are present, whether you need them or not.
The other type of "disk image" is more correctly a "filesystem image". This approach is aware of the type of filesystem you have on your hard disk and what files are on it. A filesystem image would most likely be the "copy" your backup utility is referring to. (Though many backup utilities use the phrase "image" to refer to a filesystem image - Acronis TrueImage being one obvious example.)
When a utility makes a filesystem image, it effectively copies all the files and folders on your hard disk, not unlike a file copy you might perform, and then also includes all of the system information relating to the files and folders it copies as well as, presumably, special cases like the system boot sectors.
A filesystem image typically does not preserve the physical location of files on the hard drive, only the contents and attributes of the files.
Like a disk image, a filesystem image implies a couple of interesting things:
-
A filesystem image does not copy unused areas of your hard disk; it copies only existing data.
-
A filesystem image, when restored, does not necessarily put data back in the same physical locations on the hard drive (though I suppose it could). A restore from a filesystem image typically acts more like a regular series of file copies and will put data in the next available space by whatever rules the filesystem implements.
The good news here is that a filesystem image is only as big as the data that's on your drive. If you have 10 gigabytes of data on your 250 gigabyte drive, then your filesystem image will be only 10 gigabytes.
The bad news ... well, for most folks there really isn't any. There are rare cases where you might actually need a sector-by-sector disk image, but for the average user backing up data or even snapshotting or transferring systems from one drive to another, a filesystem image approach to backup is more than sufficient.
Related:
-
Ask Leo! - What backup program should I use?
-
Ask Leo! - Can't I just copy everything instead of using a backup program?
Article C3352 - April 16, 2008
Hi Leo
Posted by: Just J at April 16, 2008 7:40 AMA query on this article if I may. Can you still restore from a FileSystem image in the same way as you would with a 'full' Disk Image?
Thanks!
Leo, if I may respond to your questioner regarding restoring a file system image: There are two answers -
Posted by: Steve Burgess at April 18, 2008 10:41 AM1: As long as (as Leo says) it includes all of the system information relating to the files and folders it copies as well as...boot sectors" then the answer is - Yes...however, you'll be overwriting everything on the drive to which you're copying the data.
Answer #2: If all of the data from the initial image is saved as a ginormous file (or several), then it would need to be restored by the program that made the image(s), or one built to restore such images.
Steve Burgess
Burgess Computer Forensics
Leo,
Posted by: Steve Burgess at April 18, 2008 11:22 AMI’d like to add another layer of distinction, for I get asked this question myself - but in my field, they’re asking something (slightly) different although they don't always realize it. A “disk image” may be different from a “forensic disk image” due to the provable validitiy that the image or copy is identical to the original. Several computer forensic packages verify this by generating a hash value (or hash signature) for the original and for the copy, and then comparing the two. If they match, they’re identical (well, the odds are better than a quadrillion to one that they’re identical). A hash is a number calculated form string of text – in this case, the string of text is every consecutive sector on the hard disk. If it is if value to your readers, we’ve put up a glossary of such terms here: http://www.burgessforensics.com/glossary.php
Leo,
Posted by: colin_w at April 19, 2008 1:12 AMI presume that your two types of imaging are distinct from cloning or making an exact copy of the disk as offered by Norton Ghost and Acronis True Image? Thanks.
Message to Steve Burgess.
Thank you very much for responding.
Leo explained very well the differences between the two backup mediums, but left me wondering whether you could restore in the same way once backed-up.
Again, thank you for the time taken to explain this to me. It was very a very detailed & informative answer.
Kind regards.
Posted by: Just J at April 19, 2008 9:41 AMI guess both disk imaging and exact copying will be good enough for backing up files.
Posted by: A. Orcan at April 21, 2008 1:25 AMBut, I'm sure once in a while a computer simply won't start due to reasons like hard disk crashes, improper use of registry cleanup, system maintenance/optimization, Anti-malware programs, deletion of infected system files, software uninstallation,etc. Then one could restore files from a backup copy. But how to restore anything if you can't even boot your computer? What if even your partitioning info is lost? This may turn out to be a real problem as even an exact copy might not be enough.
My solution has been:
Keep C: as small as possible, about 20 MB (use another drive for virtual memory - bettter in many ways),
Make an exact backup copy in a special partition (F:) in my second hard disk regularly, including all software and hardware system files.
Thus, if anything goes wrong with C:, I start my PC again, select F: as the bootup drive in BIOS and boot again. After recovering any needed data on C: I do whatever is needed to make it boot drive again. In cases of drives other than C: same operation is easier. Of course, as in the other backup methods, some data and changes after last boot may be lost.
I guess this beats re-installing Windows , re-downloading and re-installing all the service packs and patches (I shudder when I think the time I had to spend to download multi-processor drivers, XP patches for the same, re-activation problems, license problems due to lost registry records,...), re-setting all the preferences not to mention other work needed.
Note that if C: crashes, system restore will probably not work anyway.
Keeping C: small and preferably keeping some of the system files elsewhere makes it easier and faster checking for malware, defragging and compacting the operating system as well as keeping boot-up and turn-off times lower.
Without using image or clone.I have an autorun or autoplay cd.I used windows copy and paste the contents(data) onto the hard drive.I copy back the contents from hard drive onto cd.Now the new cd has no autorun or autoplay why.
Posted by: max at December 13, 2008 5:36 AMHii...
Anybody has any idea about what are the technologies used in the creation of a A file system image.What they are actually doing? I think they are filtering the used and free clusters.Copying the used clusters only.So how the copied data getting link among them;because the free space may be there,and the source may not be fragmented.
We have to change the Volume boot record of the duplicated destination ?
How to reinitialize the link between them?
Is it possible?
Thanking you,
Posted by: Krish at June 11, 2009 6:19 AMKrish.