Helping people with computers... one answer at a time.

The word "imaging" when applied to disks is often misused and subject to some interpretation. Imaging can mean different things to different programs.

A utility I have offers two methods of saving a disk: imaging or copying. What's the difference?

When talking about backing up your hard drive we often throw around a lot of different terms. "Imaging" is one of them, and it's frequently misused.

Let's look at the differences, and when you might want to use one over the other.

In its strictest, most correct sense, a disk image is a perfect copy of everything on the disk. And in this case I do mean everything. A true disk image is a sector-by-sector copy of the contents of the disk, paying no attention to the contents of those sectors.

That means a couple of interesting things:

  • A true disk image includes "copies" of the contents of all of the unused areas on the hard disk as well as the areas that currently contain data.

  • A true disk image, when restored, puts data back in the exact same location on the disk as it was when the image was created. For example any fragmentation is unaffected and preserved.

"The bad thing about a true disk image is that it includes the entire disk, whether or not there's data."

The neat thing about this type of disk imaging is that the tool doesn't need to understand the contents of the disk that it's operating on. It simply operates on the disk at a level below the operating system or filesystem to simply copy the raw data.

The bad thing about a true disk image is that it includes the entire disk, whether or not there's data. If you have a hard drive with a capacity of 250gigabytes, then 250gigabytes is what the image will contain, no matter how much data you actually have on the drive. The actual image may be smaller, of course, due to compression, but the fact is all 250 gigabytes are present, whether you need them or not.

The other type of "disk image" is more correctly a "filesystem image". This approach is aware of the type of filesystem you have on your hard disk and what files are on it. A filesystem image would most likely be the "copy" your backup utility is referring to. (Though many backup utilities use the phrase "image" to refer to a filesystem image - Acronis TrueImage being one obvious example.)

When a utility makes a filesystem image, it effectively copies all the files and folders on your hard disk, not unlike a file copy you might perform, and then also includes all of the system information relating to the files and folders it copies as well as, presumably, special cases like the system boot sectors.

A filesystem image typically does not preserve the physical location of files on the hard drive, only the contents and attributes of the files.

Like a disk image, a filesystem image implies a couple of interesting things:

  • A filesystem image does not copy unused areas of your hard disk; it copies only existing data.

  • A filesystem image, when restored, does not necessarily put data back in the same physical locations on the hard drive (though I suppose it could). A restore from a filesystem image typically acts more like a regular series of file copies and will put data in the next available space by whatever rules the filesystem implements.

The good news here is that a filesystem image is only as big as the data that's on your drive. If you have 10 gigabytes of data on your 250 gigabyte drive, then your filesystem image will be only 10 gigabytes.

The bad news ... well, for most folks there really isn't any. There are rare cases where you might actually need a sector-by-sector disk image, but for the average user backing up data or even snapshotting or transferring systems from one drive to another, a filesystem image approach to backup is more than sufficient.

Article C3352 - April 16, 2008 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

14 Comments
Just J
April 16, 2008 7:40 AM

Hi Leo
A query on this article if I may. Can you still restore from a FileSystem image in the same way as you would with a 'full' Disk Image?
Thanks!

Steve Burgess
April 18, 2008 10:41 AM

Leo, if I may respond to your questioner regarding restoring a file system image: There are two answers -
1: As long as (as Leo says) it includes all of the system information relating to the files and folders it copies as well as...boot sectors" then the answer is - Yes...however, you'll be overwriting everything on the drive to which you're copying the data.
Answer #2: If all of the data from the initial image is saved as a ginormous file (or several), then it would need to be restored by the program that made the image(s), or one built to restore such images.
Steve Burgess
Burgess Computer Forensics

Steve Burgess
April 18, 2008 11:22 AM

Leo,
I’d like to add another layer of distinction, for I get asked this question myself - but in my field, they’re asking something (slightly) different although they don't always realize it. A “disk image” may be different from a “forensic disk image” due to the provable validitiy that the image or copy is identical to the original. Several computer forensic packages verify this by generating a hash value (or hash signature) for the original and for the copy, and then comparing the two. If they match, they’re identical (well, the odds are better than a quadrillion to one that they’re identical). A hash is a number calculated form string of text – in this case, the string of text is every consecutive sector on the hard disk. If it is if value to your readers, we’ve put up a glossary of such terms here: http://www.burgessforensics.com/glossary.php

colin_w
April 19, 2008 1:12 AM

Leo,
I presume that your two types of imaging are distinct from cloning or making an exact copy of the disk as offered by Norton Ghost and Acronis True Image? Thanks.

Just J
April 19, 2008 9:41 AM

Message to Steve Burgess.

Thank you very much for responding.

Leo explained very well the differences between the two backup mediums, but left me wondering whether you could restore in the same way once backed-up.

Again, thank you for the time taken to explain this to me. It was very a very detailed & informative answer.

Kind regards.

A. Orcan
April 21, 2008 1:25 AM

I guess both disk imaging and exact copying will be good enough for backing up files.
But, I'm sure once in a while a computer simply won't start due to reasons like hard disk crashes, improper use of registry cleanup, system maintenance/optimization, Anti-malware programs, deletion of infected system files, software uninstallation,etc. Then one could restore files from a backup copy. But how to restore anything if you can't even boot your computer? What if even your partitioning info is lost? This may turn out to be a real problem as even an exact copy might not be enough.
My solution has been:
Keep C: as small as possible, about 20 MB (use another drive for virtual memory - bettter in many ways),
Make an exact backup copy in a special partition (F:) in my second hard disk regularly, including all software and hardware system files.
Thus, if anything goes wrong with C:, I start my PC again, select F: as the bootup drive in BIOS and boot again. After recovering any needed data on C: I do whatever is needed to make it boot drive again. In cases of drives other than C: same operation is easier. Of course, as in the other backup methods, some data and changes after last boot may be lost.
I guess this beats re-installing Windows , re-downloading and re-installing all the service packs and patches (I shudder when I think the time I had to spend to download multi-processor drivers, XP patches for the same, re-activation problems, license problems due to lost registry records,...), re-setting all the preferences not to mention other work needed.
Note that if C: crashes, system restore will probably not work anyway.
Keeping C: small and preferably keeping some of the system files elsewhere makes it easier and faster checking for malware, defragging and compacting the operating system as well as keeping boot-up and turn-off times lower.

max
December 13, 2008 5:36 AM

Without using image or clone.I have an autorun or autoplay cd.I used windows copy and paste the contents(data) onto the hard drive.I copy back the contents from hard drive onto cd.Now the new cd has no autorun or autoplay why.

Krish
June 11, 2009 6:19 AM

Hii...

Anybody has any idea about what are the technologies used in the creation of a A file system image.What they are actually doing? I think they are filtering the used and free clusters.Copying the used clusters only.So how the copied data getting link among them;because the free space may be there,and the source may not be fragmented.


We have to change the Volume boot record of the duplicated destination ?
How to reinitialize the link between them?
Is it possible?

Thanking you,
Krish.

Martin
October 26, 2010 5:09 AM

And wich Software can i use, to make a disk image from a dynamic disk?

Vikas L Naik
May 11, 2011 8:33 PM

the content was very useful to me leo but still i have a query, that the question started with the what is the difference between 'Imaging' n 'Cloning', but in the entire explanation it talks only about imaging and its 2 types i.e. 'truedisk imaging' and 'file system image' but there is no clue/reference of which of these is called as cloning or there is no specification which defines cloning and how is it indifferent from imaging. i'd be gald if you could shed some some light on ma query.

thank you leo, you've always been a source of light when it comes to 'KNOWLEDGE'.

There is no hard-and-fast definition to either term. Imaging typically refers to a byte-for-byte copy of the data, while cloning often referes to a byte-for-byte copy of the sectors, including empty sectors. But there are many who define the terms in exactly the opposite way.
Leo
12-May-2011

Alex M
June 6, 2011 12:50 AM

Hello Leo,

I would love to know some further details about how these work. First, let me say that I am specifically interested in the scenario of replacing a dead drive (a bootable one containing the OS). So, I have a SSD for boot, OS, and apps and a mechanical HDD for data. The SSD only has 1 partition. Let's say my SSD died and I'm replacing it with a brand new SSD.

1. Would both types of images have to be restored or written to the new, fresh drive by the same software that originally made either image? It seems to me that the full disk image might be somewhat of a more universal type of thing, kind of like how the .iso format is standard for making images of cds/dvds. So, if I created a true disk image, could I then have the flexibility of using any backup utility to write the image to a brand new SSD (or any drive)?

2. You say that creating a filesystem image does take care of things like system boot sectors, but can you elaborate on this? How does it work? I'm somehow a bit nervous that in my scenario of restoring to a brand new SSD something will be missing and the restore will not work quite right compared to having a full disk image...

3. What if I have not one but two partitions on my SSD. Then is it correct that I cannot just create and later restore a filesystem image of the whole drive? I could do this with a "true disk image," right? But with a filesystem image, would I only be able to create a separate image of each partition? Then I would have to restore both images of each partition to the new drive, right?

Thank you

1) typically, yes. There's sadly no standard image format.

2) Using Acronis there's a checkbox when making an image that says "include boot sector" (or something similar). Other programs will of course make different assumptions and make different options available.

3) Again, using Acronis as the model, when you create an image you simply select both partitions. And once again, other programs may do things differently.
Leo
06-Jun-2011

Alex M
June 7, 2011 5:13 PM

Hi Leo,

Thank you for the reply to my previous comment. I just did my first ever backup using Acronis TI. But it's strange that there wasn't really that kind of option like you said. Instead, it showed two partitions on "Disk 1" (my ssd), with one of them called System Reserved and sized only 100MB (I never see this partition in Windows). The other partition matched what I was expecting to see: ~90GB, the same as what I see in Windows. So I checked both. Is the "System Reserved" partition which I otherwise never see the one that contains the boot sector?

It's an odd version of Acronis. It came bundled with my Kingston SSDNow V+100, but it seems to be crippled somehow. Some stuff described in the help files are not even present in the program itself, like some options items. It also cannot be installed--there was no setup program on the CD. It only works by booting off the CD.

Thanks

Mark J
June 7, 2011 11:38 PM

@Alex
Often, in fact usually, software which comes free with hardware is a limited or trial version and not the full commercial version.

Vicktor
April 27, 2012 9:09 AM

You have been extremely helpful. I have a standard Internal mechanical HDD as my secondary back. I always clone my primary to the secondary using Acronis True Image back up system and it works out great. I am planning to install an external SSD system to a USB port. Should I use an Image back up to the SSD, or should I clone to the SSD as I do to the Internal mechanical HDD?

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.