Disk image

From Wikipedia, the free encyclopedia

 This article does not cite any references or sources. (April 2008)
Please help improve this article by adding citations to reliable sources. Unverifiable material may be challenged and removed.
For discussion of CD and DVD images, see optical disc image.

A disk image is an archive file containing the complete contents and structure of a data storage medium or device, such as a hard drive, CD, or DVD. A disk image file is usually created based upon the sectors on the medium (bit copy), ignoring its file system. As such, a disk image contains all the information necessary to perfectly replicate the structure and contents of a storage device.

The term disk image has come to mean any file, whether originated from an actual physical storage device or not, capable of producing the relative structure and data file contents of the intended destination medium. Disk imaging utilities, when not replicating an entire original source medium, such as omitting unused file space on the source media, are actually creating an archive file and not a true disk image.

Contents

[edit] Uses

[edit] Historical

Originally disk images were used for backup and disk cloning of floppy media, where replication or storage of an exact structure was necessary and efficient.

[edit] System Backup

An ordinary backup program only backs up the files it can access; boot information and files locked by the operating system (such as those in use at the time of the backup) may not be saved. A full disk image contains all these, faithfully replicating all data. For this reason, it is commonly used for backing up disks with operating systems, or bootable CDs and DVDs.

[edit] Rapid Deployment of Clone Systems

Large enterprises often need to buy or replace new computer systems in large numbers. Installing operating system and programs in to each of them one by one requires a lot of time and effort and has a significant possibility of human error. Therefore, system administrators use disk imaging to quickly clone the fully-prepared software environment of a reference system. This method saves time and effort and allows administrators to focus on unique distinctions that each system must bear.

[edit] Imaging process

Creating a disk image is achieved through a suitable program. Different imaging software as a rule focus on either hard drive imaging (including hard drive backup, restore and rollout), or optical media imaging (CD/DVD images).

[edit] Hard drive imaging

In hard drive imaging, there are three main areas of focus.

A) Forensic imaging is the process where the entire drive contents are imaged to a file and checksum values are calculated to verify the integrity (in court cases) of the image file (often referred to as a “hash value”). Forensic images are acquired with the use of software tools. (Some hardware cloning tools have added forensic functionality.)

B) Drive cloning, as previously mentioned, is typically used to replicate the contents of the hard drive for use in another system. This can typically be done by software-only programs as it typically only requires the cloning of file structure and files themselves.

C) Data recovery imaging (like forensic imaging) is the process of imaging every single sector on the source drive to another medium from which required files can be retrieved. In data recovery situations, one cannot rely on the integrity of the file structure and therefore a complete sector copy is mandatory (also similar to forensic imaging). The similarities to forensic imaging end there though. Forensic images are typically acquired using software tools such as EnCase and FTK. However, forensic imaging software tools have significantly limited ability to deal with drives that have hard errors (which is often the case in data recovery and why the drive was submitted for recovery in the first place).

Data recovery imaging must have the ability to pre-configure drives by disabling certain attributes (such a SMART and G-List re-mapping) and the ability to work with unstable drives (drive instability/read instability can be caused by minute mechanical wear and other issues). Data recovery imaging must have the ability to read data from “bad sectors.” Read instability is a major factor when working with drives in operating systems such as Windows. A typical operating system is limited in its ability to deal with drives that take a long time to read. For these reasons, software that relies on the BIOS and operating system to communicate with the hard drive is often unsuccessful in data recovery imaging; separate hardware control of the source hard drive is required to achieve the full spectrum of data recovery imaging. This is due to the fact that the operating system (through the BIOS) has a certain set of protocols or rules for communication with the drive that cannot be violated (such as when the hard drive detects a bad sector). A hard drive’s protocols may not allow “bad” data to be propagated through to the operating system; firmware on the drive may compensate by rereading sectors until checksums, CRCs, or ECCs pass, or use ECC data to recreate damaged data.

Data recovery images may or may not make use of any type of image file. Typically, a data recovery image is performed drive to drive and therefore no image file is required.

[edit] File Formats

Below are examples of archive formats specific to disk image files. a comprehensive list and comparison of archive formats are also available.

[edit] CD / DVD Specific

Binary imaging of optical media is supported by the following software and image formats:

- Single track archive -

- Multi-track archive -

[edit] Hard Disk Specific

These formats support binary imaging:

Other hard disk image formats such as VMware (.vmdk), Microsoft (.vhd), VirtualBox (.vdi), Symantec (.v2i), Acronis True Image (.tib) do not support true binary imaging.

[edit] Floppy Specific

[edit] Other Imaging Formats

[edit] See also


v • d • e
Disk image file formats
Personal Computers
MAC / UNIX
Deprecated / Proprietary / Other