A utility I have offers two methods of saving a disk: imaging or copying.
What’s the difference?
When talking about backing up your hard drive we often throw around a lot of
different terms. “Imaging” is one of them, and it’s frequently misused.
Let’s look at the differences, and when you might want to use one over the
other.
Become a Patron of Ask Leo! and go ad-free!
In its strictest, most correct sense, a disk image is a perfect
copy of everything on the disk. And in this case I do mean everything.
A true disk image is a sector-by-sector copy of the contents of the disk,
paying no attention to the contents of those sectors.
That means a couple of interesting things:
-
A true disk image includes “copies” of the contents of all of the
unused areas on the hard disk as well as the areas that currently
contain data. -
A true disk image, when restored, puts data back in the exact same location
on the disk as it was when the image was created. For example any fragmentation
is unaffected and preserved.
whether or not there’s data.”
The neat thing about this type of disk imaging is that the tool doesn’t need
to understand the contents of the disk that it’s operating on. It simply
operates on the disk at a level below the operating system or filesystem to
simply copy the raw data.
The bad thing about a true disk image is that it includes the entire disk,
whether or not there’s data. If you have a hard drive with a capacity
of 250gigabytes, then 250gigabytes is what the image will contain, no matter
how much data you actually have on the drive. The actual image may be smaller,
of course, due to compression, but the fact is all 250 gigabytes are present,
whether you need them or not.
The other type of “disk image” is more correctly a “filesystem image”. This
approach is aware of the type of filesystem you have on your hard disk and what
files are on it. A filesystem image would most likely be the “copy” your backup
utility is referring to. (Though many backup utilities use the phrase “image”
to refer to a filesystem image – Acronis
TrueImage being one obvious example.)
When a utility makes a filesystem image, it effectively copies all the files
and folders on your hard disk, not unlike a file copy you might perform, and
then also includes all of the system information relating to the files and
folders it copies as well as, presumably, special cases like the system boot
sectors.
A filesystem image typically does not preserve the physical location of
files on the hard drive, only the contents and attributes of the files.
Like a disk image, a filesystem image implies a couple of interesting
things:
-
A filesystem image does not copy unused areas of your hard disk; it
copies only existing data. -
A filesystem image, when restored, does not necessarily put data back in the
same physical locations on the hard drive (though I suppose it could). A
restore from a filesystem image typically acts more like a regular series of
file copies and will put data in the next available space by whatever rules the
filesystem implements.
The good news here is that a filesystem image is only as big as the data
that’s on your drive. If you have 10 gigabytes of data on your 250 gigabyte
drive, then your filesystem image will be only 10 gigabytes.
The bad news … well, for most folks there really isn’t any. There are rare
cases where you might actually need a sector-by-sector disk image, but for the
average user backing up data or even snapshotting or transferring systems from
one drive to another, a filesystem image approach to backup is more than
sufficient.
Hi Leo
A query on this article if I may. Can you still restore from a FileSystem image in the same way as you would with a ‘full’ Disk Image?
Thanks!
Leo, if I may respond to your questioner regarding restoring a file system image: There are two answers –
1: As long as (as Leo says) it includes all of the system information relating to the files and folders it copies as well as…boot sectors” then the answer is – Yes…however, you’ll be overwriting everything on the drive to which you’re copying the data.
Answer #2: If all of the data from the initial image is saved as a ginormous file (or several), then it would need to be restored by the program that made the image(s), or one built to restore such images.
Steve Burgess
Burgess Computer Forensics
Leo,
I presume that your two types of imaging are distinct from cloning or making an exact copy of the disk as offered by Norton Ghost and Acronis True Image? Thanks.
Message to Steve Burgess.
Thank you very much for responding.
Leo explained very well the differences between the two backup mediums, but left me wondering whether you could restore in the same way once backed-up.
Again, thank you for the time taken to explain this to me. It was very a very detailed & informative answer.
Kind regards.
I guess both disk imaging and exact copying will be good enough for backing up files.
But, I’m sure once in a while a computer simply won’t start due to reasons like hard disk crashes, improper use of registry cleanup, system maintenance/optimization, Anti-malware programs, deletion of infected system files, software uninstallation,etc. Then one could restore files from a backup copy. But how to restore anything if you can’t even boot your computer? What if even your partitioning info is lost? This may turn out to be a real problem as even an exact copy might not be enough.
My solution has been:
Keep C: as small as possible, about 20 MB (use another drive for virtual memory – bettter in many ways),
Make an exact backup copy in a special partition (F:) in my second hard disk regularly, including all software and hardware system files.
Thus, if anything goes wrong with C:, I start my PC again, select F: as the bootup drive in BIOS and boot again. After recovering any needed data on C: I do whatever is needed to make it boot drive again. In cases of drives other than C: same operation is easier. Of course, as in the other backup methods, some data and changes after last boot may be lost.
I guess this beats re-installing Windows , re-downloading and re-installing all the service packs and patches (I shudder when I think the time I had to spend to download multi-processor drivers, XP patches for the same, re-activation problems, license problems due to lost registry records,…), re-setting all the preferences not to mention other work needed.
Note that if C: crashes, system restore will probably not work anyway.
Keeping C: small and preferably keeping some of the system files elsewhere makes it easier and faster checking for malware, defragging and compacting the operating system as well as keeping boot-up and turn-off times lower.
Without using image or clone.I have an autorun or autoplay cd.I used windows copy and paste the contents(data) onto the hard drive.I copy back the contents from hard drive onto cd.Now the new cd has no autorun or autoplay why.
Hii…
Anybody has any idea about what are the technologies used in the creation of a A file system image.What they are actually doing? I think they are filtering the used and free clusters.Copying the used clusters only.So how the copied data getting link among them;because the free space may be there,and the source may not be fragmented.
We have to change the Volume boot record of the duplicated destination ?
How to reinitialize the link between them?
Is it possible?
Thanking you,
Krish.
And wich Software can i use, to make a disk image from a dynamic disk?
the content was very useful to me leo but still i have a query, that the question started with the what is the difference between ‘Imaging’ n ‘Cloning’, but in the entire explanation it talks only about imaging and its 2 types i.e. ‘truedisk imaging’ and ‘file system image’ but there is no clue/reference of which of these is called as cloning or there is no specification which defines cloning and how is it indifferent from imaging. i’d be gald if you could shed some some light on ma query.
thank you leo, you’ve always been a source of light when it comes to ‘KNOWLEDGE’.
12-May-2011
Hello Leo,
I would love to know some further details about how these work. First, let me say that I am specifically interested in the scenario of replacing a dead drive (a bootable one containing the OS). So, I have a SSD for boot, OS, and apps and a mechanical HDD for data. The SSD only has 1 partition. Let’s say my SSD died and I’m replacing it with a brand new SSD.
1. Would both types of images have to be restored or written to the new, fresh drive by the same software that originally made either image? It seems to me that the full disk image might be somewhat of a more universal type of thing, kind of like how the .iso format is standard for making images of cds/dvds. So, if I created a true disk image, could I then have the flexibility of using any backup utility to write the image to a brand new SSD (or any drive)?
2. You say that creating a filesystem image does take care of things like system boot sectors, but can you elaborate on this? How does it work? I’m somehow a bit nervous that in my scenario of restoring to a brand new SSD something will be missing and the restore will not work quite right compared to having a full disk image…
3. What if I have not one but two partitions on my SSD. Then is it correct that I cannot just create and later restore a filesystem image of the whole drive? I could do this with a “true disk image,” right? But with a filesystem image, would I only be able to create a separate image of each partition? Then I would have to restore both images of each partition to the new drive, right?
Thank you
2) Using Acronis there’s a checkbox when making an image that says “include boot sector” (or something similar). Other programs will of course make different assumptions and make different options available.
3) Again, using Acronis as the model, when you create an image you simply select both partitions. And once again, other programs may do things differently.
06-Jun-2011
Hi Leo,
Thank you for the reply to my previous comment. I just did my first ever backup using Acronis TI. But it’s strange that there wasn’t really that kind of option like you said. Instead, it showed two partitions on “Disk 1” (my ssd), with one of them called System Reserved and sized only 100MB (I never see this partition in Windows). The other partition matched what I was expecting to see: ~90GB, the same as what I see in Windows. So I checked both. Is the “System Reserved” partition which I otherwise never see the one that contains the boot sector?
It’s an odd version of Acronis. It came bundled with my Kingston SSDNow V+100, but it seems to be crippled somehow. Some stuff described in the help files are not even present in the program itself, like some options items. It also cannot be installed–there was no setup program on the CD. It only works by booting off the CD.
Thanks
@Alex
Often, in fact usually, software which comes free with hardware is a limited or trial version and not the full commercial version.
You have been extremely helpful. I have a standard Internal mechanical HDD as my secondary back. I always clone my primary to the secondary using Acronis True Image back up system and it works out great. I am planning to install an external SSD system to a USB port. Should I use an Image back up to the SSD, or should I clone to the SSD as I do to the Internal mechanical HDD?