true disk image Vs. file system image

What data recovery tools to buy if you want to start a data recovery business?

Free video data recovery training on how to recover lost data from different hard drives?

Where to buy head and platter replacement tools at good prices?

Data recover case studies step by step guide

I want to attend professional data recovery training courses

A true disk image is a sector-by-sector copy of the contents of the disk, paying no attention to the contents of those sectors.

That means a couple of interesting things:

* A true disk image includes “copies” of the contents of all of the unused areas on the hard disk as well as the areas that currently contain data.

* A true disk image, when restored, puts data back in the exact same location on the disk as it was when the image was created. For example any fragmentation is unaffected and preserved.

* The neat thing about this type of disk imaging is that the tool doesn’t need to understand the contents of the disk that it’s operating on. It simply operates on the disk at a level below the operating system or filesystem to simply copy the raw data.

* The bad thing about a true disk image is that it includes the entire disk, whether or not there’s data. If you have a hard drive with a capacity of 250gigabytes, then 250gigabytes is what the image will contain, no matter how much data you actually have on the drive. The actual image may be smaller, of course, due to compression, but the fact is all 250 gigabytes are present, whether you need them or not.

* The other type of “disk image” is more correctly a “filesystem image”. This approach is aware of the type of filesystem you have on your hard disk and what files are on it.

When a utility makes a filesystem image, it effectively copies all the files and folders on your hard disk, not unlike a file copy you might perform, and then also includes all of the system information relating to the files and folders it copies as well as, presumably, special cases like the system boot sectors.

A filesystem image typically does not preserve the physical location of files on the hard drive, only the contents and attributes of the files.

Like a disk image, a filesystem image implies a couple of interesting things:

* A filesystem image does not copy unused areas of your hard disk; it copies only existing data.

* A filesystem image, when restored, does not necessarily put data back in the same physical locations on the hard drive (though I suppose it could). A restore from a filesystem image typically acts more like a regular series of file copies and will put data in the next available space by whatever rules the filesystem implements.

The good news here is that a filesystem image is only as big as the data that’s on your drive. If you have 10 gigabytes of data on your 250 gigabyte drive, then your filesystem image will be only 10 gigabytes.

The bad news … well, for most folks there really isn’t any. There are rare cases where you might actually need a sector-by-sector disk image, but for the average user backing up data or even snapshotting or transferring systems from one drive to another, a filesystem image approach to backup is more than sufficient.

Actually true disk image will be good for forensic computer professionals to get intact data. Data Copy king has been developped as one true disk image tool/hard drive duplicator and besides Data Copy King is able to wipe data permanently, whether it’s HPA or DCO areas, the image and wipe solutions are able to handle perfectly.