Disk image: Difference between revisions

A disk image is an archive file containing the complete contents and structure of a data storage medium or device, such as a hard drive, CD, or DVD. A disk image file is usually created based upon the sectors on the medium (bit copy), ignoring its file system. As such, a disk image contains all the information necessary to perfectly replicate the structure and contents of a storage device.

however, the term disk image has been generalized to cover any file, whether originated from an actual physical storage device or not, capable of producing the relative structure and data file contents of the intended destination medium. Disk imaging utilities, when not replicating an entire original source medium, such as omitting unused file space on the source media, are actually creating an archive file and not a true disk image.

= Historical

Originally disk images were used for backup and disk cloning of floppy media, where replication or storage of an exact structure was necessary or efficient.

With the advent of the Internet, it became convenient to use archive files to distribute "Disk images" of optical drives such as CD-ROM and later DVD.

Data storage

An ordinary backup program only backs up the files it can access; boot information and files locked by the operating system (such as those in use at the time of the backup) may not be saved. A full disk image contains all these, faithfully replicating all data. For this reason, it is commonly used for backing up disks with operating systems, or bootable CDs and DVDs.

Software distribution

A common use of disk images is for distribution of large programs or software systems over the internet. Installation disks and LiveCDs for operating systems such as Linux or BSD systems are typically available as .ISO images. Installation floppy disks or CD-ROMs are stored as disk image files, transferred over the internet, and burned or copied onto actual disks by end users.

Disk images, most often .ISO or .BIN/.CUE files, are also popular for peer-to-peer file sharing of software.

Rapid deployment of clone systems

Large enterprises often need to buy or replace new computer systems in large numbers. Installing operating system and programs in to each of them one by one requires a lot of time and effort and has a significant possibility of human error. Therefore, system administrators use disk imaging to quickly clone the fully-prepared software environment of a reference system. This method saves time and effort and allows administrators to focus on unique distinctions that each system must bear.

Universal archive formats

As images are unaffected by the file system or contents of the original data source, and most operating systems allow disk images to be mounted as if they were physical discs, image formats such as .ISO may be used as a universal archive format.

Virtual disks

Another common use is to provide virtual disk drive space to be used by emulators (e.g., QEMU) and virtual machines. This can prevent the CD from getting damaged. It can also reduce bulk when one wishes to carry the contents of the CD along with oneself: one can store disk images to a relatively lightweight and bootable storage device which has a higher storage capacity than that of a CD (e.g., a USB keydrive).

Emulation also provides a performance boost, as hard disks transfer data at much higher rates than optical disk drives. Console emulators, such as ePSXe, and many other emulators that read from CD/DVD, are able to read ISO/BIN (and other similar formats) instead of running directly from the CD drive, obtaining better performance.

Another reason for some people is that CD/DVD drives are noisy, a virtual disk on a hard disk is already a lot less noisy, and a USB stick is silent.

Imaging process

Creating a disk image is achieved through a suitable program. Different imaging software as a rule focus on either hard drive imaging (including hard drive backup, restore and rollout), or optical media imaging (CD/DVD images).

Hard drive imaging

In Hard Drive Imaging, there are three main areas of focus:

A) Forensic Imaging, which is the process where the entire drive contents are imaged to a file and checksum values are calculated to verify the integrity (in court cases) of the image file (often referred to as a “hash value”.) Forensic images are acquired with the use of software tools (Some hardware cloning tools have added forensic functionality.)

B) Drive Cloning, which as previously mentioned is typically used to replicate the contents of the hard drive for use in another system. This can typically be done by software-only programs as it typically only requires the cloning of file structure and files themselves.

C) Data Recovery Imaging, which (like forensic imaging) is the process of imaging every single sector on the source drive to an alternate location from which required files can be retrieved. In data recovery situations, one cannot rely on the integrity of the file structure and therefore a complete sector copy is mandatory (also similar to forensic imaging.) The similarities to forensic imaging end there though. Forensic images are typically acquired using software tools such as EnCase and FTK. However, software tools have significantly limited ability to deal with drives that are not 100% functional (which is often the case in Data Recovery and why the drive was submitted for recovery in the first place.) Data Recovery imaging must have the ability to pre-configure drives by disabling certain attributes (such a SMART and G-List re-mapping,) the ability to work with unstable drives (drive instability / read instability can be caused by minute mechanical wear and other issues,) as well, data recovery imaging must have the ability to read data from “bad sectors.” (Read instability is a major factor when working with drives in operating systems such as Windows. A typical operating system is limited in its ability to deal with drives that take a long time to read.) For these reasons, software that relies on the BIOS and operating system to communicate with the hard drive is often unsuccessful in data recovery imaging; separate hardware control of the source hard drive is required to achieve the full spectrum of data recovery imaging. This is due to the fact that the operating system (through the BIOS) has a certain set of protocols or rules for communication with the drive that cannot be violated (such as when the hard drive detects a bad sector. A hard drive’s protocols will not allow “bad” data to be propagated through to the operating system.) Data Recovery images may or may not make use of any type of image file. Typically, a data recovery image is performed drive to drive and therefore no image file is required.

CD/DVD imaging

Common disk-imaging programs are: Alcohol 120%, Daemon Tools, CDRWin, CloneCD/DVD and Nero Burning ROM for Windows; Disk Utility, Roxio Toast and Disco for Macintosh; K3B and X-CD-Roast for Linux; dd for Unix-like operating systems.

For CDs containing Red Book CD audio, classified as multi-track CDs (data or audio on the first track, data or audio on any subsequent tracks), a CD image is required, as CD audio cannot be copied directly via the standard Windows, Macintosh or Linux interfaces. This is because CD audio is physically imprinted on the surface of the disc in the form of pits and holes, much like the grooves on a vinyl record. For example, a computer game containing the game's data on the first track of the CD, but the game's music soundtrack in Red Book CD-audio format on following tracks, would require a CD image to retain the CD-audio. If a single-track image format like .ISO is used, then only the data will be retained and no music would be heard in the game.

Restoration

Once created, an image file can be treated as a form of compressed archive, containing all the information needed to replicate the original media: its contents and its physical layout on the relevant device. As such, disk images can be restored onto a suitable physical device (a hard drive or a CD/DVD) to replicate the original. Alternatively, if the structural information is unnecessary, programs such as ISOBuster and WinRAR which handle file compression generally, can unpack the individual files from a disk image.

File Formats

Disk image files are created using an archive formats determined by the imaging software. Below are examples of archive formats specific to disk image files.

CD Specific

Images of CD-ROMs most often carry the filename extension .ISO, referring to the ISO 9660 file system commonly used on such disks. The .ISO format is the most common format for Linux distributions and other disk images distributed over the internet, but it is not a multi-track image format and thus cannot be used for Audio CDs. Other common CD image formats are .NRG (Nero Burning ROM's proprietary format), .BIN/.CUE, .MDF/.MDS (Alcohol 120%'s proprietary format[can be read by Magic Iso, and converted to .ISO format]), .DAA (PowerISO's proprietary format), and .CCD/.IMG/.SUB (CloneCD's proprietary format). All of these support multi-track CDs.

(relocated chunk)

Proprietary formats include .NRG (Nero Burning ROM), .MDS/.MDF (Alcohol 120%), .DAA (PowerISO), .PQI (DriveImage), and .CCD/.IMG/.SUB/.DVD (CloneCD). Other disk image formats include: .img (commonly used for USB stick and hard disks) and .DMG (used by Apple).

Floppy Specific

DCF

.DCF is a file extension used by Disk Copy Fast (DCF) and Disk Copy Plus written by Chang Ping Lee. It contains a raw image of a floppy disk. This format is not compatible with Rawrite (.IMG) format.

.IMA

.IMA is a filename extention used by Nero and WinImage for disk image of floppy disks. A .IMA file contains the raw image of the floppy disk and metadata including file comments.

.ISO

Main article: ISO image

An ISO file is a disk image of an ISO 9660 file system. The term ISO image is also used informally to refer to any optical disk image, even if the disk uses another file system, such as UDF. The .ISO format is used by most CD/DVD authoring utilities. *.ISO files may be created from existing physical media or from files and folders on a computer. .ISO images can be mounted in "virtual drives" which emulate physical hardware, or burned to CDs or DVDs. .ISO image may contain only single data track of a single session of a disk (which means multitrack or multisession disks cannot be stored as ISO image).

.ISO files are often used to distribute large programs or software systems over the internet. Operating systems such as Linux or BSD systems installation disks and LiveCDs are typically available as .ISO images. The format is also popular for peer-to-peer file sharing of pirated commercial software.

On Mac OS X, ISO images often have the .cdr extension.

(Relocated Chunk)

more commonly encountered type of disk image is a CD/DVD image, often in the form of an .ISO file (or sometimes a .BIN/.CUE file), referring to the ISO 9660 file system commonly used on such disks. These provide an exact digital replica of a CD/DVD, whereby all of the data is stored in one file to completely preserve    the data structure and integrity of the CD/DVD. The .ISO format is the most common format for software disk images, but does not support multi-track data or audio CDs. In general, disk imaging is essential for retaining copy-protection data and multi-track data/audio on CD/DVD.

IMG

.IMG is the filename extension usually used for the disk image of floppy disks, optical media and hard disks. A .IMG file contains a raw dump of the content of a disk. First popularized by the DOS-based programs HD-Copy (for hard drives) and DiskDupe (for floppy disks) and now utilized by GNU RaWrite2, RawWrite for Windows, and WinRawrite, the .IMG format is a handy way to archive a floppy disk completely, including bootable ones.

The .img extension was also used by the Macintosh application ShrinkWrap by Aladdin Systems (now Allume Systems), for Mac OS 9 and older, however this Macintosh format is not compatible with the .IMG format used on Windows and it stores metadata in the resource fork. .IMG files are frequently used on Mac OS X to store images of optical disks.

Some newer software supports a zipped version of the format, such as WinImage's .IMZ.

.BIN/.CUE

Main article: Cue sheet (computing)

The .BIN/.CUE image file format was developed by Jeff Arnold for the CDRWIN program. An image consists of two files which contain binary data and metadata, respectively. The filenames typically match (e.g. image.bin and image.cue).

The .BIN file contains an exact copy of all data stored on an optical disc in raw, unprocessed form but without any subchannel data. For this reason, some programs use the .RAW suffix for these files. The file contains all data stored on the original disk - not only its files and folders, but also system-specific information such as boot loaders, volume attributes, error correction codes and other metadata on the disk itself. Of the 2352 bytes in each CD sector, only 2048 contain user data; the additional 304 bytes per sector primarily contain error correction information. Other formats, such as .ISO, do not store all this (mostly redundant) information, resulting in a smaller file. The .BIN format is useful for exotic disks, such as those containing multiple tracks or mixed track types (e.g audio & data), and for non-PC CDs (e.g. PSX, Video CD, Mac).

The .CUE file is a "cue sheet" that describes the data stored in the .BIN file. The .CUE file is a plain text file. A typical .CUE file is as follows:

FILE "IMAGE.BIN" BINARY
  TRACK 01 MODE1/2352
  INDEX 01 00:00:00

The file would be saved as IMAGE.CUE to match the file name prefix of IMAGE.BIN.

Images in the .BIN/.CUE format can be either burned on a disk using software which supports the format directly, or split into individual track files (in .ISO, .WAV format) using software like BinChunker (bchunk). The track files can then be written on a disk or used as-is.

Apple disk image

Main article: .dmg

For Macintosh computers, disk images have been available as a feature of the operating system since before System 7. Mounting a compatible disk image is achieved by double-clicking (opening) the image file. The archived volume is then available as a normal disk volume, indistinguishable at first glance from a physical volume. Modern Apple disk images for Mac OS X typically end in .DMG. Using NetBoot, client computers can start up over a network from a server-based disk image that contains system software. The default handler for disk images in Mac OS X is DiskImageMounter. Images may be created with Disk Utility in Mac OS X and with Disk Copy in older versions of the Mac OS. Mac OS X natively supports .dmg, .toast, Windows .img .mds images if renamed .iso, along with historical Mac OS disk image formats. Furthermore Disk Utility can produce .iso files. They will be named .cdr, but they can be renamed .iso and opened on other platforms.[1]

Windows Imaging Format

Main article: Windows Imaging Format

Other Imaging Formats

Other hard disk image formats include VMware .vmdk, Microsoft .vhd, VirtualBox .vdi, Symantec .v2i, Acronis .tib and the Advanced Forensic Format .aff.

See also

• Archive formats
• Boot image
• Bootloader
• Disk cloning
• Disk image emulator
• ISO image
• Loop device
• Mini Image
• ROM image
• List of optical disc authoring software

References

"Disk Imaging: A Vital Step in Data Recovery"- This white paper describes disk-level issues that must be handled by any disk imaging tool intended for data recovery.

FreeDOS.org floppy disk imaging knowledge base- resource for image formats and utilities on multiple operating systems