What is disk image file

Disk image is a file storing a full copy of a disk. It should be noted that an image file stores the full content of a disk, including the filesystem structure. In other words, the disk image is a usual disk having no the physical body. People working in computer repair business often deal with disk image files since it is much safer to create a disk images and work with them than to worry about client’s data operating with the real disks. More than that, physically damaged hard disks have to be imaged without fail.

Disk image vs disk clone

Apart from disk image files, there are disk clones. Let’s discuss what is the difference between these. The disk image is an exact copy of the disk stored as a file, while a disk clone is an exact copy of the disk stored on another hard disk. In practice, disk clones are faster while disk images are easier to store. In any case, everyone decides for himself what to choose to operate with – clones or images. Disk clones and images can be converted at any time into each other, except for some exotic image formats.

With the advent of the Advanced Format (4 KB sector) disks, the sector size must be taken into account. Clones must be created on disks with matching sector size. Disk images may or may not store sector size, depending on the image format. One needs to keep track of it when imaging Advanced Format disks.

There are two ways to create disk image files – using software or using hardware. Hardware imagers are designed to work with severely damaged hard disks and are considered reliable equipment, but the price you need to pay for such imager is very expensive – about several thousands of dollars. Software disk imagers can image healthy or slightly damaged disks.

Software disk image formats

Software imagers can create three common types of image files – sector-by-sector (also known as raw disk image file), VHD disk image file, and VHDX disk image file.

Raw disk image file is the most common format. The disadvantage of this format is that the image is not compressed; that’s why the file will be exactly the same size as the original storage. Further, it is possible to compress a file, for example, by means of NTFS, but such compression is not supported by all filesystems. Raw disk images are usually used in data recovery since almost all data recovery software support this format. Raw image does not store the sector size of the original disk.

VHD and VHDX formats are used to store image files in Windows. Windows uses these formats to store its backups and virtual machines in Windows Server. Additionally, in some cases you can boot an operating system from a VHD image file. VHD format is used for the disks up to 2 TB; VHDX format – for the disks larger than 2 TB. Both of these do store original sector size.

In addition, different tools use their own formats to store disk images – VMWare uses VMDK format, EnCase uses E01 format, R-TT tools use their own RDR, and so on. These formats differ in capabilities, for example, some formats support compression and/or digital data signature. To reduce the size of image, some formats do not store data which do not belong to any file. Such disk images cannot be used in data recovery but are used for backup, say in Acronis products.

Software disk imagers and different controllers

There are many free software for creating disk image files. Many data recovery tools have a free option to create a disk image. Data recovery tools, however, do not allow converting disk images back to disks because developers assume that after a client created an image, he or she should work only with this image.

To write an image to a disk you can use different variants of Linux dd, which exist for Windows as well, or special software, like Clonezilla.

As mentioned above, software disk imagers cannot be used for severely damaged disks; however, if there are even one or two bad sectors on a disk, the success of creating an image with software is highly dependent on the controller to which a disk is connected. Widely-used USB-to-SATA adapters often hang up when encounter a bad sector. The same is true for SATA controllers from Marvell, which are used in motherboards, usually in order to get more ports than the standard Intel ICH controller has. Based on our experience, Intel ICH controller is the best one to work with bad sectors. It often happens, that a disk, which cannot be imaged using Marvell, can be imaged with ICH, with just a minimal slowdown.

The result is a trick, which you can try if you have the situation when NAS cannot do a rebuild since it hangs up because one more NAS member disk fails or there is a bad sector. Since Marvell controllers are commonly used in NASes, the solution often is to take out a disk with bad sectors, connect it to the Intel ICH, clone the disk to another one, and insert the disk clone back to the NAS. In this case, NAS successfully completes a rebuild losing data of one or several sectors that is usually quite acceptable.


Elena Pakhomova

Co-founder at ReclaiMe
Elena is one of the founders of ReclaiMe Data Recovery Company, she has been involved in the data recovery field since 2009. While not recovering data, she provides online data recovery courses aimed at data recovery technicians both at the beginners and the experts

Latest posts by Elena Pakhomova (see all)