The Mystery of Disk imaging

Hi all,

I'm really interested on your opinions on the following. Suppose you burn a boot CD from a disk imaging tool and boot the system with it. IN the bootenvironment of your imaging programm you create an image of the system partition to an external harddrive. In case it should be relevant what Os is on the dormant Systempartition lets say win7/NTFS Filesystem.

Is under these cirumstances a difference between any of the imaging programs in terms of quality and realibility of the image? I'm NOT speaking about features of the imaging program like that you can encrypt your backup or that the size of the imagefile might vary because of different packing procedures etc. Just the quality of the sector-by-sector captured image.

I mean the difference between the programs is mainly how they do a hot-backup when the Systempartition is running. Some use VSS some use VSS with some additional scripts or have an own routine...

But when you take this factor out and do a cold image is there any difference to be seen between the quality of the images?

Does anyone here have some intel on this, what the differences could be? And it would be really interesting if there is a way to test the quality of finished images. This is probably difficult since that is mainly what the imaging program does reading and writing what has been read. So it's a little paradox a program to test the quality of images would kinda be an imaging program itself in Order to test.

Greetings to you All!!

 

The main difference would be works vs. doesn't work. If the boot media boots up correctly and creates the backup and boots up correctly and restores the backup successfully and the system boots up normally, then it works.

You can always use Linux and do a straight 'dd' copy of a drive. What imaging programs do is try to make it easy and much safer for the user. From there it becomes features, options, personal preference, etc.

 

A main difference would be the different file systems they each support if you don't want to do a full sector-by-sector backup.

 

Ah interesting point. So you mean since i start from Boot CD the imaging program is my operating system so it needs to have its own way of handling the harddisks.

But lets say i create a Winpe Disk with imaging tool on it. Than WinPE would take care about the NTFS format and the imaging tool would get the data ready and delivered by the driver for NTFS (is it actually a driver?) from Winpe or?

And why would it be different if i do a sector-by-sector backup?

Does this mean that there is no such thing as an "ntfs-driver" and the imaging tool does have to know how to read the MFT in order to know which sectors to leave out (since they are empty)?

Are there some comon libraries that every imaging program uses or does every company that is writing an imaging tool has create there own code for reading and writing from/to disk?

 

I would consider "file system support" a feature. Image quality does not depend on file system support.

The imaging program is not the operating system. The OS is usually Windows, WinPE, Linux, or DOS. The imaging program then runs in that OS.

 

Indeed, "file system support" only helps with managing the contents (files/folders) so you can skip unnecessary files. As for backing up empty sectors, compression should solve that.

Correct me if I'm wrong, but incremental backups and the like aren't supported though.

 

Yes. As I have understood it, when you create a "normal" sector image (not a sector-by-sector image), the image program uses information about the file systems to "simplify" (make more efficient) the process. If the program doesn´t recognize a specific partition file system, errors may arise.

When you create a "sector-by-sector" image, including all sectors, used or not, information about the file systems is neither required nor used.

 

Hi just stopping by again - sorry was a little bit busy,

I assume not everyone agress here with each other a 100%....

No serious, what i got out of this thread right now is the Imaging program always runs under the OS.

So if i put in my WinRE disk with lets say Image for windows included. Then IFW runs under WinPE.Then there is not much to do for IFW, it just gets the data from WinPE and what else should it do - Microsoft even invented that format.

 

I'm not sure what you mean.

 

Hi Brian,

MudCrab wrote that filesystem support is not a must have for an imager and that the imaging program always runs under an OS.

What i'm trying to accomplish here is to get a better understanding of what the role/importance of the imaging program is in the process of making the image.

I know this sounds weird, but given the 2 facts in the beginning of my post it sounds like there will be literally no differences between imagers because:

1. imaging programs runs always under OS
2. OS (in example of WinPE) is even from the inventor of ntfs himself so will manage sectors/files in a superb way

Since imaging program gets data from OS how could there then possibly be any difference in quality of images then. Its like if you fill the same orange juice in different packages its still the same orange juice.

But some post here sound like that there is still is a difference and that is what i don't understand.

Hope i explained o.k. enough what i meant..

 

Depends. If you want to back up VMWare data stores on VMFS, built-in OS support is not a given. Are we strictly speaking of consumer products? The original question didn't specify.

 

The original question was:

Sector-by-sector images are raw images and there isn't any real difference between apps doing raw images IF they work correctly on your system. Any decent programmer can write a raw imaging program in a short period of time.

File system support is a feature. Most support the common file systems. Unsupported file systems should be imaged raw and shouldn't affect image quality.

Outside the question, features, stability, and support more often determine why one chooses one over another.

 

First of all, those aren't facts.

1. Not all imaging programs always runs under OS, especially outside of Windows.
2. WinPE is far from the only LiveCD there is, plus its usually an issue of driver support rather than filesystem.

 

Interesting discussion here!

@MudCrab(or someone else): could you explain me the definition of raw image? Tried to goole it only found something about pictures, that in this field its a picture that is as least as possible changed by the camera. You said that a raw image is one that is sector-by-sector, but are there more points?

@MarcP: Yes i'm speaking more of consumer products like TIH, IFW, Shadowprotect... My interest lays more in direction of Win7, WinPE Recovery Environment, ntfs filesystem...

That brings me more to the 2 questions im really dying to know: What for - in detail - does the imaging program need filesystem support? Is ist:
a) To omit files that usually don't need to backed up, like Hiberfil.sys etc.?
b) To omit unused Sectors within a partition
c) To omit unallocated space (Sectors that don't belong to any partition)

and 2. What is this with the driver support, does anyone know more about this?

Warm greetings to all of ya!

 

Since I brought up driver support, it's basically what device drivers are included within the LiveCD. WinPE has the best support for obvious reasons, most manufacturers make their hardware for at least Windows.

Linux LiveCD may have trouble supporting RAID, SSD, and other exotic hardware configurations. But even the latest WinPE may not support specific hardware, because they only include generic drivers by default.

You can add drivers to LiveCD and WinPE manually, although the disk imaging program may have added more already. They're basically no different than an OS, except running completely on RAM and/or read-only media.

 

Hi J L,

I thought you meant with "an issue of driver support rather than filesystem" more that the quality of the image dependet on it in some kinda way.

But you just meant that the Boot Cd's off different products (obviously) differentiate in driver support?

 

No, drivers are just necessary to even detect the hardware. As long as it's not buggy, quality shouldn't be affected.

Yes, it depends on how they build their LiveCD or WinPE, and which distro (if not independant), Linux kernel version, and WinPE version they used.

 

O.K. thanks J L thought i missed something - but now Q2 is cleared - no smoking gun there.

 

File system support is necessary to access the data on the partition in a "more than just data" method. For example, the difference between reading a dictionary character by character or actually understanding how to use it. It's not necessary for imaging programs to have full support for a file system to back it up -- just enough to get what they need. The program may know enough to back up "File system XYZ" but not enough to let you save an image to a partition using that format.

Yes, the file system must be used to determine the free sectors in the partition, sectors used by files to back up or exclude, etc.

Unallocated space is not part of any partition and does not have a file system.

A raw image is when you take all the sectors used by a partition (or drive) and just copy them out. It doesn't matter what file system is on the partition or if it's wiped, garbage, or just unused. An example, would be if the file system on a partition has been corrupted and you want to make a backup before trying recovery software. A raw backup will get all the sectors allowing you to restore and try a different recovery method.

 

Hi Mudcrab, your answer really helped me to understand this a LOT better. Thank you! Thx to the other too. Great Forum here.

So let's check if i got it right:

On my laptop have several Partitions one of them is a truecrypt encryptet Partition, Then at the end of the disk is 50 GiG of unallocated space

If i now do an Image of the full disk, i assume (correct me if wrong):

a) TC partition will be backed up in total, since imaging program will not recognize filesystem, so raw image
b) The unallocated space will be backed up sector-by-sector since the imaging program was told to backup entire disk and it doesn't recognize Filesystem either

Greetings!

 

a)yes
b)no since imaging program knows unallocated space is not part of any partition(by reading partition table data which is independent of filesystem).

many imaging softwares by default leave unallocated space while doing sector-by-sector backup but also includes an option to enable it.

 

Could someone confirm or reject this for IFW?

 

IFW won't include unused sectors for recognized file systems (unrecognized file systems would be backed up raw) unless you select the Backup Unused Sectors option.

When backing up an entire drive that same option controls whether or not unused sectors are included.

 

@Whitestar: thank you for clarifying that...

@MudCrab: you answer, was a little cryptic to me because i didn't know if unallocated space is a "recognized file system" or not. But i take this as a confirmation thx too..

 

Unallocated space is not a partition and has no file system. I think you're confusing unallocated space with free (unused) space on a partition. They're not the same thing.

IFW recognizes FAT, FAT32, NTFS, Ext2/3/4, ReiserFS, and HSF+. Other file systems would be backed up raw. Also, if any of the recognized types are found, but the contents are seen encrypted they would be backed up raw.