O&O DiskImage 7 User's Guide - O&O Software

Settings for drive imaging
Image of the changes
If you only want to save changes made since the last imaging, select Image of the changes as method under Imaging
options. This will allow you to create an image that saves only those changes that have occurred since the last base
image.
While creating an image of the changes, O&O DiskImage compares each sector of the existing image with the corresponding
sector of the disk(source)being imaged. This might require more time than a complete image. An image of
the changes, however, takes up much less space than a complete image.
Note: If you want to create an image of the changes, you must have created at least one complete image of each
drive that can then serve as a base image. Afterwards, the image of the changes you've created can also serve as a
new base image.
Note: The option Use checksums to administer unchanged data is always set by default. The last incremental/differential
image created is enough to serve as the base image when creating an Image of the changes. If
Use checksums to administer unchanged data is not set, you will need the last base image and all existing incremental
images because these must be accessed as part of the imaging process.
Forensic imaging
This imaging method is especially useful when creating images of non-supported file systems or when, for example,
you would like to recover deleted data from a source drive using special data recovery software. With this method, an
exact sector-level copy of the source drive is made. By saving all sectors of a partition or drive, the unoccupied and
deleted portions of file systems can be imaged in their entirety.
Direct forensic
Direct forensic imaging is a special case. The difference, however, lies in data being read over deep system interfaces.
As with regular forensic imaging, a complete copy of a source drive will be created. This makes it possible to, among
other things, image an encrypted hard disk using encryption software.
Please note that direct forensic imaging is intended for imaging encrypted disks using encrypted data. This data
remains encrypted even after the image is restored. If the source drive being used is an encrypted drive, only sectorbased
restoration is possible. The file-based restoration or browsing of such an image is not possible. In addition,
spanned volumes (stripped/spanned) are also excluded from this, since the logical link here between the regions is
taken over by the operating system. Direct forensic imaging makes no sense if the drives are not encrypted. Here we
recommend forensic imaging because all sectors of the drive, including the sectors marked as free, will be included in
the image.
Specify the size of an image file
An image can be split into multiple image files. If a disk doesn't have enough space to contain a full image of your
selected drives, you will automatically be requested to enter another target location. It is also possible to manually set
the maximum size of an image file before creating the image. If the image being created is larger than the entered file
size, additional image files will be created.
This function is especially useful when you plan to burn your image onto a CD/DVD at a later time. Sometimes a
CD/DVD is not large enough to contain the entire image file. We recommend your limiting image files to the size of the
blank CD/DVD onto which you will be writing your images.
O&O DiskImage-31