Under Drive operation/Imaging options/Image file you can specify which imaging method should be applied as standard to every new image. In most cases, the default option Used sector is recommended.
Used sector imaging
Using this imaging method will limit the imaging process to only used sectors on a drive. This method will let you save time, computer performance, and disk space. Used sector imaging is set in the program by default.
Image of the changes
If you only want to save changes made since the last imaging, select Image of the changes as method under Imaging options. This will allow you to create an image that saves only those changes that have occurred since the last base image.
While creating an image of the changes, O&O DiskImage compares each sector of the existing image with the corresponding sector of the disk(source)being imaged. This might require more time than a complete image. An image of the changes, however, takes up much less space than a complete image.
If you want to create an image of the changes, you must have created at least one complete image of each drive that can then serve as a base image. Afterwards, the image of the changes you've created can also serve as a new base image.
The option Use checksums to administer unchanged data is always set by default. The last incremental/differential image created is enough to serve as the base image when creating an Image of the changes. If Use checksums to administer unchanged data is not set, you will need the last base image and all existing incremental images because these must be accessed as part of the imaging process.
Forensic imaging
This imaging method is especially useful when creating images of non-supported file systems or when, for example, you would like to recover deleted data from a source drive using special data recovery software. With this method, an exact sector-level copy of the source drive is made. By saving all sectors of a partition or drive, the unoccupied and deleted portions of file systems can be imaged in their entirety.
Direct forensic
Please note that direct forensic imaging of an active operating system is only possible if our snapshot driver is installed. It will otherwise not be possible to create a consistent image.
Direct forensic imaging is a special case. The difference, however, lies in data being read over deep system interfaces. As with regular forensic imaging, a complete copy of a source drive will be created. This makes it possible to, among other things, image an encrypted hard disk using encryption software.
Please note that direct forensic imaging is intended for imaging encrypted disks using encrypted data. This data remains encrypted even after the image is restored. If the source drive being used is an encrypted drive, only sector-based restoration is possible. The file-based restoration or browsing of such an image is not possible. In addition, spanned volumes (stripped/spanned) are also excluded from this, since the logical link here between the regions is taken over by the operating system. Direct forensic imaging makes no sense if the drives are not encrypted. Here we recommend forensic imaging because all sectors of the drive, including the sectors marked as free, will be included in the image.