O&O DiskImage offers two different types of imaging; complete imaging and imaging of the changes. Any image, regardless of the type, can be created either file-based or forensically.
A file-based complete image, such as one for partition D, contains all data found on the partition. The size of the image corresponds approximately to the used space plus the space needed for metadata. Sector-based imaging is enabled by default and is fully adequate for most user scenarios.
The size of a forensic image of a partition corresponds to the size of the disk, regardless of how the current space is allocated. All clusters of the disk will be backed up according to their current status. You can enable forensic imaging if you experience data loss and need the exact status of that disk in order to recover data, but still have to use the system. In cases like this, we recommend using the O&O DiskImage bootable disk. Doing so helps prevent O&O DiskImage from overwriting the lost data. Further information about this can be found under Create bootable disk
An image of the changes requires either a complete image or another image of the changes as a starting point. A check will be made to see if any data has been added, removed, or changed. These changes will then be saved in the new image. This type of imaging is especially useful for saving space. The image will be the size of the changed data plus any metadata.
For security reasons, we recommend a limit of five to ten images of the changes for every complete image. For optimal protection, create one complete image and then five images of the changes. After that, you can create a new complete image that can be used as the base for another five to ten images of the changes.