Disk imaging strategies

The choice of the processing mode to use depends on the condition of the source (whatever the source happens to be).

There are three basic categories as far as the source is concerned,

  1. Perfect, a hard drive which is known to have no bad blocks, or a disk image stored in a known-good location.
  2. Damaged but stable, a hard drive which has some bad blocks, but does not degrade further with use.
  3. Unstable, a hard drive which noticeably deteriorates over time.

These three cases may be difficult to distinguish between. This is where your experience comes in.

Imaging software employs one of the several strategies to achieve maximum performance.

First of all, the naive strategy is to image everything front-to-back. If the source is not mechanically damaged, this strategy gives the fastest possible result. Large block size and no seeks yield the theoretically best speed on any type of media. Bad sectors make things complicated. When we request a large block, and a bad sector happens to be inside the large block, the entire read operation fails and we do not know where exactly the bad sector is. To pinpoint the exact location of the bad sector, the block size must be equal to the sector size. In theory, one can read the entire drive sector-by-sector, but this is awfully slow and not a practical option. Therefore, we still try to read large blocks. Once the read fails, there are two options: either retry the failed area sector-by-sector immediately (single-pass strategy), or put it off and retry later (multipass strategy). Each of these has its advantages and disadvantages.

  • single-pass strategy allows on-the-fly hashing at the cost of decreasing amount of data acquired by any given time.
  • multi-pass strategy maximizes the amount of data acquired by the given time at a cost of losing on-the-fly hashing.

There are other variations, including filesystem-aware imaging, which tries to acquire the areas used by files first based on the results of partial or complete filesystem reconstruction. Filesystem-aware imaging uses technologies similar to what is used in full-scale data recovery with all the uncertainty involved. It works reliably with undamaged filesystems, but results become less predictable as damage gets worse. Klennet imager only uses full-disk strategies.