copydiskimage

What is difference between disk imaging and copy?


In digital forensics, analyst do disk imaging to collect information before analysis. Then why they don't use 'copy'? What is difference between disk imaging and copy?


Solution

  • So this is more of a language question than a programming question. A disk image is a computer file that represents the contents of a physical volume (usually). So when analysts create a disk image they are, in fact, copying data from the disk to a file.

    So to creating a disk image is probably a type of copying, but they could also copy individual files. Copying could be seen as a technique, where a disk image could be seen as a type of file that is a copy of a physical drive.