Editing Disk image (section)

==Uses==
===Digital forensics===
Forensic imaging is the process of creating a bit-by-bit copy of the data on the drive, including files, metadata, volume information, filesystems and their structure.<ref name=":3" /> Often, these images are also [[Cryptographic hash|hashed]] to verify their integrity and that they have not been altered since being created. Unlike disk imaging for other purposes, digital forensic applications take a bit-by-bit copy to ensure forensic soundness. The purposes of imaging the disk is to not only discover evidence preserved in digital information but also to examine the drive to gather clues of how the crime was committed.

===Virtualization===
Creating a virtual disk image of optical media or a [[hard disk drive]] is typically done to make the content available to [[Virtualization|one or more virtual machines]]. [[Virtual machine]]s emulate a CD/DVD drive by reading an [[ISO image]]. This can also be faster than reading from the physical optical medium.<ref>{{cite web |url=http://www.pcguide.com/ref/cd/perfAccess-c.html |title=pcguide.com - Access Time |archive-url=https://web.archive.org/web/20190110014217/http://www.pcguide.com/ref/cd/perfAccess-c.html |archive-date=10 January 2019 |url-status=dead}}</ref> Further, there are less issues with wear and tear. A [[hard disk drive]] or [[solid-state drive]] in a [[virtual machine]] is implemented as a disk image (i.e. either the [[VHD (file format)|VHD]] format used by Microsoft's [[Hyper-V]], the [[VDI (file format)|VDI]] format used by [[Oracle Corporation]]'s [[VirtualBox]], the [[VMDK]] format used for [[VMware]] virtual machines, or the [[QCOW]] format used by [[QEMU]]). Virtual hard disk images tend to be stored as either a collection of files (where each one is typically 2GB in size), or as a single file. Virtual machines treat the image set as a physical drive.

=== Rapid deployment of systems ===
Educational institutions and businesses can often need to buy or replace computer systems in large numbers. Disk imaging is commonly used to rapidly deploy the same configuration across workstations.<ref name=":7" /> Disk imaging software is used to create an image of a completely-configured system (such an image is sometimes called a golden image).<ref>{{Cite journal |last=Bowling |first=Jeramiah |date=2011-01-01 |title=Clonezilla: build, clone, repeat |url=https://dl.acm.org/doi/10.5555/1924401.1924407 |journal=Linux Journal |volume=2011 |issue=201 |pages=6:6 |issn=1075-3583}}</ref><ref>{{cite web |title=Create a golden image in Azure |url=https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image |website=learn.microsoft.com}}</ref> This image is then written to a computer's hard disk (which is sometimes described as restoring an image).<ref name=":9">{{Cite journal |last1=Shiau |first1=Steven J. H. |last2=Huang |first2=Yu-Chiang |last3=Tsai |first3=Yu-Chin |last4=Sun |first4=Chen-Kai |last5=Yen |first5=Ching-Hsuan |last6=Huang |first6=Chi-Yo |date=2021 |title=A BitTorrent Mechanism-Based Solution for Massive System Deployment |journal=IEEE Access |volume=9 |pages=21043–21058 |doi=10.1109/ACCESS.2021.3052525 |bibcode=2021IEEEA...921043S |s2cid=231851821 |issn=2169-3536|doi-access=free }}</ref> 

==== Network-based image deployment ====
Image restoration can be done using network-based image deployment. This method uses a [[Preboot Execution Environment|PXE]] server to boot an operating system over a computer network that contains the necessary components to image or restore storage media in a computer.<ref name=":8">{{Cite journal |last1=Shiau |first1=Steven J. H. |last2=Sun |first2=Chen-Kai |last3=Tsai |first3=Yu-Chin |last4=Juang |first4=Jer-Nan |last5=Huang |first5=Chi-Yo |date=2018 |title=The Design and Implementation of a Novel Open Source Massive Deployment System |journal=Applied Sciences |language=en |volume=8 |issue=6 |pages=965 |doi=10.3390/app8060965 |issn=2076-3417 |doi-access=free}}</ref> This is usually used in conjunction with a [[Dynamic Host Configuration Protocol|DHCP]] server to automate the configuration of network parameters including IP addresses. [[Multicast]]ing, [[Broadcasting (networking)|broadcasting]] or [[unicast]]ing tend to be used to restore an image to many computers simultaneously.<ref name=":8" /><ref name=":9" /> These approaches do not work well if one or more computers experience packet loss.<ref name=":9" /> As a result, some imaging solutions use the [[BitTorrent]] protocol to overcome this problem.

Network-based image deployment reduces the need to maintain and update individual systems manually. Imaging is also easier than automated setup methods because an administrator does not need to have knowledge of the prior configuration to copy it.<ref name=":9" /> 

===Backup strategy===
{{See also-text|[[System image]]|[[Backup and Restore]] (for Windows Vista and later)}}
A disk image contains all files and data (i.e., [[file attribute]]s and the [[file fragmentation]] state). For this reason, it is also used for backing up [[optical media]] ([[CD]]s and [[DVD]]s, etc.), and allows the exact and efficient recovery after [[Sandbox (software development)|experimenting]] with modifications to a system or [[virtual machine]]. Typically, disk imaging can be used to quickly restore an entire system to an operational state after a disaster.<ref>{{Cite web |title=Fast, Scalable Disk Imaging with Frisbee |url=https://www.cs.utah.edu/flux/papers/frisbee-usenix03/frisbee-www.html |access-date=2023-01-12 |website=www.cs.utah.edu}}</ref>

===Digital preservation===
Libraries and museums are typically required to archive and digitally preserve information without altering it in any manner.<ref name=":4" /><ref name=":6">{{Cite journal |last1=Durno |first1=John |last2=Trofimchuk |first2=Jerry |date=2015-01-21 |title=Digital forensics on a shoestring: a case study from the University of Victoria |url=https://journal.code4lib.org/articles/10279 |journal=The Code4Lib Journal |issue=27 |issn=1940-5758}}</ref> [[Emulator]]s frequently use disk images to emulate floppy disks that have been preserved. This is usually simpler to program than accessing a real floppy drive (particularly if the disks are in a format not supported by the host operating system), and allows a large library of software to be managed. Emulation also allows existing disk images to be put into a usable form even though the data contained in the image is no longer readable without emulation.<ref name=":10" />