What is a disk image?

A disk image is a single file that holds a complete copy of a volume: not just the documents you can see, but the file system's own bookkeeping and the empty space around them. Apple's Disk Utility guide describes a disk image plainly as a file that contains other files and folders, and notes that you can create one that includes the data and free space on a physical disk or connected device. That completeness is the whole point. A copy of your files is a copy of what you selected. An image is a copy of the volume itself, and that difference matters in two places: getting data off a failing drive, and backing a computer up.^[1]

What an image captures that a file copy does not

When you copy files to an external drive, you duplicate the items you selected and nothing else. A disk image works differently. Made in one pass, it records the volume from end to end, including the hidden structures that say where each file begins and ends, and the space that currently holds nothing. Those parts never show up in a folder window, which is why a copied folder can look complete while holding less than an image of the same volume.^[1]

An image is also an ordinary file, which is what makes it useful. It can be copied, moved to another drive, or put in storage like any other file. Modern systems can open one directly: Apple's guide notes that once Disk Utility saves a disk image, it mounts the image's disk icon on the desktop and in the Finder sidebar, and the worked examples in the GNU ddrescue manual mount a rescued image read-only and copy files out of it. Mounted like that, the image behaves like the disk it came from.^[1][2]

Why recovery starts with an image

When a drive is failing, every read is a request to hardware that may not answer twice. The standard move, in recovery labs and careful do-it-yourself work alike, is to make an image first and then run every recovery attempt against the copy, so the fragile original is read as few times as possible. The GNU ddrescue manual, written for exactly this kind of work, states it as a rule: make a copy of the failing drive, then try to repair the copy, and keep the first copy as a master if the data really matters, so a failed repair leaves the master intact to try again.^[2]

The same manual explains the urgency behind that rule. A failing drive tends to develop more and more errors as time passes, and every time a physically damaged drive powers up and manages to output data, it may be the very last time it ever will. Recovery software works on an image the same way it works on the drive itself, so the scan that finds your files can run against the copy, hours or days later, without troubling the original again.^[2]

How data recovery software works: what a scan can and cannot find

Images as backups

The backup question is about what you get back. Restoring an image puts a volume back the way it was: Apple's guide to restoring a disk image to a disk describes the destination as erased and then becoming the exact copy. Restoring a file backup brings back files; Apple says a Time Machine backup can restore any or all of your files to the same Mac or a different Mac. An image returns a whole computer's setup in one step. A file backup returns your data. Which one fits depends on what you are protecting against, and most plans use both.^[3][4]

It is worth knowing what the built-in tools on each platform actually make, because neither is a disk image. Microsoft's Windows Backup app backs up by folder: you toggle Desktop, Documents, Pictures, Videos, and Music on, and backing up those folders syncs them to your OneDrive account. Files come back by signing in to OneDrive with the same Microsoft account used for the backup, with app pins and settings restored along the way. Apple's Time Machine backs up your files, including apps, music, photos, email, and documents, capturing only what changed since the previous backup and keeping hourly versions for the past 24 hours, daily for the past month and weekly before that, with the oldest deleted when the disk fills. Both are file and version backups rather than disk images.^[5][3]

The 3-2-1 backup rule: copies, media, and offsite

The formats you will meet

Most people meet images long before they meet recovery. An ISO file, the image format of optical discs, is how operating system installers and large software downloads ship, so anyone who has downloaded one has already used an image. Recovery work adds raw image files, usually named .img or .dd, which are nothing more than a drive's contents written straight into a single file, in order, with no packaging around them. Tools can also convert images between formats: Apple's Disk Utility guide has separate pages for creating, converting, resizing, and restoring disk images.^[6][2]

The catch: space and time

An image is only as easy as its destination. A raw image needs somewhere healthy that is at least as large as the source: Apple's restore guide requires each destination partition to be at least as large as the corresponding partition in the image, and a copy tool writing to a device or partition overwrites whatever is already there. That is a real constraint when the drive being imaged is large and the spare space is small.^[4][2]

Time is the other cost. Reading a whole volume means reading all of it, and on a failing drive the slow parts are in exactly the wrong places. The ddrescue manual notes that the good parts are usually recovered fast while the rest may take a long time, and that a difficult rescue may take days to complete. The same manual warns that a straightforward sequential copy can wear a failing drive out without rescuing anything if the errors sit near the beginning, which is why imaging tools read carefully rather than quickly. A rescue that can take days is not a job to improvise, and when the data matters more than the drive, this is the point where a lab earns its fee.^[2]

Related reading

What a clean room is for in data recovery

How to choose a data recovery service

Not sure what to do next? Answer a few questions and get a suggested first step