How to create an image of a drive in UFS Explorer
Disk images are commonly used for data recovery and backup purposes. Not only they accelerate the process of data retrieval, but also help to minimize the risk that the original device will break down before it is completed. Supplemented with an advanced disk imager, UFS Explorer makes it possible to create such an image directly in the program, without the need for a third-party utility, and then employ it instead of conducting operations on the physical digital medium.
When a storage does not function normally due to hardware defects or other issues, the process of disk imaging may require additional configurations in order to reduce the potential for the total failure of the unstable device before the valuable data is extracted. The disk imager integrated into UFS Explorer provides an extensive set of parameters aimed at maximally efficient data reading and control over I/0 errors. To adjust the procedure in accordance with your particular case, you can modify the available settings as per the instructions given below. In addition, a brief overview of the course of action can be found in the following video guide:
Other peculiarities of work with damaged digital media are described in detail in How to recover data from a defective disk and are recommended to be taken into consideration before the start of the imaging process.
General disk-imaging procedure
-
Launch UFS Explorer and get the disk imaging tool embedded into the software.
Find the problem disk/partition in the list of attached storages and select the "Save disk image" or "Save image of this storage" option in its context menu. Read the warning note carefully before proceeding to the next step.
Hint: If you need to attach an internal hard drive from another computer, you can plug the disk into the motherboard of your PC or сonnect the drive externally using a USB to SATA/IDE adapter using the given instructions.
-
Specify the parameters related to the source storage.
-
Source range
This parameter defines which part of the source storage will be imaged. "Entire storage: full bit-to-bit disk image file" is the default choice for creating an image of the entire disk – it allows saving everything’s possible from the first to the last block of the physical storage.
The "Custom range: image file of partition or region" option is enabled automatically when an image of a disk partition is created. In this case, the values for the start and the end sectors are filled in by the software itself. Alternatively, a range of blocks for imaging can be specified manually.
The "Specific sets of sector ranges to include/exclude from the image" option makes it possible to specify a set of ranges for creating a disk image.
It allows defining which ranges will be saved and which of them will be excluded from the image. The option is useful for reading several known ranges one more time, or when a certain partition or some other data should not be present in the image.
The "Specified with external bitmap" option cannot be selected manually but is activated automatically when an image on the basis of a block map is created, which includes an instruction for each block as to whether it needs to be read.
-
-
Provide settings related to the target storage.
-
Save to image file in format
This parameter offers several storage options for saving the image file.
"Plain disk image file" is the default option for disk imaging.
In this case, a plain image file is created, without metadata, with a size that exactly matches the size of the area from which the image is created. Data about defects gets stored in the mandatory defect map file within the disk image.
The "Custom sparse disk image file" option allows performing on-demand disk imaging.
This type should be chosen when one needs an image of just a part of the data, especially if it is scattered across the source storage (an image of the file system metadata/data, an image on the basis of a map, and so on). The state of reading is a part of a sparse file and does not require a separate map.
The "Available (connected) sparse file" option enables on-demand disk imaging to a connected sparse image file and is activated automatically when an image is created for a disk that is already being read in the "on-demand imaging"/"one-time read" mode and has a connected active sparse file.
The "Encase Image File Format" option allows saving a disk image file in the *.E01 format used by the Encase professional forensic software.
The "Microsoft VHDX virtual disk" option makes it possible to create a *.vhdx virtual drive that can be mounted in Windows.
-
Save to physical drive (make clone to)
When this option is chosen, data is simply copied from the source disk to another storage, while the information about reading errors is saved to a defects map file.
However, the target disk must be no smaller than the selected area to be imaged on the source disk. For instance, if the source disk is 3 TB in size, the target storage for saving its full image must be at least 3 TB. If a 1 TB partition from a 3 TB storage is being imaged, the minimum size of the storage should be 1 TB.
-
Use sector size for imaging
This parameter defines the size of the minimum block for reading.
As modern disks usually have a physical sector size of 4 KB, the software chooses this size by default. The value cannot be changed for disks that have a physical sector size of 4 KB according to the disk identification data. For other disks the values of 4 KB or 512 bytes can be selected.
When it comes to a defective sector, using the 512 bytes value for a disk with the 4 KB sector size will lead to repeated attempts to read the same bad block. Selecting 4 KB for a disk with the 512 bytes sector size may result in skipping extra sectors adjacent to the defective one.
For disks whose sector size is not a multiple of 512 bytes (for example, 520 bytes), the software doesn’t allow changing this value whereas the disk image will be created with a rounded block size (for example, 512 bytes on the image for 520 bytes on the source).
-
-
Define the principal settings for data reading.
-
Read block size
This parameter sets the size of the data block that will be read "in one go".
The block size from 64 to 128 KB makes it possible to achieve maximum performance as it is large enough for efficient linear data reading but is not too large so that it should not "catch" defects. Besides, a very large size may not be supported on some connections in ATA/SCSI modes.
-
Read direction
This option allows choosing the direction in which the storage reading will be performed.
The "From start to end" option is chosen by default and provides the maximum speed. The second option is recommended only when the defect is observed closer to the beginning of the disk to prevent its rotational damage. In this case, the program will still read the data in the "forward" direction but will do that in blocks of several megabytes, starting from the end of the disk.
-
Read using protocol
This parameter sets the procedure which will be employed for access to the storage. The "System procedure" is available for all operating systems. The main disadvantage of the standard system procedure for reading data is the absence of control over reading errors that may result in "hanging" of the software and/or USB adapter in case of defective blocks or series of defects. Using this approach may lead to further degradation of the failing storage device.
The "Direct SCSI" procedure is available in the Windows and Linux editions for all Linux-based storage media and Windows-based storage devices, except PATA/SATA with a direct connection. The procedure of this type allows performing a controlled disk readout with the diagnostics of reading errors, though such a diagnostics may not be available on many USB adapters.
The "Direct ATA" procedure is available in the Windows edition of the software for PATA/SATA disks. Like the previous option, it allows performing controlled disk reading with advanced diagnostics.
-
Read timeout
This parameter allows setting time in seconds to wait for the data from the disk until the attempt to read the sector will not be interrupted.
This value is critical for disks that have defective or poorly readable sectors. One should consider that a small timeout accelerates the process but may lead to the omission of poorly readable sectors while a large timeout may cause the rotational scoring of defects.
-
Number of read retries
This is the number of repeated reading attempts that will be performed on a single block that causes a read error until it is considered to be "defective". A value of 1-2 can lead to skipping of extra blocks that are poorly read, whereas large values can lead to the rotational scoring of defects.
-
Offset (LBA) on target
If the target storage is larger than the source one (a larger disk, a larger existing image, and so on), it is possible to define an offset on the target storage in the range from zero to the difference of the storage sizes, for instance, to overwrite a certain partition on the target storage.
-
Defects map location
This parameter defines the path for a file to which the defective blocks will be mapped out. In addition to the header, the file has a simple map, where each byte sets the status of 4 blocks (512 Bytes or 4 KB, depending on the settings for the size of the block for reading).
-
Log file
This configuration allows choosing the location for an optional log file. Such a file will contain events like reading errors, jumps, etc. and can be used for diagnostics.
-
-
Configure the two-pass imaging algorithm for the processing of reading errors.
-
Skip number of sectors … after number of consecutive bad sectors
When the option is enabled, having encountered a defective block the software checks the number of consecutive defects. If this number is greater than or equals to the specified number, a jump is performed on the given number of blocks and the reading is performed from that location. If the readout is successful, the status gets reset and the normal mode gets resumed.
-
If the next read also fails then skip number of sectors
If the readout from the new location failed, the jump is performed again. When this option is enabled, the size of the second jump will equal to the specified number of blocks. Otherwise, its size will be the same as that of the first jump.
-
Keep skipping number of sectors until reading succeeds
If the reading is not normal after the second jump, the third jump is performed again on the size which equals to the specified number of blocks if this option is active, or coincides with the size of the second jump. The jumps of the given size are performed until normal reading resumes.
-
-
If necessary, establish a check of the storage’s ability to respond to commands after a read error.
-
Enable "safe zone" test after read error
When this feature is enabled, the software will check whether the disk is readable by performing test read requests to the specified block, which the user believes is guaranteed to be readable. This can be block 0, if the rotational scoring occurred somewhere in the file system metadata area, or a sector near the end of the disk, if the defect occurred near its starting blocks.
-
Creating disk images from other disk images
The software offers a special mode for creating disk images from other disk images and files of various formats. This mode has a simplified procedure without defect handling. This mode can be used to save a sub-image, convert formats or write data from the disk image to a physical disk.
Disk images from special sources
When imaging is run on a supported special storage from which the image is created (for example, when a disk is connected via DeepSpar DDI), a special dialog opens for managing the imaging process on an "external" tool instead of the standard procedure for creating images.
This procedure allows configuring and launching the process of imaging performed by an external tool while the process and its result will be displayed in the software.
Last update: April 04, 2022