Recovery methodsTechnical

What a Disk Image Preserves — and What It Does Not

What sector-level disk images preserve, what unreadable regions and device metadata mean, and why an image is not automatically a complete copy of a failing drive.

What a sector image normally preserves

A raw sector image can preserve partition structures, file-system metadata, allocated and unallocated sectors, deleted-file remnants and other content visible through the device’s logical block interface at acquisition time.

Unreadable sectors remain unknown

If a region cannot be read, the image cannot contain its original contents. Good acquisition workflows keep a map that distinguishes successfully read areas from failed or not-yet-attempted regions.

Device internals are a different layer

A normal image does not capture every firmware structure, SMART log, HDD service-area record, SSD flash translation table or raw NAND page simply because those structures exist inside the device. Some are not exposed through ordinary logical reads.

Snapshots and live systems add another issue

An image of a changing source may not represent one perfectly consistent point in time unless the source is quiesced or a suitable snapshot mechanism is used. This matters for databases, virtual machines and active storage systems.

Practical rule

For a damaged source, keep the acquisition map and logs with the image. “Image created successfully” is less useful than knowing which address ranges were read and which remain uncertain.