Differential/incremental imaging
As a base image you can use either a “complete” image, using the methods “Used sector imaging”, “Forensic imaging” or “Direct forensic imaging”, or by using a previously created incremental image/differential image.
Follow the instructions below:
- Please make sure that the drive containing the base image is connected to your computer.
- Start O&O DiskImage and select Drive imaging on the start page.
- Enable the check for Incremental imaging.
- Select your base image in the browser window and click Open.
- Now click Apply (if you want to specify further settings) or on OK to proceed with the imaging.
- Click on Start drive imaging.
- Now you can either select the recommended target folder for saving the image, or enter a new target path. For the sake of clarity, we recommend to store the base image and its subsequent images in one folder. The image is automatically named after the creation date. You can however enter a name manually.
- Click on Start, to initiate the imaging process.
Note: O&O DiskImage compares each sector of the existing image with the corresponding sector of the imaged (source) disk while creating an image of the changes. This might take up some more time than a complete image. However, the image of the changes takes up much less space than a complete image.
Note: the option Compare data with checksums is set as default. While creating incremental images, it is sufficient to use the last incremental image as base image. Should Use checksums to administer unchanged data not be set, you will need the last base image and all the incremental images previously created, since all of them will be accessed for creating the new image.