4.2. Create a Drive Image

Stellar Remote Forensic Imaging lets users make copies of both external and internal drives from a remote system onto their computer. This section provides a step-by-step guide to assist you in creating a disk image. Before delving into the process of creating a drive image using Stellar Remote Forensic Imaging, it's important to grasp the concept of what a drive image is and why it's valuable.

What is the Drive image?

Every computer has both internal and externally connected hard drives.  A drive image is an exact copy of all the data stored on a computer's hard drive or storage device. This includes the operating system, system settings, installed programs, files, and folders. Essentially, a drive image replicates the entire contents and structure of a storage device, preserving it in a single file.

What is it used for?

Drive images are commonly used for backup and disaster recovery purposes. By creating a drive image, users can restore their entire system to a previous state in case of data loss, system corruption, or hardware failure. This process ensures that all software configurations, system preferences, and user data are retained, allowing for quick and comprehensive restoration of the system to a known working state. In addition to backup and recovery, drive images are also used for system deployment and migration.

Let us now take a look at creating a drive image of the drives on the remote system on your local system using Stellar Remote Forensic Imaging.

Follow the steps to create a Drive Image

1. Launch Stellar Remote Forensic Imaging on your local system.

2. Connect your local system to the target remote system.
   
   

3. Once the systems are connected, navigate to the side panel and select "Imaging Drive."
   
   

4. A window opens on the screen showing all the internal and external hard drives connected to the remote system along with their respective storage sizes. Select the drive you want to create an image of on your system.

Note: If you previously stopped any image creation process, an alert will appear, informing you that the image was previously created. You will have the option to either merge the image with the previously created one or start a new image from scratch. Click Merge to start image creation from the last saved point. Click New to create a new image from the beginning.

5. Click and an "Image Settings" window will appear on your screen.

6. Customise the settings as required. To get an in-depth overview of the customisation. Refer to the Customise image setting. Once the settings are customised, click .

Note: If you have already created an image of the selected drive, an Overwrite File prompt will appear on the screen asking you whether you want to overwrite the previous file or save a new copy.

7. A Transferring Image window will appear on the screen, displaying the following details:

• Time Remaining: The time left for the drive image to be created.

• Time Lapse: The time passed since the process was initiated.

• Transfer Speed: The mb/sec speed at which the image is being created. 

Note: The speed will vary depending on the stability of the internet and VPN connection.

9. If you wish to stop the image creation process click . The drive image will be saved on your local system till the last sector that has been copied.

10. Once the process is completed. a prompt will appear on the screen to confirm the Image creation. Click  to exit the process.

Note: Ensure that your local system has enough space to store the copied image file from the Remote System.