Wednesday, September 11, 2019

hard drive - Recovering deleted files from a ghost image


Let’s suppose that we have ghost image file taken from an old hard disk and we want to burn it to a new empty hard disk. The question is: does the ghost image reflect exactly the original hard disk bitmap? so when we use a recovery solution to deal with deleted files it will be exactly as if we are dealing with the original hard disk? so we may recover deleted files which were in the original hard disk?


NOTE:
It is important to suppose that the new hard disk where the ghost image is burned to was totally wiped before burning process.


Answer



It depends on how the image was created. If we're talking specifically about Norton Ghost, here is the quote from the KB article:



Normally, Ghost does not create an exact duplicate of a disk. Instead,
Ghost recreates the partition information as needed and copies the
contents of the files. Creating a copy rather than an exact duplicate
reduces the time it takes to copy a disk and reduces the amount of
disk space required.


Ghost uses specific switches to create more exact duplicates of the
original disk. To copy the entire disk, including the entire boot
track, all sectors, and unpartitioned space, and to prevent Ghost from
filtering extraneous or erroneous information from the boot track, run
Ghost with the -IR switch.



This also will be affected by the Ghost version, because at the end of 2003, Symantec acquired PowerQuest and Ghost 9 and higher use PowerQuest file format. So, as niceman already said, best way to know is to try.


No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...