If I have a system that was not wiped and just ghosted over top of can data be recovered from the original system?
Thanks in advance!
Sorry, to clarify, if the uncompressed ghost image is the exact size of the drive.
Does this constitute over writing a drive in a way that can't be recovered?
Alltough i'm not totally sure, i would think so. It sounds like a bitwise image of the drive and thus overwriting all the sectors when it's placed back on the drive. But then, the target drive must be exact the same size (as in heads, sectors and tracks) as the drive it's imaged from.
Anything that you did get would be from UA and void of date and times stamps. (if such things are important to your case) But most main stream image restoring tools will only right the data from the image to the drive. Speed an convenience are the issues at hand with those type of tools, so I doubt that it wiped the remaining sectors and it certainly could not of filled up the drive entirely, so I’m sure it’s worth a look. But as indicated by others, there is probably not allot to be hopeful for with this one.
Hi,
It does depend on the type of imaging software used. Tools like Norton Ghost will have copied the unallocated space from the original PC to your suspect machine so anything in unallocated space had been written there as part of the bit copy. Other programs might only be a file copy rather than bit by bit copier and so might leave the evidence in the unallocated space still.
Steve