Join Us!

Notifications
Clear all

Recovering "Ghosted-over" system  

  RSS
vrocco
(@vrocco)
Junior Member

If I have a system that was not wiped and just ghosted over top of can data be recovered from the original system?

Thanks in advance!

Quote
Posted : 23/06/2006 7:50 pm
debaser_
(@debaser_)
Active Member

As long as all of the data was not overwritten i would assume so. How much of it is the question. If you have a 200 gig drive and an image thats like 20gigs uncompressed i would think you have a good shot of getting something.

ReplyQuote
Posted : 23/06/2006 10:20 pm
vrocco
(@vrocco)
Junior Member

Sorry, to clarify, if the uncompressed ghost image is the exact size of the drive.

Does this constitute over writing a drive in a way that can't be recovered?

ReplyQuote
Posted : 23/06/2006 10:47 pm
zon4jou
(@zon4jou)
New Member

Alltough i'm not totally sure, i would think so. It sounds like a bitwise image of the drive and thus overwriting all the sectors when it's placed back on the drive. But then, the target drive must be exact the same size (as in heads, sectors and tracks) as the drive it's imaged from.

ReplyQuote
Posted : 23/06/2006 11:19 pm
debaser_
(@debaser_)
Active Member

Sorry, to clarify, if the uncompressed ghost image is the exact size of the drive.

Does this constitute over writing a drive in a way that can't be recovered?

Yea you may be SOL for the most part.

ReplyQuote
Posted : 24/06/2006 12:02 am
Unforgiven
(@unforgiven)
New Member

Anything that you did get would be from UA and void of date and times stamps. (if such things are important to your case) But most main stream image restoring tools will only right the data from the image to the drive. Speed an convenience are the issues at hand with those type of tools, so I doubt that it wiped the remaining sectors and it certainly could not of filled up the drive entirely, so I’m sure it’s worth a look. But as indicated by others, there is probably not allot to be hopeful for with this one.

ReplyQuote
Posted : 24/06/2006 2:22 am
steve862
(@steve862)
Active Member

Hi,

It does depend on the type of imaging software used. Tools like Norton Ghost will have copied the unallocated space from the original PC to your suspect machine so anything in unallocated space had been written there as part of the bit copy. Other programs might only be a file copy rather than bit by bit copier and so might leave the evidence in the unallocated space still.

Steve

ReplyQuote
Posted : 26/06/2006 4:08 pm
Share: