question about 2nd hand hard drives

Discussion in 'Computer Support' started by ahevans, Oct 1, 2005.

  1. ahevans

    ahevans Guest

    hi

    if i had a 2nd hand hard drive, installed windows xp, office and put
    all my files on it, then used norton ghost to backup the drive and put
    all the data on a fresh drive, would there be any chance that someone
    could recover old deleted files from the new drive that were deleted on
    the old drive?

    any ideas?
     
    ahevans, Oct 1, 2005
    #1
    1. Advertisements

  2. ahevans

    old jon Guest

    Ghost does an Exact copy (image). Personally I wouldn`t risk it.
    bw..OJ
     
    old jon, Oct 1, 2005
    #2
    1. Advertisements

  3. ahevans

    Trax Guest

    wrote:

    |>hi
    |>
    |>if i had a 2nd hand hard drive, installed windows xp, office and put
    |>all my files on it, then used norton ghost to backup the drive and put
    |>all the data on a fresh drive, would there be any chance that someone
    |>could recover old deleted files from the new drive that were deleted on
    |>the old drive?

    It is a sector copier (image'r). You might want to defrag your drive
    before using it (to fill in the deleted entries).
     
    Trax, Oct 1, 2005
    #3
  4. ahevans

    chad Guest

    Although Norton does an exact copy of the available files, it does not
    normally do an exact copy of the drive. That is, it does not copy
    deleted files or arrange the files in the same way. Where the old drive
    might be heavily fragmented, the new image will not be. The new images
    is not "forensically accurate" as deleted files are not copied over.
    "Normally, Ghost does not create an exact duplicate of a disk.
    Instead, Ghost recreates the partition information as needed and
    copies
    the contents of the files. Creating a copy rather than an exact
    duplicate reduces the time it takes to copy a disk and reduces the
    amount
    of disk space required."

    Regards,

    Chad
    http://free-backup.info
     
    chad, Oct 1, 2005
    #4
  5. Howdy!

    Depends on a) which Ghost options you used, b) the size of the file,
    c) the format (NTFS vis FATxx), and d) what they were looking for.

    By doing an "Image All" (-ia IIRC, but check the switches - I use
    this so rarely, I have to check every time) you get the "blank" sectors
    also, and it's very possible to recover deleted files. By default, however,
    Ghost only copies used sectors, so those "unused" sectors the deleted files
    were in aren't copied.

    If, however, the drive is formatted NTFS AND the actual file size is
    under (Allocation Unit - Directory Entry size) then there's a good chance
    the file is still in the MFT ... and easily recovered. Unless Ghost
    compresses the MFT while copying - which it might, I've never had to check
    that B)

    RwP
     
    Ralph Wade Phillips, Oct 1, 2005
    #5
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.