±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35657
New Yesterday: 3 Visitors: 157

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Recovering "Ghosted-over" system

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

vrocco
Member
 

Recovering "Ghosted-over" system

Post Posted: Jun 23, 06 18:50

If I have a system that was not wiped and just ghosted over top of can data be recovered from the original system?

Thanks in advance!  
 
  

debaser_
Senior Member
 

Re: Recovering "Ghosted-over" system

Post Posted: Jun 23, 06 21:20

As long as all of the data was not overwritten i would assume so. How much of it is the question. If you have a 200 gig drive and an image thats like 20gigs uncompressed i would think you have a good shot of getting something.  
 
  

vrocco
Member
 

Re: Recovering "Ghosted-over" system

Post Posted: Jun 23, 06 21:47

Sorry, to clarify, if the uncompressed ghost image is the exact size of the drive.

Does this constitute over writing a drive in a way that can't be recovered?  
 
  

zon4jou
Member
 

Re: Recovering "Ghosted-over" system

Post Posted: Jun 23, 06 22:19

Alltough i'm not totally sure, i would think so. It sounds like a bitwise image of the drive and thus overwriting all the sectors when it's placed back on the drive. But then, the target drive must be exact the same size (as in heads, sectors and tracks) as the drive it's imaged from.  
 
  

debaser_
Senior Member
 

Re: Recovering "Ghosted-over" system

Post Posted: Jun 23, 06 23:02

- vrocco
Sorry, to clarify, if the uncompressed ghost image is the exact size of the drive.

Does this constitute over writing a drive in a way that can't be recovered?


Yea you may be SOL for the most part.  
 
  

Unforgiven
Newbie
 

Re: Recovering "Ghosted-over" system

Post Posted: Jun 24, 06 01:22

Anything that you did get would be from UA and void of date and times stamps. (if such things are important to your case) But most main stream image restoring tools will only right the data from the image to the drive. Speed an convenience are the issues at hand with those type of tools, so I doubt that it wiped the remaining sectors and it certainly could not of filled up the drive entirely, so I’m sure it’s worth a look. But as indicated by others, there is probably not allot to be hopeful for with this one.  
 
  

steve862
Senior Member
 

Re: Recovering "Ghosted-over" system

Post Posted: Jun 26, 06 15:08

Hi,

It does depend on the type of imaging software used. Tools like Norton Ghost will have copied the unallocated space from the original PC to your suspect machine so anything in unallocated space had been written there as part of the bit copy. Other programs might only be a file copy rather than bit by bit copier and so might leave the evidence in the unallocated space still.

Steve
_________________
Forensic Computer Examiner, London, UK 
 

Page 1 of 1