Jump to content

Cannot create a good disk image from a.gho file


Multibooter

Recommended Posts

I created an image of a HDD, in an external enclosure, with Ghost v11.0.2.1573 under WinXP SP2, then:

- wiped the HDD

- restored the .gho image onto the same HDD

- inserted the restored HDD back into the original computer

BUT:

1) System Commander v9.04 on the restored HDD comes up and detects a new operating system (i.e. the boot code is not what it was originally). Regardless of what I select, Save or Bypass, System Commander eventually stops loading any operating system at all and displays a cryptic err msg "Error Boot 2>" or similar. This may be caused by System Commander detecting a changed partition table. I had not changed an obscure default setting in System Commander, effective for WinNT thru 2003 [not for Vista], "Automatic Win Boot Repair" enabled, instead of disabling it. In any case, System Commander does not work with a HDD restored from a .gho file. System Commander is my preferred boot manager, and I have been using it for about 14 years.

2) When I checked the restored HDD with Partition Table Doctor v3.5 under Win98 it didn't find anything wrong. But PartitionMagic v8.01 displayed 10x [maybe because of 8 logical partitions + 1 extended partitions + unallocated space??] the err msg: "Error 114 on the partition starting at sector xxxx. The EPBR is not positioned at the beginning of a cyclinder. If this is not corrected the operating system could cause data loss. PowerQuest Partion Magic can easily fix this problem by moving the EPBR to sector yyyy." If I don't let PartitionMagic fix this, the HDD is displayed as "BAD" by PartitionMagic. If I fix it, I get 10 msgs: "Success. The partition table error was successfully fixed!".

3) Furthermore, FAT32 partitions, originally having 2k clusters, now had 4k clusters. Also, an NTFS partition, originally in NTFS 3.00 format [Win2k], now had NTFS 3.01 format (WinXP]

The original HDD was partitioned in an external enlosure with PartitonMagic v8.01, before WinXP was installed onto it on H:. The cluster sizes were set automatically by PartitionMagic. This is the partition layout:

C: BOOT_FAT16 FAT 2.047.3 Active Primary 32k

D: BLANK1 FAT32 2.047.3 Logical 2k

E: BLANK2 FAT32 2.047.3 Logical 2k

F: DIAG_FAT32 FAT32 8.189.4 Logical 4k

G: 98_FAT32 FAT32 12.284.0 Logical 8k

H: XP_FAT32 FAT32 30.710.2 Logical 16k

I: SWAP_FAT32 FAT32 15.359.0 Logical 8k

J: DATA_FAT32 FAT32 40.946.9 Logical 32k

K: DATA_NTFS NTFS [v3.0] 30.710.2 Logical Default=4k

Unallocated [for Linux etc] 50.124.7

I had created and restored the .gho image under WinXP SP2 via a desktop shortcut with the following target:

H:\Ghost\ghost32.exe -z9 -ib -szee -fatlimit -fdsp -align=chs -fmbr

Why can Ghost not create a useful image? Did I miss any parameters?

I did not use the sector-by-sector forensic -id option because creating and restoring an image in this "forensic" way may take 24 hours, with unknown results.

Is there other software which actually can clone from a file a HDD containing tricky boot code by System Commander, and which doesn't alter important partition characteristics?

Link to comment
Share on other sites


Have you tried -

-clone,mode=create,src=n,dst=x:\backup.gho

src is the source disk#, dst is the path/name of the cloned disk image

This is what Ghostcast is automatically inserting, so... And as I remember, restoring to a different size HDD worked (not sure if it handles smaller).

This assumes you're not backing up a "running system" and not backing a disk onto itself (naturally). My understanding is that only Ghost System Suite can back up a "running system". Look into the docs on the "clone+mode" switches to see if this works better. (?Checked and I believe your version is GSSv2.0?)

Kind of confused as to the errors (don't use the other software mentioned)...

HTH

Edited by submix8c
Link to comment
Share on other sites

I had created and restored the .gho image under WinXP SP2 via a desktop shortcut with the following target:

H:\Ghost\ghost32.exe -z9 -ib -szee -fatlimit -fdsp -align=chs -fmbr

Why can Ghost not create a useful image? Did I miss any parameters?

I did not use the sector-by-sector forensic -id option because creating and restoring an image in this "forensic" way may take 24 hours, with unknown results.

And that's where things went wrong... But even "-id" is simply not enough, if you want to be 100% sure. If you already knew System Commander creates unusual structures, you should have used "-z9 -ir" for, in the raw mode ghost makes no assumptions whatsoever and copies everything sector-by-sector. This is as guaranteed to work, when you put it back, as it can get. Then again, in this case, there would be no point in wiping the disk because, as you put the image back, all the trash (such as the contents of file slack and non-partition unused areas) will get back in, too. You can't both have your cake and eat it, you know.
Link to comment
Share on other sites

-clone,mode=create,src=n,dst=x:\backup.gho

src is the source disk#, dst is the path/name of the cloned disk image.

Hi submix8c,

Thanks for your suggestion, I'll try it out tomorrow, I am stuck right now emptying a 750GB PATA drive for further experimentation with the image restores. I currently don't have any other empty PATA HDD for testing the image restore, only empty SATA drives :angry: Yes, I am not backing up a running system, but have removed the HDD and put it into a USB enclosure, to be cloned/restored on a 2nd computer.

(?Checked and I believe your version is GSSv2.0?)
Yes, kind of, it consists of a set of files from the live update to v11.0.2.1573 of an older legal version. Works under Win98 and WinXP from a single set of files, no installation. Under WinXP this set of files had cloned fine another HDD (of an Asus Eee with a special non-MS partition type), but under Win98 there were issues cloning the Asus HDD, that's why I cloned the System Commander HDD under WinXP.
Kind of confused as to the errors ( don't use the other software mentioned)
These errors are mainly relevant in a multi-booting environment. When I put the badly cloned HDD in a USB enclosure and ran Checkdisk under WinXP, WinXP found everything Ok. But WinXP Checkdisk does NOT check whether the HDD layout is compatible with other operating systems.

My main operating system is Win98SE. I use 2 programs under Win98SE to check whether a HDD has a clean layout, compatible with Win98:

- PowerQuest PartitionMagic v.8.01, which is the ultimate tool for checking Win98 compatibility (it has a 192GB FAT32 partition size limit, which I am also respecting, mainly because Xrayer also uses 192GB partitions)

- Partition Table Doctor v3.5, which can fix errors reported by PartitionMagic, but which PartitionMagic cannot fix (e.g. disk geometry errors)

2 years ago I had installed Vista on my desktop, onto a primary partition on the 2nd HDD, keeping the layout of the 1st HDD (a primary FAT16 partition + several logical partitions for Win98, XP etc). I removed Vista again because PowerQuest PartitionMagic v8.01 and Partition Table Doctor v3.5 were not able to handle the Vista partition type. Eventually I'll try to install Vista and Win7 again, but this time into LOGICAL FAT32 partitions on the 1st HDD. There is a good chance that System Commander, R.I.P., will be able to do it.

Link to comment
Share on other sites

But even "-id" is simply not enough, if you want to be 100% sure. If you already knew System Commander creates unusual structures, you should have used "-z9 -ir" for, in the raw mode ghost makes no assumptions whatsoever and copies everything sector-by-sector. This is as guaranteed to work, when you put it back, as it can get.
Hi dencorso, I did read the docu of the Ghost "-ir" switch (p.476) before starting my imaging/restoring attempts:

"The image raw switch copies the entire disk, ignoring the partition table. This is useful when a disk does not contain a partition table in the standard PC format, or you do not want partitions to be realigned to track boundaries on the destination disk. Some operating systems may not be able to access unaligned partitions."

I guess I was wrong in interpreting this to mean that the original partition table does not get copied (I assumed "ignoring" means "except"). This might apply to UDF-formatted HDDs, which contain no partition table.

My System Commander HDD probably contains a "partition table in standard PC format", whatever that means. If I:

- create with Partition Table Doctor 3.5 a "Backup partition table'" file on a floppy of a System Commander HDD

- then remove the System Commander HDD from the 1st computer

- insert the System Command HDD in an USB enclosure of a 2nd PC

- in that 2nd PC, under Win98, Clear the System Commander HDD with Acronis Disk Director + reboot (i.e. the whole HDD is unallocated now)

- power up the 2nd PC and restore the "Backup partition table" from the floppy with Partition Table Doctor 3.5

RESULT: The System Commander HDD with the restored "Backup partition table" works fine again, so it should probably have a "partition table in standard PC format".

Are you sure that Ghost with "-ir" copies the partition table via sector-by-sector copying of the entire disk, and that the partition table is not skipped?

Is it possible to image/restore the 1st primary partition (=boot partition) sector-by-sector, and the remaining partitions in the normal way? With a single image file for the whole disk, in one step?

Then again, in this case, there would be no point in wiping the disk because, as you put the image back, all the trash (such as the contents of file slack and non-partition unused areas) will get back in, too. You can't both have your cake and eat it
Is there some reliable software which can wipe unneeded leftovers, before creating an image with Ghost? This would at least keep the size of the resulting compressed archive file smaller. Edited by Multibooter
Link to comment
Share on other sites

If I may, the whole problem is about "assumptions".

  • Partition Magic "assumes" that certain limits/boundaries/settings are "wrong"
  • Ghost "assumes" that a given filesystem "needs" to have a given cluster size
  • System Commander probably "assumes" something yet different.
  • XP formatting/partitioning utilities have different "assumptions"
  • Vista/Win 7 formatting/partitioning utilities have different "assumptions"

(and though inaccessible at this time, due to boot-land problems, there is a recent thread where we are trying to understand, at least partly, some of these assumptions)

You won't be able to install Vista/Win 7 directly on FAT32, AFAIK:

Wiping unused space is a possibility:

http://www.cezeo.com/products/disk-redactor/

http://eraser.heidi.ie/announcements/20091215.html

http://sourceforge.net/projects/wipefreespace/

http://www.somacon.com/p336.php

http://www.killdisk.com/

jaclaz

Link to comment
Share on other sites

Hi jaclaz, I am so glad that you joined in.

I have tried out Clonezilla, recommended by net user in his posting #2 at the parallel topic http://www.msfn.org/board/boot-sector-prob...tml#entry902053

Clonezilla clones the System Commander HDD from an image file with much better results than Ghost:

1) PartitionMagic v8.01 does not find anything wrong with the HDD produced by Clonezilla, in contrast to the HDD produced by Ghost

2) Clonezilla reproduced the two FAT32 partitions correctly in the original cluster size (2k), while Ghost changed the cluster size to 4k

3) Clonezilla, like Ghost, changed the partition type from NTFS 3.00 to NTFS 3.01

4) The image file produced by Clonezilla was about 50% smaller than the image file produced by Ghost

Unfortunately, the HDD produced from an image file by Clonezilla, did NOT work either. System Commander still came up with the window "Possible new operating system detected". I guess this window is loaded by a component program of System Commander, CHKMBR.EXE, which "verifies that System Commander's MBR has not been destroyed by a new OS installation and corrects the condition if necessary". So CHKMBR.EXE detected something on the cloned HDD which led it to believe that the "System Commander's MBR", whatever that is, had been destroyed.

When CHKMBR.exe detects "a new operating system", I select "Bypass". The "OS [=operating system] Selection Menu" then comes up, as usual. But when I select the last active operating system (e.g. Windows XP), I get an err msg "NTLDR missing", then "Boot 2> error". Then all files were gone from C:, C: was corrupted with 2 different FATs.

When I select "Save", instead of "Bypass", and then select the newly detected operating system, Windows XP loads Ok. But when I reboot and then select in the "OS Selection Menu" any of the previously existing operating system selections, System Commander goes on its destructive path and damages the boot partition C:, with a similar "Boot B1 error".

The user manual of System Commander v9.04 states (p.289): "The capacity of the MBR is not sufficient to place sophisticated boot programs. This means that the on-boot software uses the entire track 0 of the hard disk in addition to the 0 sector because it's not included in any partition. For example, boot managing utilities such as LILO, GRUB, and VCOM System Commander are located in the 0 track."

I then

- saved the whole track 0 of the original 200GB HDD, inserted in a USB enclosure, with MBRwizard: [mbrwizd /disk=1 /sector=head save=a:\track0.dat /ignore]

- restored the Clonezilla image onto a 750GB HDD

- wiped track 0 of the 750GB HDD [mbrwizd /wipe=head]

- restored track 0 [track0.dat had 32768 bytes] of the original 200GB HDD to the 750GB HDD [mbrwizd /restore=a:\track0.dat /ignore]

BUT: System Commander again detected a new operating system, then the "OS Selection Menu" came up etc, just as without the restored track 0, and then I got the boot error message plus a damaged boot partition C:

The problem might let one think of a sophisticated copy protection scheme, preventing a System Commander HDD from being used on a cloned HDD, but I doubt this was the intention. Also, I don't think that System Commander is reading hardware details from the HDD, since I had the Boot xx error msg also when I restored earlier with Ghost an image back onto the original HDD. In summary: I don't know how to get the various operating system selections to work again on a cloned HDD.

Up to now (except when I installed Vista experimentally on another computer) I have been using ancient System Commander 2000 [v5] and was able to get the opsys selections to work after cloning sector-by-sector from one disk to another [i.e. not from an image file]. The last version 9 of System Commander [i am using here v9.04] claimed to have a "super-hiding feature", to facilitate multitbooting with Vista; could that have something to do with the difficulty to clone/restore a System Commander HDD?

BTW, when I restored the Clonezilla image, 2 msg lines appeared very briefly on the screen, maybe about partitions D and E, it was too fast to write down, something like: "Error, could not create an identical partition... 4294MB... 6410MB")

Which one should I try first, before trying to make a sector-by-sector clone? Should I make a sector-by-sector clone with Ghost using the "-ir"switch? I doubt whether Clonezilla can make a sector-by-sector image: "Clonezilla saves and restores only used blocks in the harddisk." http://www.clonezilla.org/

Edited by Multibooter
Link to comment
Share on other sites

Any of the above should work allright, I would use killdisk as first approach as it has, if I remember correctly, both a Windows and a Dos version. :unsure:

If you think your experience is crazy, read attentively this (still largely UNresolved):

http://www.boot-land.net/forums/index.php?...ic=9897&hl=

I am not sure about the 3.00 and 3.01: one of the othere things that everyone "assumes" is about NTFS versions).

Care to explain how you checked the version?

I don't want to "talk bad" about an application I don't really know/used extensively, but I do remember that many, many years ago I did test System Commander and then discarded it forever as it had "queer" ways.

At the time, it was however VERY powerful, nowadays, we have grub4dos and with all due respect System Commander is - to say the least - outdated. :(

I would try to however besides CLONING (with a separate program or whatever as you did) the first 63 hidden sectors (or more) as, if I recall correctly, System Commander uses them (or part of them) AND "backup/restore" the actual partition Volume ID's AND Disk Signature.

It is also possible that System Commander uses some kind of checksum of either MBR or Partition Tables or bootsectors... or whatever, you would need two fresh installations to compare... :ph34r:

Just for your interest, since a couple of unfortunate "accidents", agian MANY years ago, I DO NOT trust either:

  • Partition Magic (since version 3 that worked allright)
  • Acronis apps (for a number of reasons, including their "habit" to install in windows Filter Drivers)

I also never used (if not very, very old versions) of GHOST.

Heck, we have an entire range of freeware, and among them quite a few OpenSource alternatives:

http://www.msfn.org/board/disk-imaging-sof...99.html&hl=

Why not using them? :whistle:

jaclaz

Edited by jaclaz
Link to comment
Share on other sites

Is there some reliable software which can wipe unneeded leftovers, before creating an image with Ghost? This would at least keep the size of the resulting compressed archive file smaller.

sysinternals sdelete. v.1.5 and later have the "-c" option to zero out the free space (= fill it with zeroes). Zeroed sectors are the best for compression, and you get rid of most of the trash. Only the trash in the file slacks will remain. I still didn't find any app capable of reliably getting rid of that. But cleaning the file slacks is a risky busines, because it can damage useful code or data, if gone wrong.

I suggest you "sdelete -c" each partition first and then ghost the whole disk with "-z9 -ir".

Then again, searching for a reliable freeware capable of doing a blind, full-disk, sector-by-sector copy may be worth it.

Link to comment
Share on other sites

I am not sure about the 3.00 and 3.01: one of the othere things that everyone "assumes" is about NTFS versions). Care to explain how you checked the version?
PartionMagic v8.01 -> right-click on NTFS partition -> Properties -> NTFS Version (displays 3.0 [=3.00] for original HDD, 3.1 [=3.01] for cloned HDD. Paragon Partition Manager 9.0 also displays the NTFS version (same results). Acronis Disk Director v10.0.2089 does not display NTFS version information.
I do remember that many, many years ago I did test System Commander and then discarded it forever as it had "queer" ways. At the time, it was however VERY powerful, nowadays, we have grub4dos and with all due respect System Commander is - to say the least - outdated. :(
System Commander does have a learning curve and there are a few essential tricks for using it. For example, I don't use the suggested way of "preparing a new operating system for installation", but my own way.

After System Commander was set up properly, it kept working invisibly for me, without major problems (except for this deployment/cloning problem). I am using 100+ applications on my computer, many of them replacements of older stuff. I have kept only 3 older applications, in use for about 15 years: InfoSelect v3, with my personal notes of the past 15 years, System Commander and DCF. At this stage I don't want to give up on System Commander; I have purchased over the years 4 different versions starting with v2, as a recognition of its usefulness to me.

Even if you don't use System Commander, the 2 docu .pdf files in it may be useful to you as additional reference material about the quirks of PC operating systems.

I would try to however besides CLONING (with a separate program or whatever as you did) the first 63 hidden sectors (or more) as, if I recall correctly, System Commander uses them (or part of them) AND "backup/restore" the actual partition Volume ID's AND Disk Signature.
MBRwizard http://www.mbrwizard.com/ backs up/restores easily only track 0, any other tool you could suggest for easy backing up/restoring of more tracks? How do I back up/restore the actual partition Volume ID's AND Disk Signature?
It is also possible that System Commander uses some kind of checksum of either MBR or Partition Tables or bootsectors... or whatever, you would need two fresh installations to compare... :ph34r:
I had created with Partition Table Doctor 3.5 a "Partition table backup" of the original System Commander HDD and of the HDD cloned/restored with Ghost, and then made a binary compare of the 2 partition table backup files (10240 bytes each) with Beyond Compare, and there were many differences.
I DO NOT trust either Partition Magic ... Acronis apps ... I also never used ... GHOST.
PartitionMagic 8.01 does give phony error messages. I have 3 partitioning utilities installed (PartitionMagic, Paragon Partition Manager and Acronis Disk Director), because none of them works to my full satisfaction. I would be glad if a single partitioning utility were fully satisfactory. I have just recently used Ghost again, and am a little disappointed with the results here.
we have an entire range of freeware, and among them quite a few OpenSource alternatives:

http://www.msfn.org/board/disk-imaging-sof...99.html&hl=

Why not using them? :whistle:

Which one would you suggest for my next cloning attempt of the System Commander HDD? Edited by Multibooter
Link to comment
Share on other sites

sysinternals sdelete. v.1.5 and later have the "-c" option to zero out the free space (= fill it with zeroes). Zeroed sectors are the best for compression, and you get rid of most of the trash. Only the trash in the file slacks will remain.
Thanks a lot dencorso, Russinovich of 2005 sounds good. I'll clean the original System Commander HDD with pre-Microsoft sdelete v1.51, then I'll create a sector-by-sector image file with Ghost "-z9 -ir", as an over-night job. I was lucky to have used for my experimentation a 200GB HDD, not the 750GB one.

This disk imaging problem makes me question my whole partitioning plan. Maybe, for easy sector-by-sector backup of the System Commander "multiFAT" boot partition C:, I should use a very small HDD with a tiny single 2GB FAT16 C: partition, and a 2nd HDD containing the logical partitions. This 2nd HDD could also contain a primary NTFS partition for Vista/Win7.

Such a 2-HDD-setup should work with an SSD disk in my desktop, and also with my 10-year-old Inspiron 7500 laptops, which can hold up to 3 internal HDDs, and I had recently bought 20 right-bay-modules, to hold a 2nd internal HDD .....

Edited by Multibooter
Link to comment
Share on other sites

MBRwizard http://www.mbrwizard.com/ backs up/restores easily only track 0, any other tool you could suggest for easy backing up/restoring of more tracks? How do I back up/restore the actual partition Volume ID's AND Disk Signature?

Track 0 is actually (normally) first 63 sectors.

A small bug seems to affect MBRWIZ:

http://www.boot-land.net/forums/index.php?...8168&st=143

(most probably completely unrelated - but I won't trust MBRwiz right now)

I personally only use dsfo/dsfi (as I know what they do) and MBRFIX (which as well I have tested extensively).

http://members.ozemail.com.au/~nulifetv/fr...ware/index.html

http://www.sysint.no/nedlasting/mbrfix.htm

Examples of my personal approach (for the reasons explained below):

http://www.boot-land.net/forums/?showtopic=3191

http://www.boot-land.net/forums/index.php?showtopic=5000

http://www.boot-land.net/forums/?showtopic=2362

Which one would you suggest for my next cloning attempt of the System Commander HDD?

The point, as far as I understand, is that you have an "atypical" configuration (please read as System Commander) and you want to do an "atypical" cloning (meaning that you are not doing a "real" cloning, which is a dd-like copy, or if you prefer a "forensic sound" one).

So it is difficult to suggest you an app over the other.

I can share my approach to this kind of things:

  • NEVER, and when I say NEVER I do mean NEVER "trust" anything that Commercial (or Freeware) utilities give as "implied" or do "automagically".
  • use as simple an approach as possible, leave "standard" tools for "standard" chores to people needing "standard" results
  • ALWAYS, and when I say ALWAYS I do mean ALWAYS have a way back or alternate way should "chosen" one fail.
  • use "plain" or however "documented" formats ONLY (and again I mean ONLY)

Usual critics to the above:

  • but it is difficult
  • but I have to learn about a lot of things
  • but it is not one click only
  • but ....

To which the reply is usually:

  • but it is SAFE for your DATA. :)

This said, I would try Odin:

http://www.boot-land.net/forums/index.php?showtopic=5871

http://sourceforge.net/projects/odin-win/

and Partition Saving:

http://www.partition-saving.com/

and Selfimage:

http://selfimage.excelcia.org/

Also, when PROPERLY accompanied with an application taking care of MBR and hidden sectors, DriveImageXML is not that bad (I would have never thought I would have ever written this sentence :ph34r:):

http://www.911cd.net/forums//index.php?showtopic=22563

http://www.911cd.net/forums//index.php?showtopic=22984

http://www.911cd.net/forums//index.php?sho...=23408&st=0

(though I never got around finding the compression used for compressed images)

About NTFS versions:

http://www.msfn.org/board/ntfs-versions-t38439.html

Most probably the version of GHOST you are using "thinks" you should be using XP instead of 2K. :whistle:

Volume ID can be gathered by using DIR or LABEL, and set besides through an HEX editor or dsfo/dsfi or similar dd-like tools, with a nice app from sysinternals, called, strangely enough, VolumeID ;):

http://technet.microsoft.com/en-us/sysinte...s/bb897436.aspx

jaclaz

Link to comment
Share on other sites

The point, as far as I understand, is that you have an "atypical" configuration (please read as System Commander) and you want to do an "atypical" cloning (meaning that you are not doing a "real" cloning, which is a dd-like copy, or if you prefer a "forensic sound" one)
Hi jaclaz,

I was first following dencorso's suggestions and ran sdelete -z on the original System Commander HDD, in preparation for a sector-by-sector cloning with Ghost "-ir". sdelete was very slow, about 0.22GB/min with my 10-year-old 700MHz laptop. I cleaned with sdelete 3 partitions (C: BOOT_FAT16, H: XP_FAT32 and J: DATA_FAT32, altogether 72GB), which took about 5.5 hrs. I then started to create a sector-by-sector image file with Ghost "-ir". The old laptop has been running for the past 12 hrs and will have finished creating the image file in about 2 more hrs. Restoring the image file to the 750GB HDD will probably take another 14 hrs, so please be patient with further feedback.

In the meantime, here some speculations about the "atypical" System Commander HDD:

1) The authors of System Commander called their boot partition the "multiFAT" partition, so possibly the difficulty of cloning a System Commander HDD has something to do with a special FAT created by System Commander on C:, not with the MBR or partitioning

2) This may be confirmed by my experience described in posting #7 here "...Then all files were gone from C:, C: was corrupted with 2 different FATs."

3) System Commander does not detect the installation of a new operating system if the newly-installed operating system is of the same type as a previously installed operating system (e.g. 2 instances of Win98SE, or 2 Win2000s with different service packs). For detecting the installation of the 2nd instance of an operating system you have to boot into DOS, run SCIN.exe -> Special Options -> Alter Current Boot Record Serial Number. Upon removing the boot floppy and rebooting from the HDD, System Commander then comes up with screen "Possible new operating system detected". I have no idea where this "Current Boot Record Serial Number" is stored, I would speculate somewhere related to the "multiFAT" FAT.

The same screen "Possible new operating system detected" comes up after starting a computer with a cloned System Commander HDD.

When Ghost has finished creating the image of the original System Commader HDD, I'll check whether the file-cleaning by sdelete has destroyed something "atypical" on the original System Commander HDD, like this "multiFAT", whatever that is.

Link to comment
Share on other sites

I was first following dencorso's suggestions and ran sdelete -z on the original System Commander HDD, in preparation for a sector-by-sector cloning with Ghost "-ir". sdelete was very slow ...

:blink: No! sdelete -z is really slow and won't help because it overwrites the sectors 3 times with random characters (DOD 5220.22-M standard)! I recommended sdelete -c, which overwrites the sectors with zeroes just once. Not only this is much faster, but it compresses better. Random characters, because of not having any pattern, however, don't. Sorry, I should have stated this more clearly! :blushing: In any case, when in doubt, type just sdelete at the command prompt to see the brief help screen and remember which switch is for zeroing-out. I always do that, just in case, before I begin. For the full documentation see the sysinternals sdelete page.

Later edit: For what's worth, the usual secure deletion methods are:

  • DOD 5220.22-M = overwrite the sectors 3 times with random extended characters, then delete;
  • DOD 5200.28-STD = overwrite the sectors 7 times with random extended characters, then delete;
  • Zero-Out = overwrite the sectors once with only zeroes, then delete.

Link to comment
Share on other sites

@dencorso

To sum up:

Q1. How can I zero out slack space?

A1. By using any of these 5 utilities.

Q2. Well, which one?

A2a. Killdisk

A2b. Sdelete -c

Action taken:

Sdelete -z

With all due respect to Multibooter, I cannot see how you can feel guilty of anything. :w00t:

;)

@Multibooter

The really bad news is that you will need to re-run again the Sdelete with the appropriate switch as random characters won't compress well, if you want to minimize the size of the image/clone.

:whistle:

jaclaz

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...