Norton Ghost and the MBR

I have a new computer running XP Home but unfortunately I do not appear to have access to the recovery console in the event of a problem with the MBR as I only have a rescue disk from the supplier, windows came pre-installed.

I have Norton System Works Pro 2004 installed and I have been imaging the C: drive on a regular basis with Ghost, does Ghost copy the MBR as part of the image?.

If I restore an image in the event of a problem with the MBR will it also restore the MBR as it was when the image was recorded?.

many thanks for any help

 

Christer's right. If you make an image of your drive, it makes an exact image. This would include the MBR. In fact, though I've never used Ghost I have used Drive Image and when you opt to restore an image it prompts you telling you that it has to first format the drive before restoring the image. If the drive get's formatted that would mean that the MBR would be gone. Therefore, the image has to contain it or you'd have major headaches. I don't know if you get the same prompt in Ghost but you can bet the same type of thing is happening. Without the MBR, it wouldn't be an exact image of the drive.

 

Sorry, Zander, but Drive Image (8.0, at least ... I can't be sure about earlier versions) does not format the drive on restoration, nor does the warning say that it will. Instead, it says "All data on the destination will be overwritten" (emphasis mine).

I had to restore my C: drive just yesterday because of a BSOD caused by an error in the MBR, and I can assure you that 1) no formatting took place and 2) the MBR was overwritten.

 

Off topic: Hey Jim, did you change your email address? I emailed you from my Outlook Express address book and it bounced. Email me at martinr(delete-this-part)@tds.net if you want me to have your address.

Martin

edit note: changed the email address so you don't get harvested and blasted with spam. Newt

 

I did, and I have. . It's correct in my profile on the BBS, but I'm not going to publish it here. One of the reasons I changed it was because of the tremendous increase in the amount of spam I was getting. With the change, absolutely none so far after a month, knock wood.

 

Well, I still have DI 5. Never saw any reason to upgrade. It does what I need it to do. Either way, I would be willing to bet the drive gets formatted. Let's say you create an image of a drive that contains a new windows installation. At the time the image is created the drive contains 2gb of used space. After a while you decide you want to start again with a new windows so you restore the image file of the new installation. However over time the used space on the drive has grown to 3gb. If the drive isn't formatted at the time the image is restored but things are simply overwritten, the drive should still contain 1gb of files that weren't there originally. No???

After thinking about this a bit I suppose it could simply delete the files but it would seem to me that formatting would be the better way to go.

As to the prompt I got when using it, I don't know the exact message but it said something to the effect that the partition would need to be formatted and that all data would be lost. It's been a long time since I've used it to restore an image so I can't really tell the exact message. Also, in response to Christer's question, I don't really remember if it was a quick or full format. I still use it to make images but I don't remember the last time I had to restore an image. It's been a long time. Probably since I first installed XP and restored an XP image just to see if I could get it to work with XP (over two years ago). Maybe I'll haveto dig out the old puter in the closet and do some experimenting and make sure my memory isn't just playing tricks on me. It seems to do that more and more each year.

 

Question: If you overwrite all of the files, is that not the same as formatting? Accomplish the same objective?

After all, the overwritten files are not there anymore. (except to maybe the FBI)

In Zander's example/question, won't that drive be reduced to 2gigs if DI8 restores it to the original image? If so, how does that differ from formating? If not, can the extra gig be accessed? Won't the MFT be changed and not know about the extra gig?

Martin

 

Yes but what happens to the extra 1gb that was on the drive before the image is restored. If it isn't somehow deleted, it would still be on the drive if all the image program did was overwrite things because in my example the image is only 2gb. Therefore, you have to get rid of the extra gb of data somehow. Formatting the drive would do that very well.

 

Maybe both Christer. I haven't looked at specifics in several years but at one time (and fairly recently) the surface test was done by writing a zero to a location, reading that location to see if it read zero, writing a one to the same location, reading the location to see if it read one, writing zero once again and reading it then moving on if all was well. The assumption being that if a drive location did this properly it was good.

 

Trying to summarize.

An image is binary data, written as a data stream without regard to contents or file system; a file system is present in the image. For example, make an image of a fat32 disk, format it as ntfs, write image back onto disk and it is now fat32! Write starts at sector 0 = mbr and proceeds to end of image. Thus, no format is necessary.

It's still there, but since the fat/mft is copied along with the original contents of the disk, those areas are shown in the table as they were when the image was made. If they were empty, they are now empty, although they may contain data which is now "garbage ".

 

Not sure. Hopefully each bit location would be tested.