Ghost - wrong imaging drive

[jerovsek]

Hello,

client call me, that imaging drive in wrong direction with norton Ghost. Insted to copy full disk to empty, he imaging empty to full.
What are the best steps to perform. Any suggestion

[michael chiklis]

Data lost for ever, unless he interrupted it right away.
Has the client noticed the error immediately or only after cloning ended?

[jerovsek]

Hello,

I have ony information, which I already post.
I will receive drive late today.

[lcoughey]

As the default settings for Ghost is to do a file partition and file system copy, the copy in the wrong direction likely only took a minute or two to complete. If so, that means that the data is likely still there and should be easily found with a full scan with a program like R-Studio. If they tagged Ghost to do a full sector-by-sector clone and let it run its full course, the data is likely gone forever.

[michael chiklis]

If client stopped the cloning operation at the begin, you can get data back (where sectors were not over written).
You can use Photorec or Winhex to do a file carving, but if he noticed wrong cloning direction only at the end, it's game over.

P.S.
Remember to the owner to not use the drive anymore if he wants data recovery (of course if cloning was interrupeted at the begin).
Data must be carved and then saved on a second drive, do not write anything on the drive where are his data.
Bye.

[michael chiklis]

I never used R-studio, but you can try it.
R-studio should recover also folders by repairing MFT information (if MFT isn't totally destroyed by wrong cloning).
File carving is only for recover files, not folders structure (winhex can find also folders if MFT wasn't destroyed).

[michael chiklis]

I read just now your PM, client did a complete cloning so it's game over.
Sorry for him

[michael chiklis]

As the default settings for Ghost is to do a file partition and file system copy, the copy in the wrong direction likely only took a minute or two to complete. If so, that means that the data is likely still there and should be easily found with a full scan with a program like R-Studio.

Can you ask to client if he remember that the cloning ended after few minutes or few hours?
If ony one or two minutes, then maybe can still recover data as lcoughey said.

[jerovsek]

Dear Mr. Chiklis and Mr. lcoughey,

thank you for your replays.
I will ask him, when he will bring me the drive.
I will also post the result.