I have been using some disk imaging software (Ghost 8.0) to clone a Windows XP Embedded image.
I noticed that even if I capture a disk image from a computer and then transfer that image back to the same computer, then on the first boot-up Windows will notice that settings have changed, and it will request a reboot.
My question is, if the hard drive has exactly the same data as it had before, how does Windows know that it should reboot? Is there some kind of hardware flag on the hard drive that lets Windows know when sectors have been overwritten?
Also, I'm not sure if this is relevant, but the image that I was transferring had the Enhanced Write Filter enabled. It's my (possibly mistaken) understanding that Windows cannot make a change to its registry that can survive a power cycle with EWF turned on. I would normally expect the answer to my question to be that Windows stores something in its registry that can be compared to something stored on the hard drive, but since I had EWF enabled, I'm not sure how that would be possible.