Assuming I want to make sure all traces of deleted files are gone from a system, but don't want to do a clean install or lose the current system configuration, will restoring an image of a hard drive essentially restore traces of the deleted files I just wiped (by formatting and zeroing the drive)?
-
Wouldn't it be easier to just run SDelete?– Patrick SeymourApr 2, 2013 at 14:16
Add a comment
|
3 Answers
Yes. An image that does a sector by sector copy of your hard drive will (restore traces). But, a backup tool that copies files off your hard drive and restores them back wont (restore traces).
As a disk image usually is more than just a backup of the files but as the name says an image of the disk, which is a bit per bit reconstruction of the original. The deleted files will as well be part of the image. If you can reconstruct the files on the original disk you should be able to reconstruct them as well after restoring the image. If you want to permanently delete files you should wipe those files with a tool like Eraser, File Shredder, Darik's Boot and Nuke or CCleaner. Those tools allow the permanent delition of files by overwriting the hard disk where those files are/were stored with a pattern so a recunstruction is unlikely.
-
Partclone/Clonezilla disk images skips unused space. However I understand it works at the block level, so it would restore the smaller than 512 byte fragments of deleted files that NTFS can have ( discussed at: technet.microsoft.com/en-au/sysinternals/bb897443.aspx )– gmathtSep 10, 2015 at 2:10
Yes, they can be restored and easily. You would need to low level format, or zero the drive first.
-
Sorry, I wasn't clear in my question. That's what I meant by wipe clean after taking an image (edited question above).– ChoyApr 2, 2013 at 14:06
-
In that case, I upvoted the answers for your modified question. Apr 2, 2013 at 14:12