Ghost Solution Suite

 View Only
  • 1.  Forensic use

    Posted Jan 22, 2008 07:39 AM

    i use boot cd with Symantec ghost 11.0.1

    I need to use it for forensic use: can I?
    If yes as i can use it?

    Thanks for regards


  • 2.  RE: Forensic use

    Posted Jan 24, 2008 05:19 PM
    Yes you can, when you create the image with Ghost, use the -id switch. This creates a sector by sector image including the boot track, extended partitions and unpartitioned space on the disk. You have to restore the image to a disk with the same geometry as the original though.

    You can read about the -id switch in the Ghost Implementation Guide under your Ghost install folder.