7 Replies Latest reply on Nov 5, 2010 7:21 PM by peter_eepc

    ghosting disk scenario

    msimard

      I dont know if the question already been ask but here goes:

       

      Scenario: A disk with two partion a C and a D. The D drive would be hidden from user and use to store a ghost image, for restore purpose. The C drive would be encrypted.

       

      For restoration: The help desk would come with a cd/usb containing ghost and boot on it, cause they want to restore the machine by using the image on the D partition and overwriting the C partition without decryption. Just a plain overwrite everything.

       

      Will it work ?

        • 1. Re: ghosting disk scenario

          Not without some additional steps, no. Restoring the C partition won't remove the pre-boot links, so you'll also need to do a fixmbr or a fdisk/mbr etc to zero out the mbr and put it back to standard.

          • 2. Re: ghosting disk scenario

            Very unrealistic scenario. Few problems.

            Hidden partition might get encrypted too. Yoy will loose ability to use it for reimage.

            You would need to use partition mode of ghost, that will cause issue with MBR. Additional steps would be needed.

             

            But you could approach this by using bootable media and external storage device. Booting BartPE from large USB flash memory would resolve both issues. (Disk image - not  partition image; on USB memory device). Net benefit would be also no need for special hard disk partitioning scheme.

            • 3. Re: ghosting disk scenario
              Hidden partition might get encrypted too. Yoy will loose ability to use it for reimage.

               

              not true - EEPC only encrypts Windows accessible partitions with a drive letter, so if the recovery partition is hidden, it will never ever get encrypted.

              • 4. Re: ghosting disk scenario

                SafeBoot wrote:

                 

                Hidden partition might get encrypted too. Yoy will loose ability to use it for reimage.

                 

                not true - EEPC only encrypts Windows accessible partitions with a drive letter, so if the recovery partition is hidden, it will never ever get encrypted.


                As long as it stays hidden, maybe (I did not check that). But is still very risky as if something reenables it for a short time. Never trust MS.

                • 5. Re: ghosting disk scenario
                  msimard

                  Following my scenario, the customer decided to not bother with rescue partition at all. So i started the encryption process, everything was runnig along quite well, but the someone misundestood something and decided to go on the two machine that where encrypting, and unmask the hidden partion and delete it. The windows disk manager forze up, and the pc.

                   

                  When rebooting, we got a blank screen with nothing else after the bios screen. I started the safetech recovery cd and decrypting the disk. Will it resolve the problem ? if not, we are going to reimage the whole thing.

                  It`s my understanding that it take has long to decrypt,that it took to encrypt. im i right ?

                   

                  IF the problem come from EE, can you explain the mecanism involved. In any way, it`s a interesting experiement !

                  • 6. Re: ghosting disk scenario

                    probability is that whatever they used to modify the partition overwrote the boot sector. I would re-image and start fresh.

                    • 7. Re: ghosting disk scenario

                      Interesting, that may be. But hardly useful. Decryption times depend on environment it runs in. If decryption is done under Windows, usually it runs much fster than the same decryption under SafeTech booted OS.

                      As for explanation what happened, you are probably the best person to answer.