forums Home Forums Start Page Forums Frequently Asked Questions FAQ Member List Members List
Go Back   Petri IT Knowledgebase Forums > Other > Misc is happy to award RicklesP the title of Most Valuable Member !!!
Register Calendar Calendar Search Petri IT Knowledgebase Forums Search Todays Posts Today's Posts Mark Forums Read

Ghosted/cloned pc

Ghosted/cloned pc

this thread has 2 replies and has been viewed 869 times

Closed Thread
Thread Tools Search this Thread Display Modes
Old 26th March 2012, 16:45
Ghostrocket Ghostrocket is offline
It's not a coincidence
 Join Date: Feb 2012
  6 month star 12 month star
 Posts: 63
 Reputation: Ghostrocket is on a distinguished road (10)
Default Ghosted/cloned pc

Hi all

Just a general question

Is there a tell tale sign that would tell me if a pc was built using ghosting/imaging software?

I realise this may vary over the software available, so any advice would be great.

Old 26th March 2012, 22:11
gerth's Avatar
gerth gerth is offline
Junior Member
Staying around
 Join Date: Jul 2010
  6 month star 12 month star
 Location: The Netherlands
 Posts: 222
 Reputation: gerth will become famous soon enough (73)
Default Re: Ghosted/cloned pc

Sysprep will leave some traces. Look at this article

MCITP sa, ea & va, sysadmin@cydonia.
Old 29th March 2012, 07:56
winoutreach5 winoutreach5 is offline
 Join Date: Feb 2012
  6 month star 12 month star
 Posts: 19
 Reputation: winoutreach5 is on a distinguished road (10)
Default Re: Ghosted/cloned pc

As Gerth indicated, sysprep, if used will leave some traces behind. However, it is the most used widely accepted and suggested solution for imaging in the enterprise world.

You asked if there would be “tell-tale signs” that would be indicative of if a system had been imaged. With sysprep, one would really, really have to know where to look if he or she wanted to decipher whether or not the computer had been imaged. Rearm count and sysprep panther logs are two methods. However, rearm count isn't necessarily applicable to large OEMs who have partner contracts with Microsoft, and panther logs – as referenced in Gerth’s link – can be deleted by someone who knows what they're doing.

As for the imaging process specific part of your question, ghosting is detectible by MBR and index misalignment when you apply partitions of not exactly the same size, but ImageX file based imaging is undetectable. And, for the record, that ghosting detection is something that would require forensic software.
Hope this helps!

Windows Outreach Team – IT Pro
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Cloned machines in terminal safe boot mode pksupport Windows 2000 Pro, XP Pro 2 29th July 2010 02:25

All times are GMT +3. The time now is 17:10.

Steel Blue 3.5.4 vBulletin Style ©2006 vBEnhanced
Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.

Valid XHTML 1.0!   Valid CSS!

Copyright 2005 Daniel Petri