The newer '5.x' versions of Ghost no-longer use raw reads of the drive; they
copy files [and therefore won't keep 'deleted' files].

You'll need to use Ghost 4.03 or earlier, and do a disk-to-disk copy onto a new
drive. If you request "dump-to-image" and/or compression, it will lose the
'deleted' data as well.

I go w/ Mark's suggestion-- just swap drives out, putting the new drive [w/
image] in the person's machine. After imaging to the new drive, and the
partitions will be the same-- even if the new drive is physically larger, no one
will know, b/c the partition-size will be the same [unless they use fdisk, &
look at 'percentage-used'], or they like to look at the BIOS boot-screen, & see
the drive geometry.... & if so, that kind of person knows how to use a good
'wipe' program, so this entire 'forensics' would be useless anyway.


>  hook them up to a basic DOS system
> >and run GHOST 5.2 to create the image.

>
> >Additionally, does anyone see a flaw in this course of action or can
> >suggest a better method?
>
>             Do you want to signoff PCBUILD or just change to
>                     Digest mode - visit our web site:
>                    http://freepctech.com/pcbuild.shtml

--


Thanks,

Dave A. Anselmi
IT Analyst, IT.ERP
Oracle

            Do you want to signoff PCBUILD or just change to
                    Digest mode - visit our web site:
                   http://freepctech.com/pcbuild.shtml