Ghost Solution Suite

Is it possible for a v2i image to contain a bitstream image such that deleted content is recoverable?  Sorry if this question was already asked; I searched the forums and was unable to find an answer immediately.

Thanks!

Rebecca Schley, CCE

Seyfarth Shaw, LLP

The reason you may not have found anything relevant is that you are posting in the wrong forum. Although you did not mention exactly which product and version you have, the v2i reference makes me suspect that you are using the retail version of Norton Ghost. This forum supports the corporate version of Ghost, based on different technology to the Norton product.

However, we do get a number of Norton users popping in here, so there is a sticky posting around the top of the postings lists which has links to the Norton community where you can ask your questions. Whe reposting, please provide fuller information including product version, and details of your scenario so that users can understand what has happened and what you are trying to do.

If you have deleted something from your machine, but have a previous backup image which contains the deleted content then you should be able to recover it from the image. 

As EdT says, you may be on the wrong forum ... however, Symantec Ghost (from the Ghost Solution Suite) is an excellent product to meet your stated needs - with it's image-raw mode it can capture every single block on the disk - which could be used for forensic purposes, i.e. it will include any deleted data that hasn't been overwritten, and cluster-slack (unallocated bytes at the end of disk blocks, which may contain previously deleted data).