Is there a way to determine if the Ghost software was used to clone a hard drive, via USB? Does it leave a registry setting? I found some added "Disk" info in the register (HKLM\system\currentcontrolset\enum\IDE) but it is inconsistent and does not really say ghost was used. I think it may put something in the boot volume sector but I do not have the forensic tools to verify this.
Thank you,
Robert