Restoring tib to unformatted disk

I usually restore tib to overwrite the previous C-partition.
I did not have any problem.
In case of serious vira infection on Windoes,
I can wipe them out by unformatting the whole c-drive.
Then, can I restore tib directly to the unformatted c-drive (without prior reformatting)? Sarutaro

 

If your tib is a full disk-image - then yes... A full disk-image contains the disk's format information along with the MBR, Patition Tables, etc. But I fail to see what there is to be gained by 'wiping' your C-drive before restoring, as the restore itself will overwrite everything on the disk!

 

That is not technically true. TI does not wipe out all the data on the hard disk before (or during) restoring the image. It does rewrite the MBR and does delete and recreate the partition(s) before restoring the data. But only the areas TI writes data get overwritten. This works fine in most cases.

During testing multi-boot scenarios, I found that a wipe of the MBR and beginning of the drive was indeed needed to allow the some images to restore to a bootable condition. If the wipe was not performed, then the drive wouldn't boot correctly. One example is restoring an image of a drive using OSS with an image of a drive using BootITNG and vis versa.

If you had a bootsector virus, then I would wipe the MBR, boot sector and the beginning of the drive before restoring the image just to make sure no remnants remained. Under normal circumstances, though, wiping the drive is not necessary.

 

About a month ago, my computer was almost crawling. I could not figure out why. I thought that recently installed Norton 360 slowed down my computer. The problem did not appear. One possible cause of the problem is viral infection (I cleaned throughly though). So I decided to restore three tibs (backed up during last 12 months) with ATI v. 9. The oldest tib does not include Norton 360. Restoration of all three tibs did not return to the normal state of the computer. The "restored" C-partition was still too slow as before started the restoration. This suggests that something in the hard drive was not removed or over-written during the restore process.

Eventually, I replaced the C-drive with a new HD and started to reformat and install Windows XP.

It appears that what MudCrab described is probably correct. Sarutaro

 

MudCrab, my point was that there's no need to format or wipe your target drive if you are restoring an entire-disk image (tib) file ....and since you agree that ATI rewrites the MBR and deletes and recreates the partitons before restoring, I don't see any basis for saying I am not correct, technically or otherwise!

Again, I don't believe this is necessary when restoring an entire-disk image file, as doing that completely replaces the MBR (or BootSector).

Of course, there's no harm done in deleting/wiping the disk (or MBR) before restoring an entire-disk image, but while I can't speak for other disk-imaging products, it's just not necessary with ATI, and that was the point of my first reply.

 

pvsurfer,

What I was disagreeing with was the statement that TI will overwrite everything on the disk. It only overwrites the used parts of the disk. Just as it only backs up the used parts.

In probably 99.9% of cases you are correct. An entire disk restore will work (and should work). However, BootITNG uses an EMBR (an extended MBR) to keep track of part of its information. This is stored just after the MBR on the disk. In the case of my tests (of which I ran dozens), restoring the entire disk image was not enough to restore BootITNG (or OSS) into a bootable condition. I have no idea where the "bug" actually is, but wiping from the MBR through the bootsector fixed the problem. I have a feeling that the problem lies in switching between the two, but technically that shouldn't affect TI. What I think happened is that since TI didn't "wipe" the EMBR, there was junk left over from OSS that caused it to fail. I don't think any of the problem was in the MBR or in any of the restored partitions. The problem was in the "empty" space.

When TI restores it does not "erase" any underlying data on the disk. It simply overwrites what's there. This is sufficent in most cases. I was just making the point that IF it was not working correctly after the drive got screwed up or infected and a disk restore was done, that wiping the drive would probably clear the problem.

I do agree with you 100% that a complete disk image restore should always work properly. And should always result in a bootable system (assuming the original image was bootable).

That is the only scenario I've had problems with. In all other cases doing a complete drive image restore has worked perfectly, as has doing individual partition restores.

 

Interesting discussion. The way I see it, unused parts of the disk can not have data (or for that matter, malware) on them - so the argument is strictly academic!

 

Unused parts (sectors, etc.) of a hard disk can contain data, they just may not be currently marked as used. For example, say sector 190,243,527 contained the program fdisk.exe. Then a previous entire disk image was restored to the disk. The restored image is smaller than the previously existing image so sector 190,243,527 does not get overwritten. In this case, the fdisk.exe program is still on the disk. It is intact and can be accessed by a disk editor. However, there is no link in the current file table on the disk. According to the FAT, that sector is unused and will be filled with new data when the space is needed.

That is the main reason that disk wiping is necessary, especially when security is an issue.

During normal use, this does not matter. Files get deleted all the time and the space they occupied gets overwritten by other files.