Advertisement
i am backing up an entire hard disk using the xp backup utility. my boss doesn't want who ever uses that computer after the backup to know it was backed up. Is this possible? Any help would be much appreciated.
posted by:
|
SF Bay Area
|
Advertisement
Advertisement
-
Re: question
Tue, February 27, 2007 - 2:15 PMI would suggest setting it to do a "Copy" as opposed to "Backup" (that way it leaves the "A"rchive bits set.) Of course, whether or not the bit is set or not, people will not really know if you copied a system or not. (Keep in mind that running a backup using NTBackup will leave marks in the registry as to the job that was run as well as there will be a job log.)
If you want to snag a system completely and stealthily, ghost is your best option. -
-
Re: question
Tue, February 27, 2007 - 7:54 PMAlternatively you could always use the attrib command to reset the archive bit...
-
-
Re: question
Wed, February 28, 2007 - 12:06 AMSymantec Ghost
There is a Forensic setting that leaves the host drive unmarked... Required to ensure evidence is not tampered with.
We used that when I worked for the government during legal cases. We never accessed the host drive, all investigation is done on the Imaged drive. Any changes to the host drive instantly made all evidence inadmissible in court.
