Macrium Reflect imaging and restore question

I'm wondering if Macrium Reflect's intelligent copy will overwrite all sectors not in use?

Heres an example: A pc freshly formatted, with files A and B on it. Then I create an image with Macrium Reflect. Afterwards, I make a new file C, then restore the image I just created.
Will data recovery tools be able to find this file C? Windows should have just marked the space for file C as available but not overwrite with 0s.

Now if the Macrium image was made with forensic (exact) copy, the image will overwrite all not in use sectors and C wouldn't be recoverable after the restore. But with intelligent copy (only copies files in use), is file C recoverable? Are files even put back in the same blocks they were in before?

Macrium problems??

Last post: "Image backups are just another file and do not wipe data on a target drive."

Personally I'm not sure.
May best to do a test.

Are files even put back in the same blocks they were in before?

I doubt it when doing a regular image restore. You would have to ask macrium what happens with their delta restore.

NTN said:

Macrium problems??

Last post: "Image backups are just another file and do not wipe data on a target drive."

Personally I'm not sure.
May best to do a test.

Yeah I'll probably do a test.
Any suggestions for programs to test with? Sure I can use recuva to check for the files but I'm not sure how to check the blocks...

Couldn't you just take a back-up first, and then download some kind of a program that you don't need.

So after restoring the image you could see if that program still exist.

NTN said:

Couldn't you just take a back-up first, and then download some kind of a program that you don't need.

So after restoring the image you could see if that program still exist.

I meant checking if blocks are the same for files that exist in the backup. The program part I can check with recuva or file recover programs

Aooouu....I've never been there, sorry.

If you create a forensic backup, then, yes, all data will be overwritten. Remember that a forensic backup backs up EVRYTHING including blocks with no data (at least as reported by the filesystem). So, let's say that you have a 500GB HDD, but there is only 100GB of data on it. Creating a forensic backup will create a 500GB backup because it backs up EVERYTHING.

However, note that if it was possible to recover a previously deleted file before your backup, it will then still be possible to recover that file after restoring your backup.

If you want to make sure that previously deleted files cannot be recovered, do this:

Create a backup with Reflect, but NOT a forensic backup.

Boot from your Reflect recovery disk OR Windows setup media (but don't proceed with Windows installation).

Open a command prompt by pressing SHIFT + F10.

Run DISKPART and determine the drive ID of the Windows drive - If you need info on how to do this, let me know.

Perform a clean all operation on that drive. This will overwrite EVERY byte of data on the drive. This may take a long time!

Now, restore your backup. Since this was NOT a forensic backup, but rather a backup of used blocks only, only that data will be restored, not previously deleted files.

hsehestedt said:

If you create a forensic backup, then, yes, all data will be overwritten. Remember that a forensic backup backs up EVRYTHING including blocks with no data (at least as reported by the filesystem). So, let's say that you have a 500GB HDD, but there is only 100GB of data on it. Creating a forensic backup will create a 500GB backup because it backs up EVERYTHING.

However, note that if it was possible to recover a previously deleted file before your backup, it will then still be possible to recover that file after restoring your backup.

If you want to make sure that previously deleted files cannot be recovered, do this:

Create a backup with Reflect, but NOT a forensic backup.

Boot from your Reflect recovery disk OR Windows setup media (but don't proceed with Windows installation).

Open a command prompt by pressing SHIFT + F10.

Run DISKPART and determine the drive ID of the Windows drive - If you need info on how to do this, let me know.

Perform a clean all operation on that drive. This will overwrite EVERY byte of data on the drive. This may take a long time!

Now, restore your backup. Since this was NOT a forensic backup, but rather a backup of used blocks only, only that data will be restored, not previously deleted files.

So it seems to me that if I go: create intelligent image -> create file C -> restore with image, it will still be there and recoverable with recuva if it wasn't overwritten by the restore right... hmm... I'll check it later