Imaging gets rid of virus infection?

Anupam · 15. Oct 2010, 05:52 AM

I had not tried drive imaging until a few days ago. A friend of mine had her PC infected, and I had to format it. I reinstalled everything, and I decided to try making an image. I tried Macrium Reflect free, and it went quite smoothly. I will use imaging for myself now

.

The question I have is, suppose the C drive is infected with virus. Can I use the previously built image of C drive, kept on other partition, to wipe the C drive, and install the image over it? Will this get rid of the infection, and return the C drive to a fresh state?

Also, can the image file get infected with virus?

kendall.a · 15. Oct 2010, 06:45 AM

Think of a drive image as a byte by byte duplication of your hard drive. It literally copies everything. In fact, if your hard drive has a bad sector, an image will actually copy that bad sector into your image file. (I know this to be true because I once imaged a hard drive that was failing. I then copied or installed the image on a new hard drive. Guess what? The new hard drive ended up in the exact same state as the old hard drive!) So, be very careful with images. Again, it literally copies that hard drive sector by sector and byte by byte.

As you are probably aware, chkdsk has the ability to mark certain sectors as "bad". If you image that hard drive, then those same sectors on your new hard drive will also be "bad". Again, imaging is an exact duplicate not only of your OS and files, but of the actual HD itself.

So, understanding this, your first question should be answered. Since an image is an exact duplicate of your OS, files, and even HD at the time of the image, installing an image over top of a HD with a virus on it will, in essence, wipe out that virus. It reverts that HD to exactly the way it was when you created the image.

I keep my image file(s) on an external HD. An image "file" cannot be "infected" by a virus, but your external HD could. In theory, I guess that virus could in some way impact your image file. But, to be really honest, I'm not totally sure on this point.

tushR · 15. Oct 2010, 10:12 AM

If you have a good image (no virus...)in a external HD, and your computer has virus, to be safe you can format your computer, then reinstate the image - long drawn process but worked for me.

Anupam · 15. Oct 2010, 02:19 PM

Thanks for the replies. Logically yes, if I install the image, then it should bring the computer to a fresh state of the image, wiping out the infection. I asked just to confirm, in case this was not so.

I also asked this because I did not want to perform the format. But, to be sure virus infection is not there, Tushar's way seems safe.

Quote:

Originally Posted by kendall

Think of a drive image as a byte by byte duplication of your hard drive. It literally copies everything. In fact, if your hard drive has a bad sector, an image will actually copy that bad sector into your image file. (I know this to be true because I once imaged a hard drive that was failing. I then copied or installed the image on a new hard drive. Guess what? The new hard drive ended up in the exact same state as the old hard drive!) So, be very careful with images. Again, it literally copies that hard drive sector by sector and byte by byte.

As you are probably aware, chkdsk has the ability to mark certain sectors as "bad". If you image that hard drive, then those same sectors on your new hard drive will also be "bad". Again, imaging is an exact duplicate not only of your OS and files, but of the actual HD itself.

I don't have much knowledge about this, but correct me if I am wrong. I think if a hard disk develops a bad sector, it occurs at the hardware level? And I think drive imaging works at the software level? So, how would it copy the bad sectors of the hard disk?

But yes, if you had run chkdsk, I think it marks the bad sectors at the software level? That way, the problem can occur.

Logically, this seems to me the case. But, I may be wrong. I will have to read more about imaging to see how it works.

Are you sure that the image file does not get affected by any malware? If it gets, then that image has to be kept on a different hard disk, or better on a DVD. I saw an option to make a bootable DVD on Macrium free. That would be best.

eyeb · 16. Oct 2010, 02:27 AM

Quote:

Originally Posted by kendall

Think of a drive image as a byte by byte duplication of your hard drive. It literally copies everything. In fact, if your hard drive has a bad sector, an image will actually copy that bad sector into your image file. (I know this to be true because I once imaged a hard drive that was failing. I then copied or installed the image on a new hard drive. Guess what? The new hard drive ended up in the exact same state as the old hard drive!) So, be very careful with images. Again, it literally copies that hard drive sector by sector and byte by byte.

As you are probably aware, chkdsk has the ability to mark certain sectors as "bad". If you image that hard drive, then those same sectors on your new hard drive will also be "bad". Again, imaging is an exact duplicate not only of your OS and files, but of the actual HD itself.

So, understanding this, your first question should be answered. Since an image is an exact duplicate of your OS, files, and even HD at the time of the image, installing an image over top of a HD with a virus on it will, in essence, wipe out that virus. It reverts that HD to exactly the way it was when you created the image.

I keep my image file(s) on an external HD. An image "file" cannot be "infected" by a virus, but your external HD could. In theory, I guess that virus could in some way impact your image file. But, to be really honest, I'm not totally sure on this point.

does this work in opposite direction? to image a good hdd onto a bad one to fix it?

kendall.a · 16. Oct 2010, 06:29 AM

Quote:

I don't have much knowledge about this, but correct me if I am wrong. I think if a hard disk develops a bad sector, it occurs at the hardware level? And I think drive imaging works at the software level? So, how would it copy the bad sectors of the hard disk?

I am by no means an expert in drive imaging. However, from personal experience I can tell you that imaging a HD with bad sectors recreates those bad sectors when you install that image. It happened to me.

As you can see from the following link, it has happened to lots of people:

http://www.wilderssecurity.com/archi...p/t-82535.html

Quote:

does this work in opposite direction? to image a good hdd onto a bad one to fix it?

I'm not sure if this was a serious question or not. However, it is a very good question and one I don't know the answer to.

Anupam · 16. Oct 2010, 12:20 PM

Thanks for the link kendall. Wow, its surprising to read that drive imaging of a bad disk can actually corrupt the good disk too.

From what I read on the thread, it happened due to the partition information being copied to the good disk via imaging. So, I might be right that while disk corruption occurs at a hardware level, but the marking of a bad sector by chkdsk occurs at the software level, thats why the problem occurs, because that information gets copied too. But, I don't think that it would actually corrupt the good disk at a hardware level too? Not sure about this. Logically, it should not. One solution provided was to resize the partitions, to get over this. Don't know if that would work.

Another aspect to be considered is that there are two things, disk cloning, and disk imaging, and I think both work in different ways. Cloning might be copying sector by sector of the hard disk, while imaging might be different.

Which software had you used kendall, when the problem occurred?

Quote:

Originally Posted by eyeb

does this work in opposite direction? to image a good hdd onto a bad one to fix it?

Logically, it should not work, because even if that sector is marked good via imaging, at the hardware level, that sector would still remain bad, and would cause problems.

Ritho · 16. Oct 2010, 02:27 PM

Quote:

does this work in opposite direction? to image a good hdd onto a bad one to fix it?

Quote:

I'm not sure if this was a serious question or not. However, it is a very good question and one I don't know the answer to.

I am assuming that eyeb was joking, but no it won't fix it. A bad sector is far more that a fileing system or data error. It is cause by a physical failure on one of the disk platter surface.

kendall.a · 16. Oct 2010, 05:34 PM

Quote:

Which software had you used kendall, when the problem occurred?

Acronis True Image. Though, I now use Paragon Backup & Recovery.

jim · 18. Oct 2010, 09:45 AM

My method (which has saved me more than once) is to find an imaging program which works on your system. I tried many but found just one which (unfortunately) was paid but which definitely restored a perfect image. (You MUST test it under fire to make sure it works). If my PC is running perfectly then I make an image each month on an external drive. I keep one old one and make one new one so I have two - one two months old and the latest at the start of the current month. As long as the imaging program works properly and you ensure your PC is as "clean" as possible when you make the images then you should be covered against just about anything. If you use a good program like mine it can even restore your image to a new hard drive (or PC) as long as the drive is large enough. It only takes an hour or two to do it. Much better than a reformat and trying to download/re-install all the programs you had.

15. Oct 2010, 05:52 AM	#1 (permalink)
Anupam Moderator Join Date: Jul 2008 Location: India Posts: 9,484	Imaging gets rid of virus infection? I had not tried drive imaging until a few days ago. A friend of mine had her PC infected, and I had to format it. I reinstalled everything, and I decided to try making an image. I tried Macrium Reflect free, and it went quite smoothly. I will use imaging for myself now . The question I have is, suppose the C drive is infected with virus. Can I use the previously built image of C drive, kept on other partition, to wipe the C drive, and install the image over it? Will this get rid of the infection, and return the C drive to a fresh state? Also, can the image file get infected with virus? __________________ Anupam

15. Oct 2010, 06:45 AM	#2 (permalink)
kendall.a Foundation Editor/Forum Manager Intern Join Date: Apr 2008 Location: Colorado, USA Posts: 1,814	Think of a drive image as a byte by byte duplication of your hard drive. It literally copies everything. In fact, if your hard drive has a bad sector, an image will actually copy that bad sector into your image file. (I know this to be true because I once imaged a hard drive that was failing. I then copied or installed the image on a new hard drive. Guess what? The new hard drive ended up in the exact same state as the old hard drive!) So, be very careful with images. Again, it literally copies that hard drive sector by sector and byte by byte. As you are probably aware, chkdsk has the ability to mark certain sectors as "bad". If you image that hard drive, then those same sectors on your new hard drive will also be "bad". Again, imaging is an exact duplicate not only of your OS and files, but of the actual HD itself. So, understanding this, your first question should be answered. Since an image is an exact duplicate of your OS, files, and even HD at the time of the image, installing an image over top of a HD with a virus on it will, in essence, wipe out that virus. It reverts that HD to exactly the way it was when you created the image. I keep my image file(s) on an external HD. An image "file" cannot be "infected" by a virus, but your external HD could. In theory, I guess that virus could in some way impact your image file. But, to be really honest, I'm not totally sure on this point. __________________ <-------Is looking for his brain....

15. Oct 2010, 10:12 AM	#3 (permalink)
tushR Senior Member Join Date: Feb 2010 Location: Bangalore Posts: 187	If you have a good image (no virus...)in a external HD, and your computer has virus, to be safe you can format your computer, then reinstate the image - long drawn process but worked for me. __________________ Relativity applies to physics, not ethics...

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

18. Oct 2010, 09:45 AM	#10 (permalink)
jim Moderator Join Date: Apr 2008 Location: near Ashford Kent England Posts: 304	My method (which has saved me more than once) is to find an imaging program which works on your system. I tried many but found just one which (unfortunately) was paid but which definitely restored a perfect image. (You MUST test it under fire to make sure it works). If my PC is running perfectly then I make an image each month on an external drive. I keep one old one and make one new one so I have two - one two months old and the latest at the start of the current month. As long as the imaging program works properly and you ensure your PC is as "clean" as possible when you make the images then you should be covered against just about anything. If you use a good program like mine it can even restore your image to a new hard drive (or PC) as long as the drive is large enough. It only takes an hour or two to do it. Much better than a reformat and trying to download/re-install all the programs you had.