Image your system with free Macrium

Forensic imaging is a waste of time unless you intend to restore all the deleted files in their deleted state so that you can subsequently use data recovery utilities.

@Scoop.
Most malware is unlikely to look for external drives and corrupt them, but I too have a similar fear.

I make image backups in an internal SATA connected Secondary HDD.
Subsequently I use TeraCopy to copy those backups to an external eSATA connected HDD,
and TeraCopy then reads the duplicates and compares the hash checksums and warns me of any data transfer errors.

Only when copying to the external is that connected up - so it is mostly off-line and not accessible to malware.

NB
Never had data transfer errors with eSATA, but did suffer when using USB2 externals.

NB
At any time you can validate an image backup, and Macrium will warn if any data corruption has occurred because it incorporates hash checksums. You can validate immediately before you restore.
Plugging in a clone is an act of faith - there are no checksums or other means of validating.
(If hash checksums were incorporated in a clone then the clone would be unbootable)

alan10 said:

@Scoop.
Most malware is unlikely to look for external drives and corrupt them, but I too have a similar fear.

I make image backups in an internal SATA connected Secondary HDD.
Subsequently I use TeraCopy to copy those backups to an external eSATA connected HDD,
and TeraCopy then reads the duplicates and compares the hash checksums and warns me of any data transfer errors.

Only when copying to the external is that connected up - so it is mostly off-line and not accessible to malware.

NB
Never had data transfer errors with eSATA, but did suffer when using USB2 externals.

NB
At any time you can validate an image backup, and Macrium will warn if any data corruption has occurred because it incorporates hash checksums. You can validate immediately before you restore.
Plugging in a clone is an act of faith - there are no checksums or other means of validating.
(If hash checksums were incorporated in a clone then the clone would be unbootable)

for the info. I had a guess about your point about malware mostly acting as you mentioned, being unlikely to seek out and target external HDD's.

I'm not familiar with checksums as it relates to cloning. I read a little about it after reading your post and it's interesting info.

When I clone, I have a routine that (I think) validates my newly-cloned HDD:

- Install my Target HDD (via hot-swap SATA racks, no tools required, no accessing internal PC needed). Boot up with "Gparted", a Linux CD bootable HDD utility tool. I do this to format my Target HDD outside of Windows prior to starting the cloning process.

- Format the original HDD. I do this to make it easy to determine the "Source" and "Target" HDD's in the software gui, or with Conezilla, etc. That way, my Target HDD will display an empty bargraph, etc within the software tool. It eliminates human error, selecting the HDD's in reverse.

- Clone the HDD outside of Windows, usually with my Acronis CD.

- Remove the Source HDD and install the Target HDD. This prevents Windows from seeing 2 identical bootable HDD's in my PC.

- Boot up on my Target HDD and insure that it's a working spare HDD. I launch several programs, my Outlook, IE10, etc.

- Re-install my Source HDD. Insure that it's working ok. Resume everyday PC use until I clone the next time.

Since I also have a 2nd spare HDD that was also tested to work ok, I'm not vulnerable in the event that a cloning process goes south.

- I've been cloning every 4-6 weeks since Sept '11 without issues.

I'm definitely going to learn more about imaging and will soon launch my own imaging activity on a scheduled basis since I like the idea of covering all of the bases with backup tools.

Thanks again for your info

lehnerus2000 said:

alan10 said:

Forensic imaging is a waste of time unless you intend to restore all the deleted files in their deleted state so that you can subsequently use data recovery utilities.

I'm aware that "Forensic" will copy everything including "empty" sectors. :)

Regardless of what you might be aware of,
You specifically ask
"should we be using "Forensic" imaging instead of "Intelligent" imaging?"
and I answered your ignorance of what you should be using by telling you that it will facilitate data recovery of what were "deleted files" at the time that you create the image.

If you intend to use something like Lazesoft Recovery to resurrect files deleted from a corrupted install then use Forensic imaging.
If you wish to only retrieve NON-deleted files from what you image then Forensic will give zero benefit.
Lazesoft Recovery Suite Home Free Download

Scoop said:

I'm not familiar with checksums as it relates to cloning. I read a little about it after reading your post and it's interesting info.

Macrium Image backups consist of blocks of compressed data which can be decompressed into sector clusters.
Each data block is a few Megabytes (documented somewhere) and a hash checksum is recorded for each block.
Every block must match its hash or it is not valid.
When the image is restored only the data blocks are decompressed to the target sector clusters,
the hash values are not written to the target.

This sort of checksum validation is not feasible for a clone - Its sector clusters need to hold the system data and there is no space for embedding hash checksums.