Does Acronis restore clean HDD

[lffoar]

Hi all,

I normally format my Win 7 and reinstall annually to start with a clean slate again. Last year after my usual format/reinstall I installed all my programs, drivers, updates etc and did a system back up with Acronis True Vision Home 2010. My question is, does restoring through an Acronis backup clean the HDD as in a format/reinstall or are things left behind. ie possible malware? Thanks

 

[Wallonn7]

Restoring a backup is basically the same as reinstalling Windows, it only takes less time and is less laborious. With regard to malware and "family" ... if the hard drive that will receive the image is compromised by certain kinds of "family", I believe you will find that your "house " was raided, even though the image is free of malware. But I do not think that is the case. So, relax, and enjoy the first part of the answer.

 

[kodi]

Hi all,
My question is, does restoring through an Acronis backup clean the HDD as in a format/reinstall or are things left behind. ie possible malware? Thanks

Yes Acronis will wipe Everything left on the drive

 

[Wishmaster]

Yes, Acronis wipes the drive. So any bad stuff thats there does get erased.


But bear in mind ...
If by chance there was Malware or a Virus present when that Image was made, it backed that up as well.
It will then restore that malware/Virus as well, just as it was when you made the image.

If the Image was free of any bugs, the completed restore will be as well.

 

[toddincabo]

Correct

Wishmaster is correct, The very last screen where you "apply" says.... Operation 1: Delete Partition Operation 2:Restore Partition

Total wipeout.

 

[lffoar]

As usual, the answers a here once again. Best help site on the web!!
Thanks all

 

[Wallonn7]

As usual, the answers a here once again. Best help site on the web!!
Thanks all

You're always welcome!

 

[alan10]

I really do not believe that any imaging system is certain to "wipe" the disc.

Certainly if you create a FULL and NON-intelligent image that captures all the "empty" space and "deleted" files then when that image is restored it may over-write and thus purge any recent infections.

But when the typical Intelligent image is created then only the sectors in use are captured,
and unless deleting the partition involves a very long and tedious wipe of that partition/disc
all the sectors will still hold the recent malware.
After restoring the intelligent image only the restored sectors will be free of malware,
and all the "empty" sectors could still hold recent malware.

It is true that you will not see the malware and you cannot run it because it is not reported in File Directories etc.,
but if File Recovery utilities are able to retrieve files that vanished when a partition was deleted then the malware could also be retrieved.

I am focussing on a technicality which has little relevance normally.
I think it might be relevant if :-
There is a boot virus component that knows the start point at which to execute the main body of the malware;
Some other person has/obtains access to the computer and is able to "undelete" private files that are NOT "wiped" as you have been told.

 

[lffoar]

Thanks Alan for the input. I think I'm pretty satisfied for all intents and purposes that the Acronis backup should "protect" me but if it proves ineffective, there's always a format/reinstall......which I have used pretty well annually up until now.

 

[SIW2]

All imaging apps will delete the restore target partition, then recreate it.

Except for the part overwritten by the image itself -data will still be there - you all know it is possible to recover data after partition deletion.

I don't know if it is possible for malware to resurrect itself from that situation - I doubt it.

 

[alan10]

All imaging apps will delete the restore target partition, then recreate it.

Except for the part overwritten by the image itself -data will still be there - you all know it is possible to recover data after partition deletion.

I don't know if it is possible for malware to resurrect itself from that situation - I doubt it.

I too have doubts, but also fears ! !

I had full understanding of the way that a file on a floppy disc would be read.
The directory would link the name to the first sector number and track number, and each sector had an overhead of checksum etc. and a link to the next sector in the file.

I know that NTFS is a bit different, and we have extra complications of MFT and MBR and Partition Tables, but I assume that a deleted file can be recovered and the sectors accessed in the correct sequence, so deduce the individual sectors still have the overhead designating which track and sector is the next one.
I also assume that even though the MFT etc may be blissfully unaware of the deleted files, if you start reading a file from the initial sector you will automatically read all the other sectors of that original file, and if you can read you can also execute.

Happy memories of a simpler time in the DOS era when Debug.exe ruled supreme. and you could create a program using HEX characters and invoke G with a Hex address at which to commence execution.

 

[Wishmaster]

All imaging apps will delete the restore target partition, then recreate it.

Except for the part overwritten by the image itself -data will still be there - you all know it is possible to recover data after partition deletion.

I don't know if it is possible for malware to resurrect itself from that situation - I doubt it.

Agreed, I highly doubt it can as well.
Unless of course the malware was already present when the target image was made, but thats a bit different situation.

If it is at all possible to ressurect itself, Id like to see some info showing how and why thats possible. But, as far as Im aware, it isn't.