Smartechnologies said:
I have a clients PC in my shop for repairs. He had Win2000 Pro. I
imaged the
HD to a file, then wiped the HD and installed XP Pro. The image file,
created
with Acronis True Image 8 was then copied to an external HD. The image
file
can be explored fine and individual files can be copied to the PC from
the
Ext. HD.
Problem is, the files cannot be opened! Either "the document name or
path is
invalid" or "wrong file format". I'm beginningto believe the W2K
installation
had EFS setup. Is there a way around this, or must I bring that image
back to
the PC, unencrypt, image again, so on and so on??
The problem with many drive imaging programs is that they perform a
*logical* copy by reading through the file system. If the EFS
certificate wasn't exported (and then imported) then you won't have it
to decrypt the files. You need to perform *physical* drive imaging
(which is actually partition imaging). A physical image will read
sector by sector and also write sector by sector, so it is unimportant
if EFS is used or not. Powerquest's DriveImage does physical imaging by
reading sectors (i.e., the file system is never used for the source or
target). The "old" Symantec Ghost program defaulted to saving logical
images, so you had to use the /IA command-line parameter to save
physical images.
When I tested Ghost (because it was included in some "Pro" suite), that
was one of the first nasties that I hit. Symantec's recommendation was
that I remove EFS from all such protected files before saving the image,
save the image, and then reapply EFS on all those directories. Yeah,
right, like I'm going to act like an idiot because logical imaging was
used instead of physical imaging. Eventually I figured out the /IA
parameter could be used to force Ghost into saving a physical image (but
its fileset for a physical image was far more huge than the fileset
created by DriveImage). Symantec bought Powerquest and dumped their old
codebase for Ghost and went with the DriveImage engine, so the "new"
Ghost probably defaults to saving physical drive images. As I recall,
Acronis also saves logical drive images but maybe it has an option to
save physical drive images. The problem with a logical drive image is
that the EFS certificate won't be available when the EFS-protected files
are restored (i.e., they cannot be read). With a physical image, the
file system (and EFS cert) aren't needed to restore the file, but a
logical image requires you be able to read the EFS-encrypted file by
having the EFS certificate already incorporated into the file system
through which the file is being read or written. The result was that my
EFS-protected files on a restore using a logical image were completely
worthless. The other problem with logical images is that the sectors
are not physically laid down (in relative order from the start of the
partition) exactly as they were before.
See if Acronis has an option to force it to save and restore PHYSICAL
images. That usually means you also end up restoring the entire
partition, not just some files within in (although some drive imagers
have a utility to extract individual files from the image - but don't
have the image on CD media since you will be forever swapping CDs).
