TeraByte Unlimited

Hello,
i just tested the restoration of an Image of C (System). For testing purposes i exported the "folder" "HKEY_CLASSES_ROOT" to a textfile, then created Image, then installed irfanview, then restored C and exported again the part of registry to textfile and compared the 2 versions of the textfile with windiff. Result: To my surprise windiff said: no difference.

Searching for "I_view" in the registry led me to the following key (see att.)

I was a little shocked to find that out. I thought that an imaging program would restore the EXACT State of the machine not having some keys deleted - but one still remaining (how is that even possible - i thougt the harddisk is overwritten sector-by-sector?)
What's the reason for this?

Greetings!

Where is located the key you are showing? Is it under HKEY_USERS or HKCU?
Have you moved your user's profile on to another partition than C: (system)?

This key was under HKey_Classes_Root,
but i found also keys under:
Hkey_Local_Machine
HKEY_USERS

Yes indeed my userprofile is stored on D and was not restored.

NOTE: I thought about it and can NOT be a 100% sure that irfanview was never ever installed before. If you say it is totally impossible what happened i could try another software that was definetly never installed.

Do you find the I_view value under your textfile you saved just before creating the image?

I guess so. Can not tell since i deleted files. I will set up a new clean test and tell you the outcome.

On Mon, 10 Jun 2013 08:11:35 PDT, just as I was about to take a herb,
TDC999 disturbed my reverie and wrote:

>I guess so. Can not tell since i deleted files. I will set up a new clean test and tell you the outcome.

I just cannot understand why you are making your life so difficult
LOL. Just what are you trying to achieve? There must be an easier way.
--

Cheers,

DrT

** Stress - the condition brought about by having to
** resist the temptation to beat the living daylights
** out of someone who richly deserves it.