What is “Ghosting” an image and why isn’t that good enough?
|
|
Ghost is an application created by Symantec. Ghost is very good for creating an image of a computer that includes only those files and data visible to the operating system and the user. Ghost does claim to have settings allowing it to make an image of all data. However, Ghost has not been tested and verified with a peer review to determine its worthiness in creating a forensic image. Furthermore, Ghost does not have a method for verifying the data that it does acquire is accurate and does not change.
Vestige uses a tool called Encase which has not only been peer reviewed but also has been tested by NIST (National Institute of Standards and Technology). It maintains a unique signature of the image which it can use to compare at any point in time in order to verify the authenticity of the image.