Hello Reader,
I've been asked quite a lot about recovering data from Windows 10 if deep freeze was installed. Now I've had theories and hypothesis regarding how Deepfreeze works and what should be possible but tonight I got an evaluation version of Deepfreeze and a new Windows 10 VM to find out for sure.
Here is what we learned:
I've been asked quite a lot about recovering data from Windows 10 if deep freeze was installed. Now I've had theories and hypothesis regarding how Deepfreeze works and what should be possible but tonight I got an evaluation version of Deepfreeze and a new Windows 10 VM to find out for sure.
Here is what we learned:
- Deep freeze is reverting the system back to its prior state on reboot, as advertised
- When creating resident files if it is a reused mft entry it will be overwritten by the prior entry
- When creating non resident files any cluster previously in use will be overwritten
- Any part of the disk that was unallocated before freezing will contain any deleted data after reboot as deep freeze will have no data to overwrite it with
So, yes you can recover data even after rebooting with deep freeze, just not everything.
More testing to understand more about what is happening with deep freeze to come!
You can watch the video here:
Also Read: Daily Blog #612
Post a Comment