I support a number of desktop computers at my workplace (Dell Optiplex 9010, Win 7, 64-bit) and I use Ghost 11 to create and restore images for these computers. Over the weekend an incident occured which I am having trouble finding a cause for.
Three staff members have reported to me that their computers have been wiped/restored back to factory conditions overnight. I managed to catch one "in the act" and here is what I saw:
Upon turning on the computer, it boots into the "Symantic Windows PE Automation," and begins running Ghost 12 (keep in mind I use 11, I don't know how or why version 12 appears.) The Ghost program then restores an image to the computer: "Win7_x86_01_07_13_SysPrep.gho" (this is not the exact filename, but it is close, I didn't have time to write it down verbatim.) After the restore, the computer boots up into a fresh windows 7 installation, I cannot find any way to recover the old data.
Over the past month I have deployed 20+ desktop computers in this manner, each using the same image. This is the first time I have had this problem, however, I am worried that this event will to continue to happen to all my users computers one by one. I have instructed everyone to not shut down or reboot until I can figure this out. I have been Googling all morning and on the phone with Symantec tech support but no one is able to give me any info.
Hopefully someone on these forums will have some experience with this. Thanks!