Ghost Solution Suite

 View Only
Expand all | Collapse all

Can't reimage or extract files from ghost image - help

Migration User

Migration UserMar 20, 2007 11:23 PM

  • 1.  Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 12:20 AM
    A year and a half ago, I used Ghost to create an image file of a computer, and it created 1 GHO file (Zombie.GHO - 2,097,147 KB) and 4 GHS files (ZOMB1001.GHS - 2,097,147 KB, ZOMB1002.GHS - 2,097,139 KB, ZOMB1003.GHS - 2,097,133 KB and ZOMB1004.GHS - 655,282 KB).

    Well, some knuckle head deleted a who bunch of critical files; however, very little had changed since I did the Ghost. So I attempt to recover by just re-imaging the computer. I booted form a DOS disk, mapped the drive on the network with the image files and began to re-image. Once it got to 19% (2306 MB), it would give me an error - Unexpected end of file. Well, I got on a chat line with Symantec support, and they were no help at all. They left me by telling that I could extract the files I needed by using Ghost Explorer.

    Well, when I go into it, it doesn't show my GHO file as a recovery point, so I have to go to Advanced Open to see it. I select it and then it asks me for the final GHS file in the sequence, and when I select it, it keeps asking me for it again and again and again..... So I get onto Symantec's online chat, and they can't figure it out either.

    So does anybody have a clue how I can get these files, or is there a company I can pay to extract them?

    Thanks,
    Peter


  • 2.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 12:22 AM
    And I'll PayPal a cash reward to anyone who can help me solve this.


  • 3.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 05:57 AM
    Hmm. Error 10008, yes? And what particular version of Ghost are you using?

    From my reading of the source code and the circumstances in which it generates this error, it seems to be that when Ghost is encountering the end of the first span of the image, it's deciding that spanning is disabled rather than going on to the subsequent span files.

    When you start Ghost, use the "Options" menu item and check to see whether "Spanning" is ticked (it should be the first item in the first options tab). If it's not ticked, enable it (or equivalently, use "-span" on the command line when first invoking Ghost).


  • 4.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 08:20 AM
    I created the original image using Ghost 2003 after booting to DOS and runing Ghost.exe.

    I have purchased Ghost 10, so I could use either.

    Ideally, I'd like to do a total restore of the machine. Extracting was my secondary route.

    Thank you very much. I'll let you know the outcome, but I'm very optimistic since you knew it was a 10008 error.


  • 5.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 09:45 AM
    Have verified the integrity of the ghost files to make sure they are ok?


  • 6.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 09:47 AM
    The Enable Span was checked.

    I did a copy with verify, which was successful, but I don't know if that is the best way to check it. When I use Norton to verify, it gives me the same error as when I try to reimage from it.


  • 7.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 09:52 AM
    Pl clarify. Did the ghost program you used to create verify the imagefile ok or it also gave the same error?


  • 8.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 10:09 AM
    When I ran Ghost and created the original image, I didn't receive any errors at all. I never manually did a integrity check afterwards.

    And I meant to say earlier, that from DOS I did a copy with the verify and it copied fine, but when I have Ghost do an intergrity check it gives me that same Uneexpected End Of File error.


  • 9.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 10:21 AM
    Obviously there is a problem within the Ghost image file. From a DOS point of view the files are ok.

    You will need help from one of the developers with Symantec who knows the innards of the ghost image file. I highly doubt anyone outside of Symantec will be able to figure it out since very few outside have knowledge about the innards of the image file. You will soon hear from someone on this list.


  • 10.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 10:21 AM
    As it goes through the first 2 GB, it shows the files it is extracting. Does anyone make a program to directly extract from GHO and GHS files? Apparently Symantec does not.


  • 11.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 10:29 AM
    Did you try to open the image file with Ghostexplorer? If so, did the open work ok?


  • 12.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 10:39 AM
    Yes, I did try that and it failed.

    I would have to use Advanced Open, and it would see the GHO file and start to load it, and then it asks for the final GHS file in the series. I'd point to it, and say OK, and it would immediately and continually ask for it again and again and again...


  • 13.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 10:46 AM
    Only a developer from Symantec NZ can help you. I am confident they will.

    Current NZ time is 2.45AM. So will have to wait for about 6 hours before one their developers will see the msgs.


  • 14.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 20, 2007 11:23 PM
    Anybody? Anyone?


  • 15.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 21, 2007 06:30 AM
    > I created the original image using Ghost 2003 after booting to DOS and runing Ghost.exe.

    Thanks; do you happen to recall whether you put the image on a local hard disk, or used a mapped network drive instead?

    Unfortunately, the lead developer of the cloning engine was home sick today so I couldn't consult with him on this, because spanning is one of the more gnarly areas of Ghost. I've pulled the Ghost 2003 source code from the archives to get more familiar with how the process worked in the edition you have, but take this with a grain of salt since this is not the code that is my primary responsibility.

    Anyway, it turns out that when restoring from a dumpfile, the flag that controls whether Ghost understands spanning comes from the header of the image file rather than from the normal settings. Now, when the .GHO file is written, it assumes that it won't span, and what is supposed to happen when it does end up spanning is that the header is adjusted to indicate that it did end up spanning.

    My conjecture, therefore, is that somehow this adjustment to set the "spanned" flag might have gone missing somehow; if this one byte in the image header isn't set right, Ghost won't even try to look for a subsequent span and will instead complain with this error.

    In order to be sure, I'd need to have a look at the first section of the first span (i.e., the .GHO file). The way these files are laid out is that the first 512 bytes of every span contains a header that describes what it is. If it's the first span, the next 2048 bytes are another header that describes the contents, and it's this section that contains the "spanned image" marker. So, the first 2560 bytes (0xA00 in hex) are the critical part, and from that I should be able to work out if my theory is right.

    I don't think I'll need the raw file data, just a dump; in case you don't have a tool to do this, I've adapted a little VBscript from here http://www.interclasse.com/scripts/dumphexafile.php - you can get from http://nigel.bree.googlepages.com/hex.txt and if you save it as a .vbs file it'll dump the relevant part of an image file out into notepad.

    You can e-mail me the dump at nigel dot bree at gmail dot com, and hopefully from that we can work out if my conjecture as to the cause is correct.


  • 16.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 21, 2007 07:30 PM
    Nigel,

    That file is on its way.

    Thank you so much,
    Peter


  • 17.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 23, 2007 09:37 PM
    Thanks to Peter, we've at least found part of what's going on. As conjectured, the "spanning" bit isn't set in the image file header, and we've given Peter a fixup tool for that which has let him recover the data he has.

    Unfortunately, it's the case in current Ghost that the "spanning" bit is only written to the header section of the first span once cloning has finished; if this hasn't happened, we are facing the possibility that in fact the image isn't complete for some reason (and this seems to have happened to Peter).

    Unfortunately we can't fully determine how this came to pass in the first instance, but the cloning engine lead and I are thinking about what we can do to make this more robust.


  • 18.  RE: Can't reimage or extract files from ghost image - help

    Posted Apr 02, 2007 03:08 PM
    Hello,
     
    I'm having the exact same problem, I just read this, and sent you the results of the vbs script. The only difference is, if I opened the image file with ghost explorer, it opens OK.
     
    Any help will be appreciated.
     
    Thank you.
     
    Raul.


  • 19.  RE: Can't reimage or extract files from ghost image - help

    Posted Apr 02, 2007 05:15 PM
    After opening the file with Ghostexplorer, try to compile it into a new file name and then see if the new file will let you reimage or extract files.


  • 20.  RE: Can't reimage or extract files from ghost image - help

    Posted Apr 03, 2007 09:37 AM
    It worked just perfect!, I did the compile option with ghost explorer 8.00.984 and reimage, now the system is up and running.
     
    Thank you very much!.
     
    Raul.


  • 21.  RE: Can't reimage or extract files from ghost image - help

    Posted Apr 04, 2007 07:13 PM
    Nigel,
    On 3/19 at 9:21 PM Peter said: "And I'll PayPal a cash reward to anyone who can help me solve this"
    Did he follow through?


  • 22.  RE: Can't reimage or extract files from ghost image - help

    Posted Apr 05, 2007 12:42 AM
    Yes, he did offer to pay the bounty after getting the fix, so he was as good as his word. Naturally, we couldn't accept it.


  • 23.  RE: Can't reimage or extract files from ghost image - help

    Posted May 08, 2007 09:44 AM
    Hi Nigel,

    I saw your post to Peter on this link:

    https://forums.symantec.com/syment/board/message?board.id=109&message.id=2663&view=by_date_ascending&page=2

    I am having the same exact problem and need to recover the data.  You said in one of your replies that you were able to send him a fix up tool so that he could get the data.  can you please send that to me?

    Thanks,
    Dave


  • 24.  RE: Can't reimage or extract files from ghost image - help

    Posted Jun 08, 2007 06:33 PM
    Hi Dave!
     
    Did you get any answer I am in the same situation, cant open a 17 ghost spanned image, when using Ghos explorer asks me for the last file and keeps asking me for it.
     
    Looking forward to get Nigel Fixtool, I think it would be the solution but didnt get any answer.
     
    Thx dave


  • 25.  RE: Can't reimage or extract files from ghost image - help

    Posted Jul 28, 2007 02:06 AM
    Hi Nigel,
     
    We are experiencing with exactly the same error as well. The GHO and GHS files we have are (each) around 4GB in size. Would it be possible if you can send me the fix up tool? My e-mail address is xo dot martin at gmail dot com. Thankd heaps I am looking forward to seeing your reply. Thanks.
     
    Regards,
    Martin


  • 26.  RE: Can't reimage or extract files from ghost image - help

    Posted Jul 30, 2007 06:00 AM
    Since I get quite a surprising amount of direct e-mail about this, I though it'd be good to provide an overview of what we've learned about these situations along with a direct link to the tool.




    Some advice for situations where there are problems opening images:

    1) In many of these cases, the root cause is that some data loss has occurred; if Ghost Explorer isn't able to open your image, it's usually because the essential data at the end of the image that Explorer needs to display the content is gone.

    In this case, the very first thing to try is recovering the image with Ghost using the -ntexact switch. Ghost processes images front-to-back, whereas Explorer actually processes it from the end (where Ghost stores a summary index of all the spans in the image and all the files as well). If you are lucky then only the index data is seriously damaged and it may restore fine. Even if Ghost fails, if it gets most of the way through there's an excellent chance that the volume can have chkdsk run on it and the content can be recovered.

    2) If restoring with Ghost fails with an "End of File" error (number 10008), then the data loss may well have occurred when the image was first taken, and as a result the Ghost header is missing a flag that says it wrote the image over multiple spans. This means that you won't be able to recover the image using Ghost as suggested above, because of the error 10008.

    In order to get past that error and restore the image to a disk, you can try using this command-line tool to set the missing "spanned image" flag using the "span" option.

    All this is intended to do is get past error 10008 to let you restore the image using Ghost; it probably won't let Explorer run because the most likely cause of the span bit missing is a failure during the image write that also means the end of the image is damaged.

    3) The main additional problem aside from actual image data damage that blocks Explorer is when images were taken starting with a image-to-disk and then subsequent spans were continued on CD or DVD. Image spans written to CD or DVD have (for no particularly good reason) a slightly different structure to normal spans; the first span written to a CD contains the regular image header data, but later spans on the same CD do not.

    There's a special bit in the .GHO header that tells Ghost and Explorer that spans with missing headers are OK and not to panic. If you start imaging to a hard disk and switch to CD or DVD later on, the structure of the span files is in the CD mode but the restore code doesn't know about it and neither Ghost nor Explorer tend to be happy. There isn't any data loss in this particular case, this is just a design oversight stopping access to the data.

    This flag, the "CD bit", can also be set by this tool, using the "cd" option.

    4) There are a small number of images where Explorer fails internally while opening them (it doesn't prompt for the last span over and over, as it does if there is actual damage to the image). If you have a version prior to GSS2.0.1, this may be due to a problem handling an unusual layout of some of the internal NTFS data, and the 2.0.1 Explorer may be abe to deal with this case.

    In this case, it's a good idea to obtain the GSS2 trialware - it should be that the current trialware is build 1532 and this has the fix to that case. The version of Explorer included in the trialware isn't restricted and should be able to be used fine with images from older versons of Ghost.

    [ The exception to this is that Explorer's new NTFS editing won't be useful, because older Ghost versions don't understand the new extensions to the image format. It's best to not "recompile" the images with this version of Explorer if you want to use them with an older version of Ghost. ]

    5) If all the above suggestions aren't enough, by all means get in touch. It's a good idea to be able to supply or post a GHOSTERR.TXT file from a failed Ghost restore, because that will tell us a lot more about the overall structure of the image, and in particular the data it contains will give us an idea of what to suggest next.


  • 27.  RE: Can't reimage or extract files from ghost image - help

    Posted Aug 01, 2007 01:06 AM
    Hi Nigel,
     
    YOU ARE A LIFE SAVER!! I used the fixup tool and it worked like a charm.
     
    Thanks heaps, I can relax now :-)
     
    Regards,
    Martin


  • 28.  RE: Can't reimage or extract files from ghost image - help

    Posted Aug 15, 2007 06:43 PM

    I was extremely excited when I found this topic because I have been trying to extract files from 7 DVDs for almost a year.

    I used Norton Ghost 2003 in October 2006 to image my hard drive. When I went to restore the drive, Ghost failed. All I need off of the DVDs is about 25-30 files, but I can not get Ghost Explorer to work either. I thought this forum was the answer to my prayers. However, when I downloaded the trial version of Ghost Solution Suite I found out that it can only be used on Windows XP Pro and I have Windows XP Home SP2.

    So, hoping that ghofixup.exe may help me and allow me to access the files on the DVDs but I received the following message:

    C:\>ghofixup.exe d:\cdr00034.gho cd

    Failed to open image file: d:\cdr00034.exe

    C:>\

    cdr00034.gho is the last file on Disk 7. I receive the same message when I try to use ghofixup.exe on cdr00001.gho located on Disk 1. I’ve tried using both the cd parameter and the span parameter on both files on the original DVD’s. On the .gho files that I copied to my hard drive I receive the message "Not a valid image file".

    Here are the errors I now receive when using Ghost 2003

    Ghost Explorer asks for Disk 1, Disk 7, Disk 6, Disk 7, Disk 1, Disk 7, Disk 1, Disk 7....... When I hit cancel to exit this loop, I receive the error message, "Corruption in image file, or media not present. Not all files are shown." No files appear in the tree.

    Ghost Integrity Check stops with this error on Disk 5 - "Error Number: (27076) Message: Corrupt packet length in compressed image file".

    When I first tried to restore this image, it made it all the way to Disk 7 before it "errored out". I have tried copying the disks to the hard drive and using Ghost on those files - it doesn’t recognize them. I have also tried running Ghost Explorer with various command line switches (i.e. -bfc; -crcignore; and another command that I can’t think of right now).

    Can you please help me? All I want to do is access a few files, not restore the entire image.

    Thank you in advance. Cindy



  • 29.  RE: Can't reimage or extract files from ghost image - help

    Posted Aug 15, 2007 07:50 PM
    Because the ghofixup tool needs to modify the file, it won't work when run against something on read-only media.

    You should only use it against the first file in an image set, not any subsequent file - although Ghost (especially very old versions) sometimes uses the .GHO extension for later parts of a multipart image on optical media instead of the .GHS extension, the later files have a different internal layout. Only the very first file of an image set (CDR00001.GHO, most probably) contains the information describing the image as a whole, and this is what ghofixup.exe attempts to help with.

    So, you need to copy the CDR00001.GHO file (and probably all the rest) to writable media, and run ghofixup against that first file.

    The message "Error Number: (27076) Message: Corrupt packet length in compressed image file" indicates real data loss in the underlying file. With that kind of major damage (or possibly marginal media that don't read reliably) if the simple fixup tool doesn't let you extract with Ghost Explorer then it may well not be recoverable.

    We could possibly take a look at your images in our labs here in New Zealand to see what (if anything) can be done; you'd need to ship us copies of the DVDs. If you do want to explore that, send Krish Jayaratne a private message on these boards to discuss it.


  • 30.  RE: Can't reimage or extract files from ghost image - help

    Posted Aug 16, 2007 12:55 AM
    Thank you for you very quick response!  I truly appreciate it.
     
    All of the files in this image are .gho files.  I have copied them to my hard drive and when I use ghofixup on the CDR00001.gho I receive the following message:
     
    C:\ghofixup.exe cdr00001.gho cd
    "This image already has the CD flag enabled, image left unchanged."
    C:\ghofixup.exe cdr0001.gho span
    "Detected image with spanned bit disabled.  Spanning now enabled."
     
    However, when I try to access these files in Ghost Explorer, I receive the following message:  "Invalid Drive Details.  This probably isn't a Ghost image file".
     
    The good news is that ghofixup WORKED this time!!!!  The bad news is that I still can't get Ghost Explorer to work.  Any ideas on how I can get around this problem?  I believe most of the files that I want are located on the first 2 or 3 DVD's, so it doesn't matter if the 5th DVD, and possibly others, has unrecoverable data.
     
    I am more than happy to make copies of the DVD's and send them to you in New Zealand.  But, as I said, there are only about 25-30 files that I need and I don't know if it would be worth your time and effort.  It's worth my time because there are family pictures and videos involved which I can't replace - sadly.
     
    Thanks in advance for any help you can provide.  Cindy


  • 31.  RE: Can't reimage or extract files from ghost image - help

    Posted Aug 28, 2007 07:21 PM
    Is there a type of utility program, similar to Ghost Explorer, that I can use to view and extract these files?  It looks like there are others who may also be interested in a utility, based on the number of people who have viewed this post.
     
    As I said before, there are only 25-30 files I'd like to extract from these DVD's, most of which are on the first few discs - I think.  Please let me know if this is possible or if the only way to extract anything from them is to send them to New Zealand.
     
    Thanks!  Cindy


  • 32.  RE: Can't reimage or extract files from ghost image - help

    Posted Aug 28, 2007 10:09 PM
    I haven't used Ghost 2003 and I'm not sure what the error message was when it error out on the restore.  But now you've ran the ghofixup tool, I suggest trying to restore your image again.

    Try to restore the image onto a 2nd or data partition/disk.  That way even if the restore fails at some point, hopefully after chkdsk and after you log into Windows you'd be able to access whatever was restored on the 2nd partition.

    Cheers,
    Bruce


  • 33.  RE: Can't reimage or extract files from ghost image - help

    Posted Aug 29, 2007 12:01 AM
    I understand what you saying, but I don't think it will work.  Although I'm going to try it anyway. When I restored it the first time, it was almost finished but failed on the final disk. Since this was restoring the image to drive D: and not the root drive D:  I was able to access that drive after the restore failed.  If I'm remembering correctly, there was nothing on the drive.  I check into some different parameters and run it again using any relavant parameters I can find.  I'll post the result back here.  Keep your fingers crossed.
     
    I still feel that there has to be a 'baby' Ghost Explorer hiding somewhere that will make mincemeat of the errors and allow me to retreive my photo's and video.
     
    Thanks for replying to my post.  I'll get working on it, but it may be several days before you hear back from me.  Cindy


  • 34.  RE: Can't reimage or extract files from ghost image - help

    Posted Sep 11, 2007 02:42 PM

    Ok, running CHKDSK after restoring the Ghost image to a second disk helped me recover a few of the .jpg files which I lost. When I first viewed the drive, I was thrilled because the directories I needed were there! However, it was short lived. When I tried to open the files in IrfanView, I received the following message: "Can’t read header. Unknown file format".

    The file headers seem to be missing from a large percentage of the files, sigh. The restore failed when it got to CDR00020 - (current file 4742 Unnamed MFT Table Entry). Even though this method did not work for me, I will post the steps I took because it may help someone else recover their data.


    For now I’d like to see if I can retrieve the remaining files using Ghost Explorer.

    When I try to open the image, which I copied from 7 DVDs to the hard drive with Robocopy, using Explorer I receive the following error message: "Invalid Drive Details. This Probably Isn’t a Ghost Image File". I am assuming that this is because Explorer tries to read the first span of the image file (CDR00001) and it’s expecting it to be on a DVD not the hard drive.

    Is there a utility (similar to GHOFIXUP.EXE) which will set the flag on the first span so Explorer will open the image file? There are a total of 34 spans in this image (CDR00001-CDR00034).

    Again, thanks for your help. Cindy



  • 35.  RE: Can't reimage or extract files from ghost image - help

    Posted Sep 13, 2007 03:43 PM

    PLEASE PLEASE PLEASE - will someone tell me how to get past this message? "Invalid Drive Details. This Probably Isn’t a Ghost Image File" when using GhostExplorer.

    Here are the first few bytes of the GHO headers:

    CDR00001.GHO
    000000 fe ef 01 02 64 23 07 00 01 01 00 00 00 00 00 00 00 00 00 00 00

    CDR00006.GHO
    000000 fe ef 09 02 65 23 07 00 71 25 71 17 01 00 00 00 00 00 00 00 00

    CDR00011.GHO
    000000 fe ef 09 02 66 23 07 00 df b4 6a 46 03 00 00 00 00 00 00 00 00

    CDR00016.GHO
    000000 fe ef 09 02 67 23 07 00 10 dc ec 8c 06 00 00 00 00 00 00 00 00

    CDR00021.GHO
    000000 fe ef 09 02 68 23 07 00 11 0b 4f eb 0a 00 00 00 00 00 00 00 00

    CDR0026.GHO
    000000 fe ef 09 02 69 23 07 00 d5 61 91 61 10 00 00 00 00 00 00 00 00

    CDR0031.GHO
    000000 fe ef 09 02 6a 23 07 00 29 ca b3 ef 16 00 00 00 00 00 00 00 00

    CDR0034.GHO
    000000 a3df 21 88 f2 68 9a e4 43 64 81 86 06 12 03 10 8d d0 28 22 01 8 61 69

    I have run ghofixup.exe successfully (see an earlier post in this thread) with the following results:
    C:\ghofixup.exe cdr00001.gho cd
    "This image already has the CD flag enabled, image left unchanged."
    C:\ghofixup.exe cdr0001.gho span
    "Detected image with spanned bit disabled. Spanning now enabled."

    Based on what Nigel says in this thread:
    https://forums.symantec.com/syment/board/message?board.id=109&message.id=3297&query.id=98757#M3297

    I believe that byte 3 (the span byte) is set correctly. I’m not sure which byte is the "CD flag" but based on the message ghofixup returned, I’m assuming that it is set to enabled. Even though these images are now on the hard drive (copied from CD using Robocopy and a utility called JfileRecovery.jar), I am assuming that the CD flag needs to be enabled because the final span CDR00034.GHO does not contain a header. BUT - is this what is causing Explorer problems and returning the "invalid drive" error? Or, is there another byte that needs to be set which will allow Explorer to open this image?

    The reason I am so anxious to extract files from this image is because the ones I need are from my son’s Eagle Ceremony (Boy Scouts of America). This is a great achievement and a once in a lifetime event and it breaks my heart to not have pictures of it as anyone who has ever been involved in scouting will understand.

    In return for help with this, I will post the steps I've taken to recover my files.  Hopefully, this will help others who are having similar problems

    Again, thanks in advance for your help. If you need more information or clarification on anything, please let me know. Cindy



  • 36.  RE: Can't reimage or extract files from ghost image - help

    Posted Sep 14, 2007 03:08 PM

    Hi Nigel,

     

    My name is Rogerio Duarte, I’m a Help Desk Support Specialist at Synqor Inc. Recently we took a image with GSS from one of ours engineers and when trying to image back the system, we’re getting this “unexpected end of file” message. I started looking around and I found a discussion between you and Peter Bretherton at the Symantec Peer-to-Peer Discussion Forum, and I realize that he was having the same exactly problem and you were able to let him access his files.  

    I called Symantec Tech Support and they could not help me at all. I was wondering if you could please help me out with this matter. I will be really thankful to receive your help.

     

     

    Rogerio Duarte

    IT

    Synqor, Inc.

    Boxboro MA – USA

    rduarte@synqor.com     



  • 37.  RE: Can't reimage or extract files from ghost image - help

    Posted Sep 15, 2007 03:54 AM

    will someone tell me how to get past this message? "Invalid Drive Details. This Probably Isn’t a Ghost Image File" when using GhostExplorer.

    Cindy, sorry for not getting to this earlier, but because this forum software isn't very good it's easy to miss out on bumps of old threads.

    It's not clear exactly what the problem that Explorer is failing on is; the message probably relates to a thing called the "Drive Structure" which is the table near the start of the first span that describes the disk the image was taken on and the partitions in the image.

    Posting the first few bytes of the .GHO files was useful; they do seem to be mostly valid to me from eyeballing them. The ones that begin with "FE EF" are the same as GHS-format spans; on CDs, the first span on the disk has the same header as a GHS-format span. One of the peculiarities of the CD format is that the later spans on a CD or DVD don't have any header at all, and the "CD format bit" is what tells Ghost and Explorer to treat those spans as part of an image despite not having a header.

    I can't find that exact message in the current source code of Explorer, since things have been rearranged a bit since 2003. But if you e-mail me (at nigel dot bree at gmail dot com) the dump of the first section of the CDR00001.GHO file, the cloning engine lead and I will be able to decode the Drive Structure for the image and see if we can see anything wrong that is making Explorer have trouble.


  • 38.  RE: Can't reimage or extract files from ghost image - help

    Posted Sep 15, 2007 04:16 AM
    Rogerio, your situation with the "End of file" message is covered in section "2)" of this message earlier in the thread; your image is probably missing the "span bit", which you can set using this command-line tool and pointing it at the initial file in your image set.

    Setting the "spanned image" bit will only resolve the "end-of-file" error and allow Ghost to continue past the initial .GHO file and proceed onto the span files; your image may have other damage at the very end of the image file and so it may be a good idea to restore with the "-ntexact" flag to Ghost. If you do this, it's more likely that after restoring a chkdsk will be able to recover the filesystem.


  • 39.  RE: Can't reimage or extract files from ghost image - help

    Posted Sep 16, 2007 08:03 PM
    Nigel - Thanks for the reply.  I'm looking forward to hearing from you once you're able to run the analysis tools on the hex dump I sent to you.  In the mean time, I'll try the most recent build of Explorer, which you suggested.  I'll let you know if it works.  Cindy


  • 40.  RE: Can't reimage or extract files from ghost image - help

    Posted Sep 16, 2007 09:54 PM
    The most recent build of Explorer allowed me to access the image file and extract the files I needed.  Thank you Nigel!  I truly appreciate all of the help you've given me.  Cindy


  • 41.  RE: Can't reimage or extract files from ghost image - help

    Posted Dec 01, 2007 02:05 PM
    @Nigel
    Hi Nigel,
    I received the message "error 10008" when trying to restore from a .GHO image.
    I have a Compaq Presario P1700T with XP Home and Ghost 2003 (v2003.793).
    The image that I have is 1.7GB. There are no spanned (.GHS) files only one .GHO file.
    I use an external drive connected via FireWire to my notebook (notebook does not have USB 2.0). I boot-up from a Ghost created floppy disk and it works fine with other images.
    I tried your tool anyways and now I get an error message "10040" when using the "Check Integrity" of image.
    When trying to restore I now get an error message "651".
    When using Ghost Explorer I now get a window prompt asking me to "Please select the file for the last segment in this image".
    This image is the original install of XP Home on this notebook and I really need to restore it.
    Any suggestions?
    Your help will be greatly appreciated!
    Thanks,
    Sergio.


    Message Edited by SM339 on 12-01-2007 11:05 AM


  • 42.  RE: Can't reimage or extract files from ghost image - help

    Posted Dec 02, 2007 05:16 PM
    If there aren't any spans at all, then the original error 10008 - which says that the image is incomplete - is correct, and the image really is incomplete. The tools that adjust the "spanned" and "CD" bits are really only for multi-span cases where the image pretty much is complete (except perhaps for a small amount of damage at the very end).

    Error 10040 is basically the same problem as 10008; by using the tool to force the "CD-mode" bit on, you have forced Ghost to assume that the image is spanned, but it isn't happy because there isn't an additional span to go to.

    So, the image really is missing a lot of the data, and is incomplete - some of the data will be gone.

    The simplest next step is to use Ghost to restore the image to a spare hard drive (ideally with the -ntexact switch, if there are NTFS volumes) and then use chkdsk to try and repair the damage to the restored volumes that results from the image being incomplete. That should let you recover what is recoverable from the image.


  • 43.  RE: Can't reimage or extract files from ghost image - help

    Posted Dec 03, 2007 06:51 PM
    Hi Nigel,
    Thank you for the reply.
    Indeed the volumes are NTFS.
    I tried the -ntexact switch you suggested in the following syntax:
    ghost.exe(space)-clone,mode=restore,src=e:\savedimage.gho,dst=1-ntexact
    and I received the following message prompt: "Norton Ghost needs to open an image span" and then prompts for the "name of portion 2 of image". At that point my options are "OK", "Cancel" or "Browse". Since there is no image span, my only option is to cancel. That's when I receive the message "Unable to locate next span".
    The image restoration proceeds up to 93% done and it stops and that's when I receive the message prompts.
    I realized that I may have made a mistake in the command so I tried the following:
    ghost.exe(space)-clone,mode=restore,src=e:\savedimage.gho,dst=1(space)-ntexact
    That's when I received the following message: "Invalid switch ntexact"
    The difference between the two command lines is the space between "dst=1" and "-ntexact"
    Isn't "-ntexact" a Ghost 8 command and not a Ghost 2003.793 command?
    I really do not know what to do at this juncture.
    What is the proper syntax?
    I would really appreciate any help you may provide.
    Thank you,
    Sergio.


  • 44.  RE: Can't reimage or extract files from ghost image - help

    Posted Jun 17, 2008 10:26 AM
    Success at last, here is what I did.
     
    Okay so I tried yesterday to make everything happen based on what was said on this board, and thank you so much Nigel for posting those tools, they really helped me get started.  I am going to start off with my scenario so you can decide if it will help you, then give the steps I used in having a succesful recovery of my data.
     
    Before we work on one of our users computers that is having hard drive issues we always create a ghost image to an external USB drive just in case in dies, we know we have everything.  In this scenario, our technician needed to format the drive to get the apps working again, and well he forgot to back up all of the personal data we needed.  I tried going to Ghost explorer, no luck.  I tried burning the image and got the error 1008.  The reality is I didn't need to completely restore the entire drive, I just need pieces of data off.  So here was my solution.
     
    1.  Downloaded ghofixup.exe that Nigel posted.  I ran ghofixup.exe imagename.gho span
     
    This added the spanning image that I needed to the end of the file. 
     
    2.  I then used the ghost utility to put the image onto an external usb hard drive that I had.  At the end of the write I got an error message, just as it completed.  I tried using the fix -ntexact swith, however my ntfs tables were so screwed I don't think it mattered.
     
    The reason I did not go to an internal hard drive (which I tried) is because I kept finding that the NTFS table it tried to write to was so corrupt that the system couldn't see it.  By going to a USB external I could still make out that it was there.  Also note in my scenario chkdsk didn't work, I tried it but to no prevail.
     
    3.  I had a copy of minipe on me, which you can get from minipe.org and found a utility on there called GetDataBack for NTFS which is designed to restore corrupted NTFS tables, which is what I realized I had.  Minipe is an awesome utility however you can download GDB for NTFS directly from runtime.org. 
     
    The nice thing about the trial version is it can run against your volumes and disks, show you what it could bring back to life before you pay the $60.00 to actually copy your data back. 
     
    4.  I then just copied my data back and life was good.
     
    I am not big into data recovery and I just got into a pinch, maybe this will work for you, maybe it won't.  But yesterday everything I was reading sort of left me at dead ends.  I owe a large debt of gratitude to Nigel for his post.   I hope this might help out some others in the future.
     
     
     


    Message Edited by hawk333w on 06-17-2008 07:34 AM

    Message Edited by hawk333w on 06-17-2008 07:34 AM


  • 45.  RE: Can't reimage or extract files from ghost image - help

    Posted Jun 17, 2008 10:26 AM
    Success at last, here is what I did.
     
    Okay so I tried yesterday to make everything happen based on what was said on this board, and thank you so much Nigel for posting those tools, they really helped me get started.  I am going to start off with my scenario so you can decide if it will help you, then give the steps I used in having a succesful recovery of my data.
     
    Before we work on one of our users computers that is having hard drive issues we always create a ghost image to an external USB drive just in case in dies, we know we have everything.  In this scenario, our technician needed to format the drive to get the apps working again, and well he forgot to back up all of the personal data we needed.  I tried going to Ghost explorer, no luck.  I tried burning the image and got the error 1008.  The reality is I didn't need to completely restore the entire drive, I just need pieces of data off.  So here was my solution.
     
    1.  Downloaded ghofixup.exe that Nigel posted.  I ran ghofixup.exe imagename.gho span
     
    This
     


  • 46.  RE: Can't reimage or extract files from ghost image - help

    Posted Jun 27, 2008 10:53 PM

    I am having extreme difficulities with extracting a ghost image.... it has 15 spanned along with the .gho file.  I have lost all my data from my machine, it give me cant open span 11 error.....  I have performed a check image integrity and it checks fine.... I need help.. can anyone help me?



  • 47.  RE: Can't reimage or extract files from ghost image - help

    Posted Jun 28, 2008 01:59 PM

    @scsaperez 

     

    In order for people to help you, you need to provide more info, such as error number, version of SW used etc...etc...etc...

    Venga ya tio...

    Message Edited by SM339 on 06-28-2008 11:00 AM
    Message Edited by SM339 on 06-28-2008 11:01 AM


  • 48.  RE: Can't reimage or extract files from ghost image - help

    Posted Jul 09, 2008 10:23 PM

    Hi there,

     

    Sorry about continuing this already-long thread, but there seems to be a wealth of knowledgable people here!

     

    I have a backup that my IT department from my last company made for me.  It spans 15 volumes (filename.gho, and filename1.ghs thru filename14.ghs), and the version of Ghost Explorer that they gave me was 8.0.0.984.

     

    The issue I'm having is the following:

     

    - I copy all the files to a single directory on my hard drive

    - I use Ghost Explorer to open the filename.gho image.  It asks me if I want to mount the images, since it will take an excessive amount of disk swapping otherwise.

    - The image opens just fine, and displays ALL files in the image

    - When I go to extract the entire image... the extraction process just simply STOPS 2/3 of the way thru (I have about 30GB of data, and it stops at about 21GB).

    - The Ghost Explorer status bar states "Complete".

    - I have tried this multiple times, with the same result.

    - Yes, I am making sure I am highlighting the top of the volume before extracting to make sure I am trying to extract the entirety of the contents

    - Where it "fails" (i.e. stops extracting) is somewhere in the middle within C:\Documents and Settings\USER\My Documents

    - It does NOT complete the extraction of "My Documents"

    - It does NOT complete the extraction of any user's directories beneath (i.e. after in the alphabet) C:\Documents and Settings\USER

    - It does NOT complete the extraction of any sibling directories beneath (i.e. after in the alphabet) C:\Documents and Settings

     

    It is obviously just stopping mid-operation, and I can't figure out why.  I've even tried going to the top of the volume, highlighting all the contents in the window, and extracting that... and it still gets the same result.

     

    Any help would be appreciated!

     

    Thanks,

    mattchoo 



  • 49.  RE: Can't reimage or extract files from ghost image - help

    Posted Jul 09, 2008 11:05 PM
    Debugging internal problems in versions of the code that are over 4 years old is extremely difficult. First though, it's often useful to check whether the image is damaged or not. If you have 8.x or later then the 32-bit Windows version of Ghost can do an integrity check on the image from within Windows and that is the gold standard as to whether the image is fine, or whether it is corrupt.

    From what you describe, I would suspect the image you have is corrupt, and that Explorer is not presenting the data from that point in the image because it has hit some corrupted data and prior to GSS2.5 the Explorer code generally abandons its attempt to expand the image data at the first sign of trouble, and none of the command-line switches really dealt with that (don't bother trying them).

    Either way, the best approach with Explorer is to try opening the image with a newer version, since genuine (i.e, not "Norton Ghost" 9 or later, which is a completely unrelated product) Ghost and the associated toolchain is backward compatible to a pretty extreme degree and that's the tool that we want to make the primary one for recovering data from damaged images, and in GSS2.5 Explorer tries much harder to extract data from damaged images.

    If you're not a customer of the current version though, pretty much the only way to get at the current version is via either the current trial edition of the full GSS product, since Explorer it's part of GSS and like most things related to Ghost it's licensed code rather than freeware (it'd be nice to have a more readily available edition of the newer Explorer, particularly for customers with truly ancient versions of Ghost, but although I raise this from time to time thus far I haven't got much traction with management on that).

    If you try that, it'll at least have a MUCH better chance of working through your image than any earlier version will do, and if it doesn't work opening a corrupted image then I can generally try and do something about it.

    Now, if the corruption in the image affects enough of it - for instance, the corruption is in a directory structure - the GSS2.5 version of Explorer can't load that directory. If produces a pop-up telling you that the image is corrupt, that means it's absolutely tried everything it can, and whatever it shows you is all it could recover.

    [ I just yesterday made one improvement to the Explorer code since 11.5.0.2113 since a customer reported that it couldn't completely open his corrupt image, but I'm not yet certain quite whether that will be in the next LiveUpdate we make to GSS2.5 or whether I'll be able to make it available as a standalone download somehow. ]


  • 50.  RE: Can't reimage or extract files from ghost image - help

    Posted Nov 19, 2008 09:44 AM
    Hello TimdueMo, This is a old thread, started well over a year old, now with five pages of posts. The original topic was in regards to spanned images not able to be restored or opened from Ghost Explorer. Nigel Bree provided workarounds on this issue on page 2. Although you've encountered the same error message, your issue sounds different as your image is not spanned, can be opened in Ghost Explorer and is specific when restoring the image from the two Passport HDs. I'll move your post to create a new thread. If there are relevant issues in this thread please add a link to this thread specifying the points. Thank you, GSS Taniwha


  • 51.  RE: Can't reimage or extract files from ghost image - help

    Posted Nov 19, 2008 04:43 PM

    Locking this thread to due size and age. If you encounter this issue and the workarounds provided are not working, please create a new thread with a link to this one.

     

    Thank you,

    GSS Taniwha



  • 52.  RE: Can't reimage or extract files from ghost image - help

    Posted Mar 22, 2010 02:27 AM
    I have a similar issue.  I ran a GHOST image using 11.5 on a failing drive.  This version does the image in one file rather than smaller blocks (kinda nice, I guess).  However, the drive actually crapped out about 3/4 of the way through the image.  For the life of me, can't get it to spin up one more time.  Is there any way to get the 42GB of GHOST image that I DO have to come up so I can extract at least a portion of whatever is there???

    Much appreciated for any help.