Can't reimage or extract files from ghost image - help

[Migration User]

A year and a half ago, I used Ghost to create an image file of a computer, and it created 1 GHO file (Zombie.GHO - 2,097,147 KB) and 4 GHS files (ZOMB1001.GHS - 2,097,147 KB, ZOMB1002.GHS - 2,097,139 KB, ZOMB1003.GHS - 2,097,133 KB and ZOMB1004.GHS - 655,282 KB).

Well, some knuckle head deleted a who bunch of critical files; however, very little had changed since I did the Ghost. So I attempt to recover by just re-imaging the computer. I booted form a DOS disk, mapped the drive on the network with the image files and began to re-image. Once it got to 19% (2306 MB), it would give me an error - Unexpected end of file. Well, I got on a chat line with Symantec support, and they were no help at all. They left me by telling that I could extract the files I needed by using Ghost Explorer.

Well, when I go into it, it doesn't show my GHO file as a recovery point, so I have to go to Advanced Open to see it. I select it and then it asks me for the final GHS file in the sequence, and when I select it, it keeps asking me for it again and again and again..... So I get onto Symantec's online chat, and they can't figure it out either.

So does anybody have a clue how I can get these files, or is there a company I can pay to extract them?

Thanks,
Peter

[Migration User]

And I'll PayPal a cash reward to anyone who can help me solve this.

[Migration User]

Hmm. Error 10008, yes? And what particular version of Ghost are you using?

From my reading of the source code and the circumstances in which it generates this error, it seems to be that when Ghost is encountering the end of the first span of the image, it's deciding that spanning is disabled rather than going on to the subsequent span files.

When you start Ghost, use the "Options" menu item and check to see whether "Spanning" is ticked (it should be the first item in the first options tab). If it's not ticked, enable it (or equivalently, use "-span" on the command line when first invoking Ghost).

[Migration User]

I created the original image using Ghost 2003 after booting to DOS and runing Ghost.exe.

I have purchased Ghost 10, so I could use either.

Ideally, I'd like to do a total restore of the machine. Extracting was my secondary route.

Thank you very much. I'll let you know the outcome, but I'm very optimistic since you knew it was a 10008 error.

[Migration User]

Have verified the integrity of the ghost files to make sure they are ok?

[Migration User]

The Enable Span was checked.

I did a copy with verify, which was successful, but I don't know if that is the best way to check it. When I use Norton to verify, it gives me the same error as when I try to reimage from it.

[Migration User]

Pl clarify. Did the ghost program you used to create verify the imagefile ok or it also gave the same error?

[Migration User]

When I ran Ghost and created the original image, I didn't receive any errors at all. I never manually did a integrity check afterwards.

And I meant to say earlier, that from DOS I did a copy with the verify and it copied fine, but when I have Ghost do an intergrity check it gives me that same Uneexpected End Of File error.

[Migration User]

Obviously there is a problem within the Ghost image file. From a DOS point of view the files are ok.

You will need help from one of the developers with Symantec who knows the innards of the ghost image file. I highly doubt anyone outside of Symantec will be able to figure it out since very few outside have knowledge about the innards of the image file. You will soon hear from someone on this list.

[Migration User]

As it goes through the first 2 GB, it shows the files it is extracting. Does anyone make a program to directly extract from GHO and GHS files? Apparently Symantec does not.

[Migration User]

Did you try to open the image file with Ghostexplorer? If so, did the open work ok?

[Migration User]

Yes, I did try that and it failed.

I would have to use Advanced Open, and it would see the GHO file and start to load it, and then it asks for the final GHS file in the series. I'd point to it, and say OK, and it would immediately and continually ask for it again and again and again...

[Migration User]

Only a developer from Symantec NZ can help you. I am confident they will.

Current NZ time is 2.45AM. So will have to wait for about 6 hours before one their developers will see the msgs.

[Migration User]

Anybody? Anyone?

[Migration User]

> I created the original image using Ghost 2003 after booting to DOS and runing Ghost.exe.

Thanks; do you happen to recall whether you put the image on a local hard disk, or used a mapped network drive instead?

Unfortunately, the lead developer of the cloning engine was home sick today so I couldn't consult with him on this, because spanning is one of the more gnarly areas of Ghost. I've pulled the Ghost 2003 source code from the archives to get more familiar with how the process worked in the edition you have, but take this with a grain of salt since this is not the code that is my primary responsibility.

Anyway, it turns out that when restoring from a dumpfile, the flag that controls whether Ghost understands spanning comes from the header of the image file rather than from the normal settings. Now, when the .GHO file is written, it assumes that it won't span, and what is supposed to happen when it does end up spanning is that the header is adjusted to indicate that it did end up spanning.

My conjecture, therefore, is that somehow this adjustment to set the "spanned" flag might have gone missing somehow; if this one byte in the image header isn't set right, Ghost won't even try to look for a subsequent span and will instead complain with this error.

In order to be sure, I'd need to have a look at the first section of the first span (i.e., the .GHO file). The way these files are laid out is that the first 512 bytes of every span contains a header that describes what it is. If it's the first span, the next 2048 bytes are another header that describes the contents, and it's this section that contains the "spanned image" marker. So, the first 2560 bytes (0xA00 in hex) are the critical part, and from that I should be able to work out if my theory is right.

I don't think I'll need the raw file data, just a dump; in case you don't have a tool to do this, I've adapted a little VBscript from here http://www.interclasse.com/scripts/dumphexafile.php - you can get from http://nigel.bree.googlepages.com/hex.txt and if you save it as a .vbs file it'll dump the relevant part of an image file out into notepad.

You can e-mail me the dump at nigel dot bree at gmail dot com, and hopefully from that we can work out if my conjecture as to the cause is correct.

[Migration User]

Nigel,

That file is on its way.

Thank you so much,
Peter