Not a Ghost Image File???

[Migration User]

When i attempt to open an image file I get an error message "Not a Ghost image file".  I used to be able to open this image file.  I also get an error "standard.gho is not a valid image file" when i try to use the GhostCast server.  Is there a way to make this back into a valid image file?  I haven't moved the image or anything to my knowledge.  It just stopped working.  My image consists of a standard.gho, stand001.ghs and stand002.ghs files.  Can someone give me some direction?

[Migration User]

There's some information on the basic structure of the image file data in this thread. Basically, to diagnose the problem we need to go through the same basic process to check that the right things are there at the start of the image.

So, you can download this script file to get a hex dump of various files (download it as .txt so you can inspect it before running it, and rename it to a .vbs file to run it).

It would be nice to take a look at both the first file in the set (the initial .GHO) and the last span, so we can check them. You can eyeball the hex dumps yourself to see whether the initial signature is there or not, but to fully analyse the first span I need to run the data through some tools we have here at Ghost HQ, so you're welcome to send the hex dumps to me at nigel dot bree at gmail dot com

[Migration User]

Hi! Nigel
I have an image made in 2004-06-16 with Ghost 2003  (2003.775).
It it stored directly to CD-R into 3 dics.
Disc 1: CDR00001.GHO   717 120 kb 
Disc 2: CDR00002.GHO   718 560 kb
Disc 2: CDR00002.GHO   255 992 kb
when trying to open disc 1 is says not a valid image file (518)
and the 2:nd and 3:de disc not the first one in the set (1972).
I used Your script and made hex dumps and there is nothing in the header of first span.
You mention in Your comment above about some tools at Ghost HQ.
Would this tools be able to fix the header. Or if You have some input to where to get help with this.
I attach the hexdump of the 3  discs. Have some more images wih the same problem.

Best regards

ForestMan

 

Attachment(s)

CDR00001HEXdump.txt   11 KB 1 version

CDR00002HEXdump.txt   11 KB 1 version

CDR00003HEXdump.txt   11 KB 1 version

[Migration User]

Essentially, if the hex dump of the CDR00001.GHO file shows all zeroes as the above attachment does, then some external influence must have caused that part of the image file to be erased. There are all kinds kinds of potential causes for this to happen over time as data goes through generations of media - media failure, faulty network drivers, malware - but if  the only evidence is a sea of zeroes, it's not usually possible to determine the precise root cause after the fact.

In general, if the first span of the image is completely erased like this it's not possible to recover; there is too much critical information that is gone and which is not replicated elsewhere. The version of Ghost Explorer included in the current Ghost Solution Suite product has been enhanced to deal with various different kinds of image damage, but the first span being completely erased like this is not something it can work around.

Your best bet is to go back as many generations as possible, to the oldest media set you have with this image on it and see if you can recover a working initial span which has not been affected by whatever process has caused the large-scale data erasure shown in the dumps above. Without an intact first span we probably can't recover this for you.

[Migration User]

Nigel - Could I send you my hex information? I have a similar situation. Except  when the image process was sent through it didn't create seperate image files like it normally does.  So i have a 34GB file which I need to recover data out of. Is there any possible way you can assist.

Thank you for your time.

Rob

Attachment(s)

radB7653.tmp_.txt   11 KB 1 version

[Migration User]

Unfortunately your data in the dump above is not remotely similar to a Ghost image; the beginning of the file should look like this example. As in that other thread, it appears that your image data has been overwritten, and as such it's unlikely that anything could be recovered from it.