Norton Ghost Conundrum

[Migration User]

Hi Everyone;

My friend Joe is in a real pickle; it's a sad story. His company mandated that if he used his personal laptop in his office, it must be encrypted. A  technician (some external contractor) came and encrypted his entire hard drive. Before he did the encryption, he did a "backup" - which  generated a very large file on an external USB drive. The file has a .gho file extension and was created in September 2010.

Last November, Joe's hard drive failed with a hard crash. The system would not reboot, the decryption boot CD could not read the disk, so nothing was recoverable. I rebuilt Toshiba laptop with a new hard drive and original Windows XP media, but he has critical data that is in that .gho image that he is desperate to recover. The technician who did the encryption/imaging has since disappeared, and neither Joe (nor anyone in his company) has any idea of what software was used to create this image.

I've tried the Norton Ghost recovery CD, but the .gho file extension was not recognized. 

I tried Norton Ghost Explorer (version 2003). It recognizes the .gho extension, but it cannot open the file - it gives the "Invalid Drive specifications - this is probably not a Ghost Image file" error.

I suspect now that the file must have been created from some version of Ghost Solutions - but am unable to figure out if this software (or its trial version) could be used to extract and restore files from the .gho image.  I don't need any enterprise imaging software, I just need something that can extract a few files/folders from the image.

Please, any ideas?

Thanks, 

Curious-Linda

[Migration User]

There was a .txt file on the drive that had this content:

 

Date   : Wed Sep 29 17:03:11 2010

Error Number: (470)

Message: Image file is on drive being imaged

Version: 11.0.1.1533 (Apr 19 2007, Build=1533)

OS Version: Professional  (Build 3790)

Command line arguments: -clone,mode=create,src=2,dst=d:\613_robert_ -sure -fx -BATCH -Afile=D:\err.txt

Active Switches :

       AutoName

[Edward Tippelt]

Can I refer you to the top posting in this forum which provides links to the Norton Ghost community. They may be able to give you more relevant guidance than this forum which supports Ghost Solution Suite, based on different technology to the retail Norton Ghost product.

You may need to source a current version of the Norton Ghost (V15?) retail product (not sure if an eval is available for this) to be able to view and extract the contents of the GHO file.  The GHO file extension is definitely created by a version of Ghost though.

I trust you have also educated your friend Joe about making regular backups of data on his laptop, as hard disk failures can occur anytime, and where encryption is used, the chances of recovery being possible are that much smaller.

 

[Migration User]

Thanks for the reply. 

I am now 99% sure that the software that created the image was Ghost Solution Suite 2. The exact version / build numbers and dates - April 19, 2007 from the err.txt file match up with  postings regarding Ghostcast in the forum.  

I suppose I could buy a commercial version of the software, but it is only sold in 5-packs and I only need it for a once-off use.  From what I've read, the trialware version will not be able to extract files from an image unless the image were created by the same trialware version. That's a dead end.

And, sigh, I've lectured him for over 20 years on the importance of making backups, and I even have shown him how to do it on more than one occasion, but it never sunk in. If I had known ahead of time that he was going to have some technician encrypt his entire C:-drive, I would have confiscated the laptop immediately and made a backup for him!

[Edward Tippelt]

Yes, you are correct that this is a Ghost Solution Suite version. I was creating my original reply while you were updating your thread so did not see it in time.

Quote Joe for the cost of buying the appropriate license(s) for data recovery,  to make it sink home how his delinquency on the backup front will impact his wallet.

Meanwhile, if you can indicate where you are located, and maybe offer a few beers as a bribe, someone in these forums local to you might be willing to take your GHO file and do some extracting for you.

What size is your GHO file, and are there any GHS files with it ?  Ghost normally splits a backup into 2Gb files - only the first has the GHO extension; additional files have the GHS file extension. You would need the entire set to ensure that your data can be reliably recovered.

[Migration User]

Oh, beers would be good! I'm in Houston, Tx, and sure that there might be some folks around that  would take pity and beers and help out. BTW, his IT service manager advised him to take it all to Best Buy service - but that was a dead end, too. 

Besides the err.txt file, there is only one file - 15,187, 107 KB in size. (14.4 GB)

 

Thanks mucho!

[Edward Tippelt]

Is there anything in the err.txt file?

One other thing that might be worth exploring - look for Symantec partners in Texas that handle the Ghost product. You might be able to charm them into offering some help!

[Migration User]

I copied the entire contents of the err.txt file in the post above titled "addendum".

I have lots of questions, being unfamiliar with the product....

= Is it normal for an image file to be one monolithic 15GB file with a .gho extension?

= Is there a recovery boot CD that could be used?  (The file system imaged was Windows XP; NTFS)  

= Can the recovery CD only be used to re-image of the hard drive, or can individual files/folders be extracted?  If not, could I re-image to a second USB drive, and get at the data files after the re-image was completed?

= Do I have to create a clean partition on the target drive?

Weeks ago, I did download the .iso recovery CD, but that was for the Norton Ghost home product;  the recovery disk that was created did not recognize the .gho file type. I since found that the products are entirely different. 

 

Thanks so much!

[Edward Tippelt]

Hmm - I've never attempted imaging a drive back to the same drive, as I did not think it was possible to create an image file on the drive you were imaging. However, something was created and hopefully a method of recovering the information from the GHO file will be found.

Yes, it is possible for a single 15Gb file to be created. Ghost has been around for over 15 years, and ran under DOS in its original form. Thus images were limited to 2Gb "chunks" because that was the largest file that PCDOS and the FAT file system could handle.

If you boot to WinPE, which supports NTFS file systems and run Ghost from an NTFS device such as a USB hard disk, it can generate single large image files.

Ghost Solution Suite includes a utility called Ghost Explorer which opens a GHO file in the same way as Winzip opens a ZIP file, and so you are able to extract files from a GHO without restoring the whole image.

If you google around, you could try some of the options suggested eg here:

http://www.softwaretipsandtricks.com/forum/software-problems-useful-utilities/35101-reading-gho-files.html

There is a possible route using VMWare converter to convert the GHO image to a Virtual Machine which you can then run on VMWare Workstation. It is not entirely clear if this functionality works with both Norton Ghost and GSS files but no doubt you could research this a bit more if you have the time.  From what I recall, VMWare can be trialed for 30 days for free, but I am unsure if this trail extends to the converter tool - again no doubt you can quickly find this out.

However, as there is no evidence that the original GHO file was tested to check if it was a valid backup, given that it was generated on the same drive that was being backed up, I would suggest not rushing to spend any money on tools unless all other avenues have been exhausted.

[Migration User]

Oh so sorry, I was not clear.  

The .gho file is on a WD Elements USB drive.

I meant to reimage  from the USB attached-drive back to the internal drive (C:) on the Toshiba laptop.  I have replaced the crashed original hard drive with a larger one and reinstalled Windows XP, drivers, and a whole bunch of application software, virus scanner, etc. etc. etc.

So I'd prefer just to extract selected data files from the image rather than the whole caboodle.

And you are right, I'd rather not spend any $$$, when I'm not confident that the image is actually intact!

Jeez, what a mess!

[Migration User]

There is finally a happy ending.  

Back in September, the technician who had done the encryption had left behind a copy of a backup/restore CD - it was suddenly discovered somewhere in the office. Joe brought me the CD - it had a WINPE iso image with the DOS Ghost executables, including Ghost Explorer. Miracle of miracles, the .GHO image file was intact, and I managed to use the Ghost explorer to extract his documents, and precious database. 

Sweet dreams tonight.....

Thanks for everyone for the help and moral support.