I had a laptop that needed to get in the mail immediately to be serviced. (Dead NVidia chip.)  The manufacturer routinely wipes out the partitions during servicing.  I backed up both of the harddrives using the Ghost32.exe from a thumb drive while booting off of a PE disk to a new, fresh out of the bag, IDE drive attached externally via USB.

When I created the image for D-drive I forgot to turn span off and so it spanned the image in 2GB sections (a GHO and 42 GHSs), no big deal.  I turned off spanning when I next imaged C-drive.  I verified both images and they both passed verification. (Used high compression on both images.)

I sent the laptop out and got it back.

C-drive restored without a hitch, D-drive appears to be toast.

I have gotten D-drive's image to open one time, by some fluke I have been unable to repeat - I did not knowing do anything special/different.  When this occurred I was able to pull out 4.5GBs of data before GhostExplorer crashed.

When GhostExplorer crashed two things changed:
1) The 42nd GHS file is now zero bytes long!
2) No matter which Ghost application I open, no matter which switch(es) I use, I am immediately prompted for the last span file - which is, of course, zero bytes long and useless!

I have tested the drive there has been no indication of any error - Hardware, Partition, MFT, clusters, etc.  But the missing data is most assuredly lost.  There are no lost clusters or deleted files on the drive.

Even when using GhostExplorer with the -corrupt and -ignoreindex switches I am still prompted immediately for the last span.

I am confident that I have lost something, but it should be possible to recover the rest.  I really need to know how to do it.

I know how important backups are, and when the laptop is in house they occur regularly, but the laptop was offsite for an extended period and the user did not follow procedure.

Typically the user would be at fault, but since I announced that a successful image was made all eyes are now on me.

HELP!  please.

NightOwl wrote on Nov 18^th, 2008 at 1:54am:

Originally Explorer couldn't do much, but I've been slowly making it better as I can. Over the last couple years a few customers have submitted images with less severe damage (media corruption, missing interior spans, and such like) to me to analyse and recover, and I've built out Explorer to work with those. However, the nature of the image format for NTFS filesystems is extremely awkward to work with, and for now doesn't really permit recovery of any individual files via Explorer without the initial .GHO and the trailing index (i.e, the last span) being present and mostly correct; that's a limitation that the cloning engine lead and I do eventually hope to fix, but it is not simple and we both have a LOT of other stuff to do on GSS3.0 before either of us can begin to look seriously at that work.

That's what the current versions of Explorer can do; if the last span is damaged, since Ghost itself works by processing the image file strictly from front to back in order, the best bet for trying to recover something from it is to restore the image using Ghost and then see whether you can recover anything from the disk using chkdsk afterwards.

I have read other responses which describe the difference between GhostExplorer and ghost like you have here, Nigel Bree.

However, I also saw (and please correct me if my information is wrong) that if you use the -ignoreindex switch that Explorer should prefer the MFT over the index and that the -corrupt switch is suposed to tell Explorer to read the files sequentially, from beginning to end.

These switches do not seem to have any effect regarding the error I seem to be dealing with.  Ghost is doing the same thing as Explorer, just with its own dialogs - but the result is the same.

Are there any switches in Ghost which would encourage it to do something similar to what is expected of the -ignoreimage -corrupt combination in Explorer?

I am trying to do what you described - use Ghost to get what I can by processing the image from beginning to end, but it will not.

I even tried GhostSrv, it can tell me that the image contains one primary partition and gives the correct size.  When I attach a client with a drive large enough and server begins to send the image the client immediately asks for the last span.

Very aggravating.




To answer you question NightOwl;
As I understand it there are two Nvidia chips in the laptop.  One is the chipset the other is the Video.  You need only search in the search engine of your choice to see that Nvidia has run into problems with their Video chip.  It is affecting Dell, HP and Apple primarily.

It seems the chip was designed to stay at rather consistent temperatures - good idea for a desktop PC (generally), but bad for a laptop.

Every 6~8 months the Nvidia Video controller dies.  When this happens I can access the machine by booting a PE or other Live CD, using standard VGA (640x480, 16 colors) and an external monitor connected to the secondary display port.

It is hideous but does allow me to do such things as create backups.  (Which I have done two times previously, with none of the problems I encountered this time. (Those backups were smaller and for a different user, so they do not apply to the current dilemma.))

By the way, the last time this machine was sent in is the last time it will be sent in. When the chip dies next time this laptop becomes spare parts.  I was given assurances that the issue was solved by HP's second tier support.  It was stated, "The problem has been resolved, we no longer use that motherboard."  

When the LapTop was returned to us I looked it over and it is using the same BIOS as when it arrived last time (which is out of date), the same drivers, etc.  It shows no signs of being an "improved" MB.  In fact, Nvidia's GPU identifier identifies the GPU with results that are identical to when the machine was returned to us the last time.  I updated the BIOS last time so I am somewhat confident that the MB was replaced, but my fear is that it was an off the shelf part and not some part that has been redesigned to address the flaw.

Since the LapTops return the Tech I spoke with will no longer take/return my calls and e-mails.

When I returned it I was tempted to remove the drives but HP, for some reason, seems quite adamant that the drives are returned with the laptop.  They do not want the battery, power cord, etc. but they do want the drives.

 GhostBeGone

Quote:

Well, that could explain the strange behavior--could you offer a reference regarding the *CD switch*--I've not seen anything about that before that I can remember.

 Nigel Bree

Thanks for the explanation.

Quote:


You seem to imply that the image file was accessed and attempted edits are the reason that the image file can not be restored.  

GhostBeGone said this:

Quote:


GhostBeGone does not indicate that he did any edits to it with Ghost Explorer--only that he had extracted 4.5 GBs of data--and then Ghost Explorer crashed.  

So...GhostBeGone...what's the story here?  Did you attempt to re-compile the multiple spans into a single Ghost file?  What might you have done *un-knowingly*?

Nigel--any reason why a Ghost Explorer crash would corrupt that last file just because it was accessed and mounted in Ghost Explorer--or did something else have to have occurred?

Nigel Bree said:
Quote:


This is an interesting hypothesis. What would cause this to occur?  As I originally stated my problems began with my first attempt to retrieve data from the image, even though the image did originally pass verification.  Out of frustration I tried to open the file multiple times.  In doing so I tried different PCs, I tried attaching the drive to the IDE bus in a Desktop machine, whatever I could think of.

One time and one time only it opened like nothing was ever wrong.  I immediately started to copy everything out and during the copy process Explorer crashed.  It was after this crash that I noticed the 42nd span was zero bytes long. Nothing I have tried has worked since.

My question, I guess, is that all I have been trying to do is get the data out of the image, so are the edits you mentioned something that is part of that process or are they user driven only?

NightOwl has hinted at something intriguing - is it possible to binary copy the GHO and the GHSs into a single image?  I imagine this will just create one big corrupt file instead of several smaller ones, but Nigel, you would know better than I.

Any suggestions?

GhostBeGone wrote on Nov 19^th, 2008 at 10:55am:

No. Explorer is designed to always open image files read/only except when explicitly directed otherwise.

GhostBeGone wrote on Nov 19^th, 2008 at 10:55am:

Not via binary copying, no. Re-segmenting images is what the "Compile" option in Explorer is for, since it has to adjust some important pieces of internal structure in the process.

 GhostBeGone

Quote:

The *compile* option would only work in Ghost Explorer if you are able to mount the image file set--and that's what you have been saying you can not do--sorry, it's a *no go*!