Welcome, Guest. Please Login
 
  HomeHelpSearchLogin FAQ Radified Ghost.Classic Ghost.New Bootable CD Blog  
 
Pages: 1 2 
Send Topic Print
Classic Ghost fact-checking session: anyone bored enough to join in? (Read 23363 times)
pishposh
Dude
*
Offline


I Love Radified!

Posts: 24
Cambria, California


Back to top
Classic Ghost fact-checking session: anyone bored enough to join in?
Feb 9th, 2010 at 7:57pm
 
I hope this won't be considered bad form here, but...

I've been charged with writing a "short yet exacting" reference guide for my IT group on classic Ghost (11.5.1).

Embarrassed

Per chance, would there be any Ghost super-experts here who not only possess the superhuman power to spot even the smallest deviation from fact in an explanation of how Ghost works ... but who might also be bored enough to read my draft of said quick reference guide and alert me to all such occurrences?  I was a frequent Ghost user many years ago in the W95/DOS era, and getting my memories up to speed took plenty of reading on my own this weekend.  The result is this draft, yet surely there are going to be a few errors of fact* remaining despite my best efforts.  And I figure you folks are the gurus best suited to spot them.

Anyway, only bored/snowed in/rained out/etc. experts need apply.  And I'd appreciate it heaps.

* Based on my conversation with Brian in this thread, it appears there may already be one error in the draft - stating that partition backups can't be restored to unpartitioned drives.

The draft:
http://img716.imageshack.us/img716/4199/ghost1.gif
http://img716.imageshack.us/img716/9778/ghost2.gif
http://img42.imageshack.us/img42/889/ghost3.gif

@edit Feb 11 2009 23:30 GMT - Aftorementioned error re: restoring partition images clarified in that other thread, here.  (Not bothering to update the draft .gif links though.)
 
 
IP Logged
 

NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #1 - Feb 11th, 2010 at 11:32am
 
@
pishposh

Just read this!

I'm otherwise tied up for today--but will be glad to read through your postings later--if it's not too late!
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
pishposh
Dude
*
Offline


I Love Radified!

Posts: 24
Cambria, California


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #2 - Feb 11th, 2010 at 4:47pm
 
Not too late at all.  I'm trying to stay well ahead of deadlines.  Smiley
 
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #3 - Feb 12th, 2010 at 10:36am
 
@
pishposh

Hmmm...the .gif format you have chosen will be very difficult to work with--hard to *quote* or *copy* text to reference in a forum posting!

Regarding your *ghost1.gif*--"Ghost's Confusing Lineage", you can find a fairly accurate outline here:  Ghost (software), "General Hardware-Oriented System Transfer".

Ghost 2001, 2002 and 2003 were retail versions of Ghost.  Ghost 6.0, 7.0 and 7.5 were the Corporate versions that most closely resembled those retail versions.

Usually the next Corporate version was already released with added functionality before those functions were incorporated in the next release of the retail version--so for instance when Ghost 2003 was released--Ghost 8.0 was already released to the Corporate folks.

Ghost 2003 was the last retail version of the Classic Ghost (DOS based) program prior to Symantec switching the new consumer (i.e. retail) version of Ghost, based on PowerQuest's Drive Image version 7.  Ghost 2003 was most like Corporate Ghost 7.5, and never had the functionality introduced in Corporate Ghost 8.0.

More comments later...
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #4 - Feb 12th, 2010 at 10:46am
 
@
pishposh

Quote:
Anyway, only bored/snowed in/rained out/etc. experts need apply.

Just to be clear--I have no *official* credentials or formal training in my resume--but, I am *rained out* at this time of year  Wink !
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
pishposh
Dude
*
Offline


I Love Radified!

Posts: 24
Cambria, California


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #5 - Feb 13th, 2010 at 1:16am
 
NightOwl wrote on Feb 12th, 2010 at 10:36am:
@
pishposh

Hmmm...the .gif format you have chosen will be very difficult to work with--hard to *quote* or *copy* text to reference in a forum posting!


See if the attachment (.rtf in .zip) suits you better.  (Some formatting prettyness was lost, but it's legible.)

Quote:
Regarding your *ghost1.gif*--"Ghost's Confusing Lineage", you can find a fairly accurate outline here: Ghost (software), "General Hardware-Oriented System Transfer".

Ghost 2001, 2002 and 2003 were retail versions of Ghost.  Ghost 6.0, 7.0 and 7.5 were the Corporate versions that most closely resembled those retail versions.


Yup, the Wikipedia article was part of my homework/research.  However, the way it's written, I had a hard time telling for sure whether it meant year-numbered names ("Ghost 2003") always meant consumer and version-numbered names always meant corporate.  For example, look at how "Ghost 6.0 (Ghost 2001)" and "Ghost 7.0 / Ghost 2002" are listed.  Makes each sound like a single product with two names.  The description of 7.0/2002 even makes it sound like it was ONLY a consumer version, called "2002", and only identifiable via Help > About as 7.0.

That's why, in my draft, I settled with the roundabout approach, saying "Under Symantec, consumer and corporate versions of Ghost were released using a mixture of the software’s traditional naming and year-numbered naming."  Technically by not even making an attempt to say which versions had which names, the statement otherwise remains correct.  Wink

Quote:
Usually the next Corporate version was already released with added functionality before those functions were incorporated in the next release of the retail version--so for instance when Ghost 2003 was released--Ghost 8.0 was already released to the Corporate folks.

Ghost 2003 was the last retail version of the Classic Ghost (DOS based) program prior to Symantec switching the new consumer (i.e. retail) version of Ghost, based on PowerQuest's Drive Image version 7.  Ghost 2003 was most like Corporate Ghost 7.5, and never had the functionality introduced in Corporate Ghost 8.0.

More comments later...


Thanks.  Smiley

Quote:
Just to be clear--I have no *official* credentials or formal training in my resume--but, I am *rained out* at this time of year  Wink !


Unless someone from Symantec's ghost development team shows up, I guess we're all rather uncredentialed, aren't we?  Wink  No worries.

(Hmm, according to that Wikipedia page, Ghost development moved from its ancestral home in New Zealand to India late last year.  Guess there's little chance the new maintainers will be showing up here, in that case...)
 

gh_draft1.zip (6 KB | 437 )
 
IP Logged
 

NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #6 - Feb 18th, 2010 at 11:16am
 
@
pishposh

So, I don't know what level of detail you want to dig down to--sometimes the statements are *true* as they are--but, there are other levels of understanding!

For instance, in your first *.gif* page:

Quote:
Ghost Fundamentals Overview

Ghost offers two cloning methods: drive to drive for live cloning, and drive to image/image to drive for protracted cloning, i.e. backup and restore.  In the latter case, a .gho image file is produced.

Depends on which version of Ghost you are using!  I don't know the exact version where the change occurred (I think it was Corporate v8.3), but until the more recent versions, there was an approx. 2 GB DOS file size limit.  So, with older versions, and if your data is greater than approx. 2 GB, you don't get just a *.gho* file, but the associated spanned *.ghs* files as well.  In the more recent Corporate Ghost versions the default (I think?) is to create a single large Ghost file (.gho).

So, the above statement might be better stated as:

Quote:
In the latter case, a .gho image file, along with any associated spanned files (.ghs), is produced.

By using Ghost switches, you can force spanned files by defining a file size limit. 

Apparently, prior to Ghost v6.5, the file naming system was different and used the file extension to show the numbered spanned file sequence.  So like this:

Quote:
Filename.gho
Filename.001
Filename.002

And, you can change Ghost's file naming back to that old style by using the *-cns* switch.

Additionally, if Ghost saves an image to optical media, then all the files named by Ghost will have the *.gho* extension and not the *.ghs* after the first *.gho* file!

(See what I mean by the *devil is in the details*?!)

More to come.....
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #7 - Feb 19th, 2010 at 10:00pm
 
@
pishposh

Moving on to the next section:

Quote:
Ghost Fundamentals Overview


And the:

Quote:
To control whether a partition or disk is imaged intelligently or sector-by-sector, four imaging modes exist: Default, Image All, Image Boot, and Image Disk.

These modes can be selected from the Ghost programs interface--on the opening page there is a menu choice called *Options*, once selected, there are a number of tabbed options available--selecting the *Image/Tape* tab brings up the selection box for these modes.

Alternatively, one can select these options from the command line that loads the Ghost program:


Default mode--no added switch is used
Image Boot--use the *-ib* switch
Image All--use the *-ia* switch
Image Disk--use the *-id* switch


I personally only use the *Default* mode and the *Image Boot* mode.    I'm not real familiar with *Image All* or *Image Disk*--I've looked at them, but their descriptions have left me wondering sometimes--see later! 

I think you may have the *Image Boot* mode incorrectly described as forcing a *sector-by-sector* direct clone or image creation.  I think only *Image All* and *Image Disk* (or the *Image Raw* switch you talk about at the end of your second *gif* file) force Ghost into the *sector-by-sector* mode.


(Note--of these modes (according to the User Guide), *Image Boot* forces one to do whole disk only tasks--no *partition-to-partition* or *partition-to-image* procedures--apparently an individual partition can not be restored from an image created with *Image Boot*.  And, one would think that *Image Disk* would also have this limitation based on its description below--but, read on--it says otherwise!!!!--so which mode is correctly described and which is incorrect--*Image Boot*--or *Image Disk*????)


So, I think this is the hierarchy of ascending data inclusion modes:



Default--intelligent imaging (or direct cloning) + absolute sector 0 only of MBR tract included

Image Boot (*-ib*)--intelligent imaging (or direct cloning) + entire MBR tract (sectors 0 thru 62) included
(Whole disk only tasks?, but see below!?)

Image All (*-ia)--sector-by-sector imaging (or direct cloning) + absolute sector 0 only of MBR tract included

Image Disk (*-id)--sector-by-sector imaging (or direct cloning) + entire MBR tract (sectors 0 thru 62) included
(Whole disk only tasks?, but see below!?)




Here's where I find the User Guide descriptions of these modes hard to follow:

For the *Image Boot* (*-ib* switch):

Quote:
You cannot perform partition-to-partition or partition-to-image functions with the -ib switch.


But, you get down to the *Image Disk* (*-id* switch): 

Quote:
The image disk switch is similar to -ia (image all), but also copies the boot track, as in -ib
(image boot)
, extended partition tables, and unpartitioned space on the disk. When
looking at an image with -id, you see the unpartitioned space and extended partitions in
the list of partitions.


So, if the *Image Boot* functionality is included in the *Image Disk*--shouldn't it have the same limitations as the above *Image Boot*--i.e. preventing partition-to-partition or partition-to-image functions with the -ib switch?  The description of *Image Disk* seems to begin to confirm that......

Quote:
Use the -ia (image all) switch instead of the -id switch when copying partition-to-partition
or partition-to-image
.


But, then goes on to say:

Quote:
Use the -ia (image all) switch instead of the -id switch when copying partition-to-partition
or partition-to-image. An individual partition can be restored from an image created with -id.


By all logic--shouldn't that have been a *CAN NOT*.

That's why I sometimes say the User Guide leaves me wondering--I think I need to test the above for accuracy!!!!!

Your comments or experience????

Perhaps, the User Guide just fails to mention for *Image Boot*, that you can restore an individual partition for an image file that was created by using *Image Boot*, just as it says you can do having used *Image Disk*--again, would have to confirm which statement is correct vs which statement left out needed information!

 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
pishposh
Dude
*
Offline


I Love Radified!

Posts: 24
Cambria, California


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #8 - Feb 21st, 2010 at 8:28pm
 
NightOwl wrote on Feb 18th, 2010 at 11:16am:
@
pishposh

So, I don't know what level of detail you want to dig down to--sometimes the statements are *true* as they are--but, there are other levels of understanding!


As deep as the rabbit hole can go, preferably.  Wink

Quote:
For instance, in your first *.gif* page:

Quote:
Ghost Fundamentals Overview

Ghost offers two cloning methods: drive to drive for live cloning, and drive to image/image to drive for protracted cloning, i.e. backup and restore.  In the latter case, a .gho image file is produced.

Depends on which version of Ghost you are using!  I don't know the exact version where the change occurred (I think it was Corporate v8.3), but until the more recent versions, there was an approx. 2 GB DOS file size limit.  So, with older versions, and if your data is greater than approx. 2 GB, you don't get just a *.gho* file, but the associated spanned *.ghs* files as well.  In the more recent Corporate Ghost versions the default (I think?) is to create a single large Ghost file (.gho).

So, the above statement might be better stated as:

Quote:
In the latter case, a .gho image file, along with any associated spanned files (.ghs), is produced.


Good catch, thanks!  I'll have to add a mention of this in deed.  FYI: it isn't just older versions.  The modern versions will also produce spanned [yourfilename]###.GHS files beyond the main [yourfilename].GHO file -- if saving an image file to a FAT16/32 volume.  An image file will only be written "whole" as a single .gho file if saving it to an NTFS destination.

Quote:
Additionally, if Ghost saves an image to optical media, then all the files named by Ghost will have the *.gho* extension and not the *.ghs* after the first *.gho* file!  (See what I mean by the *devil is in the details*?!)


Whee, bad programming consistency ahoy.  So noted!

Quote:
Moving on to the next section:

Quote:
Ghost Fundamentals Overview


And the:

Quote:
To control whether a partition or disk is imaged intelligently or sector-by-sector, four imaging modes exist: Default, Image All, Image Boot, and Image Disk.

These modes can be selected from the Ghost programs interface--on the opening page there is a menu choice called *Options*, once selected, there are a number of tabbed options available--selecting the *Image/Tape* tab brings up the selection box for these modes.


That should have been stated, yeah.  Also noted.  (Nothing like failing to point out to find critical settings.)

Quote:
I personally only use the *Default* mode and the *Image Boot* mode.  I'm not real familiar with *Image All* or *Image Disk*--I've looked at them, but their descriptions have left me wondering sometimes--see later! 

I think you may have the *Image Boot* mode incorrectly described as forcing a *sector-by-sector* direct clone or image creation.  I think only *Image All* and *Image Disk* (or the *Image Raw* switch you talk about at the end of your second *gif* file) force Ghost into the *sector-by-sector* mode.


Strange, I always thought Image Boot did sector-by-sector imaging within partition(s).  Looking at the software while preparing my draft, the wording of this seemed to confirm my belief:

http://img705.imageshack.us/img705/492/55093428.png

Note how the descriptions (right) segue from Image All to Image Boot, and how Image Boot is described with "Image Boot also copies the entire boot track, including the boot sector [boot track sector 0], when creating a disk image or copying disk to disk.  Use when installed applications such as boot-time utilities use the boot track to store information."  Following the description for -ia, the -ib description's leading "also" makes -ib sound inclusive of -ia's nature.

*time passes*

Aha!  Seems we're both correct:

http://service1.symantec.com/support/on-technology.nsf/854fa02b4f5013678825731a0...

Very interesting.  "-ib" = what you said.  "-ia -ib" (i.e. BOTH on the same command line) = what I said.  (I would assume this also means "-ial -ib" is a valid combination as well.)

Good thing you caught me here.  I'd have never learned of this otherwise.  And this effectively means "-ia -ib" (together) represent an effectively unique cloning mode.  Bringing Ghost's total modes to six: default, image boot, image all, -ia -ib, image disk, and -ir.

Unfortunately, this discovery, while clarifying our asynchronous beliefs about -ib, adds a completely new and unexpected bit of confusion to my plate.  The GSS 2.5 Implementation Guide says "-ir copies the entire disk, ignoring
[at a logical level -me]
the partition table.  This is useful when a disk does not contain a partition table in the standard PC format, or you do not want partitions to be realigned to track boundaries on the destination disk.  Some operating systems may not be able to access unaligned partitions.  Partitions cannot be resized during restore and you need an identical or larger disk.
"  Which sounds easy enough to understand: -id = re-aligns partitions to CHS boundaries, while -ir = -id without that re-alignment.  Yet the article above completely contradicts that, saying that -id and -ir both re-align partitions to CHS boundaries, and that the only difference between -id and -ir is that -ir "filters extraneous or erroneous information from the boot track," which it later explains as meaning "attempt(s) to repair minor boot track problems."

CR*P!  I hate when even official documentation contradicts itself... Sad Sad Sad  This all I need.  *bites tongue*

...see next post, running out of characters... 6K ain't enough for everybody!  Wink
 
 
IP Logged
 
pishposh
Dude
*
Offline


I Love Radified!

Posts: 24
Cambria, California


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #9 - Feb 21st, 2010 at 8:29pm
 
...continued from last post...


Quote:
(Note--of these modes (according to the User Guide), *Image Boot* forces one to do whole disk only tasks--no *partition-to-partition* or *partition-to-image* procedures--apparently an individual partition can not be restored from an image created with *Image Boot*.  And, one would think that *Image Disk* would also have this limitation based on its description below--but, read on--it says otherwise!!!!--so which mode is correctly described and which is incorrect--*Image Boot*--or *Image Disk*????)


Yeah, I saw that mentioned in the documentation too, and have also been wondering why, exactly, Ghost wouldn't technically be able restore individual partition(s) from an -ib disk-to-image backup while being able to restore individual partition(s) from an -id disk-to-image backup.  Both modes capture sector-by-sector dumps of the 63/2048 (CHS/megabyte aligned) sector MBR track.  So -ib shouldn't produce an image any more lacking in partition info than an -id image!  Of course, -id captures the MBR track in full and any 63/2048 sector EBR track(s) in full, whereas -ib only captures the MBR track in full while only "interpreting" any EBR track(s)' partition info and saving only said interpretation(s).  But even that shoudln't be the reason.  Default mode also records mere "interpretations" of partition parameters from EBR(s), and yet default-mode disk-to-image backups can have individual partitions restored from them, yes?  So that tells me Ghost's "interpretations" are enough for restoring individual partition(s) from disk-to-image backups, -ib or otherwise.

Anyway, on top of all that, this new -ia -ib combination being possible raises the question of whether individual partition(s) can be restored from disk-to-image backups done in "-ia -ib" mode.  I.e., is that ability dictated as yes by the -ia in "-ia -ib" or as no by the -ib in "-ia -ib"?

Sigh.  Guess confirmation is needed whether individual partition(s) can be retored from an -ia -ib disk-to-image backup ... and just for the sake of verifying Ghost's cryptic documentation, whether individual partition(s) can in deed be restored from -id disk-to-image backups like the manual seems to claim.

Pfew.  Thanks for all your help so far.  If you've got any more, lay it on me.  This "homework" assignment of mine appears to be due Wednesday, according to Da Boss.

P.S. Looks like according to this, Norton Ghost 2003 is not 8.1 as said in my draft, but a consumerized version of 7.5.  So, that's another note-to-self for my final draft.
 
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #10 - Feb 22nd, 2010 at 11:30am
 
@
pishposh

Interesting new information!

Quote:
P.S. Looks like according to this, Norton Ghost 2003 is not 8.1 as said in my draft, but a consumerized version of 7.5.  So, that's another note-to-self for my final draft.

I tried to point that out in my reply #3 above:

Quote:
Ghost 2001, 2002 and 2003 were retail versions of Ghost.  Ghost 6.0, 7.0 and 7.5 were the Corporate versions that most closely resembled those retail versions.

Ghost 2003 was most like Corporate Ghost 7.5, and never had the functionality introduced in Corporate Ghost 8.0.

But, guess you missed that.

I like that link however:  How to determine your version of Ghost

Nice summary......

Quote:
Very interesting.  "-ib" = what you said.  "-ia -ib" (i.e. BOTH on the same command line) = what I said.

Hmmm....kind of an *undocumented* mode!  Referring back to the *Options* choices from within the Ghost program interface under the *Image/Tape* tab--the different modes are *either/or*--you can not select more than one--so that combined command line switch mode only is available from using the command line to start Ghost!

I was going to ask you if you had a reference that talks about how Ghost handles the *EBR* (Extended Boot Record) tracks--but your above referenced link, Switches: Sector copy, seems to cover that (in Symantec's usual confusing manner!).

Again, another point I don't quite get--in the User Guide and *Help* menu from the Ghost program, Symantec says that the *Image Disk* (*-id*) is the *Forensic* mode--but, in the above reference you now have:

Quote:
Question/Issue:

This document discusses the Ghost switches to use for forensic imaging or for creating raw images (sector copies) that avoid error detection problems.


Solution:

Normally, Ghost does not create an exact duplicate of a disk. Instead, Ghost recreates the partition information as needed and copies the contents of the files. Creating a copy rather than an exact duplicate reduces the time it takes to copy a disk and reduces the amount of disk space required.

Ghost uses specific switches to create more exact duplicates of the original disk. To copy the entire disk, including the entire boot track, all sectors, and unpartitioned space, and to prevent Ghost from filtering extraneous or erroneous information from the boot track, run Ghost with the -IR switch.

Seems like that's the more *Forensic* mode than *Image Disk*!

I'm going to have to spend a little more time with that Switches: Sector copy to digest what is or is not included in different modes--I need to figure out how the command line with *-ib -ia* differs from the other sector copy modes!
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 

NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #11 - Feb 24th, 2010 at 11:56am
 
@
pishposh

Quote:
If you've got any more, lay it on me.  This "homework" assignment of mine appears to be due Wednesday, according to Da Boss.

So, it looks like we have now passed your dead line--FWIW I didn't see any other issues in the information you posted.  But, I've spent a little more time reading (and re-reading  Wink ) some of the information, and thought I'd make a few more comments.....

From Switches: Sector copy:

Quote:
Normally, Ghost does not create an exact duplicate of a disk.

Comparing the source and destination after cloning

When copying a disk to another disk, a checksum of the destination disk will nearly always result in a different value than a checksum of the original disk, even when using the -IR switch. This difference is due to differences in disk geometry between the source and destination disks. Because Ghost locates the partitions on the destination disk on cylinder boundaries, the difference in disk geometry causes the partition to be located in a slightly different place than previously. Ghost adjusts partition tables accordingly, and this does not result in a loss of data. If Ghost did not locate the partitions on cylinder boundaries, it probably would not be possible to access the restored partitions other than with a disk editor.

I've seen this comment multiple times from various sources--all well and good!  But, what has always *troubled* me is this fact--if restored partitions from the image (or direct cloning from source to destination HDD) were not located on cylinder boundaries to begin with--how exactly is it that the original source HDD did not have those partitions located on cylinder boundaries?  These partition were presumable created, and were in use prior to making a Ghost image--and someone was successfully accessing the data without using a *disk editor*--why does Ghost have to adjust the restored partitions to anything other than what was used on the original source HDD from which the image was created--or used to do a direct clone to another HDD?????!

There must be some *voodoo* magic going on in the background that no one bothers to explain--source HDD can be accessed just fine (I would think this means that the partitions *are* located on the necessary cylinder boundaries), but destination HDD must have the partition aligned in some other fashion to have them start on cylinder boundaries in order to able to access data successfully--my head hurts......

*Image All* (*-ia* switch)--seems to say it *All*--but, actually this really means *sort of all*!!!!!  Well, I guess they had to name it *something*!  But, I guess it's easiest to understand what *is not* included in *Image All* vs *Image Disk*....

*Image All* does a sector-by-sector image of all partitions--but, leaves out any *unpartitioned* space--*Image Disk* would add sector-by-sector data of the unpartitioned space!  And, *Image All* includes the absolute sector 0 boot sector, but leaves out the rest of the *boot tract*.  And *Image All* leaves out any extended partition table sector-by-sector data--it just saves the needed information to *recreate* the extended partition table(s).

Quote:
When using the switches -IA and -IB on the same command line, Ghost copies the entire boot track.

So, using both *-ia* plus *-ib*, you get a sector-by-sector image of partitions (unpartitioned space is left out), and you now get the entire boot tract sector-by-sector, but all extended partition tables and tracts are left out--but the necessary information to recreate the extended partition tables is saved, or transferred if cloning directly!

*Image Disk* creates a sector-by-sector of all partitioned and unpartitioned space, the entire boot tract, and all extended partition tables and tracts.


But, what exactly is meant by *boot tract*?!

Quote:
Image Boot

Use the Image Boot switch when applications use the boot track to store information. The Image Boot switch does a sector copy of the boot track. The image file includes the master boot record, partition information, and information stored in the boot track by boot managers and other programs.

The Image Boot switch does not, by itself, do a sector copy of the disk or partition.

I think the definition of *boot tract* has changed over time!  Back when Ghost 2003 was out, along with Corporate Ghost 8.x--this meant *sectors 0 thru 63!  With the advent of WinVista (and now Win7), I think *boot tract* may mean *sectors 0 thru 2048*--or *sectors 0 thru 63*--depending on the partitioning tool used initially--someone who understands this better than I would have to clarify that!!!!  But, earlier Ghost versions prior to Vista compatibility, probably are not *sectors 0 thru 2048* boot tract aware.  Here's a reference as to when Ghost was made Vista compatible--GSS v2.5:   Ghost Solution Suite Compatibility with Windows Vista SP1, Windows XP SP3, Windows Server 2008, Windows Server 2008 R2, and Windows 7.

So, you have to be very *alert* as to what version of Ghost you are using--and how it functions, what OS is being used, and what partitioning tool was used originally if you want to avoid attempting a Ghost procedure that might *mess* thing up for you!!!!

My head still hurts.....


 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
pishposh
Dude
*
Offline


I Love Radified!

Posts: 24
Cambria, California


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #12 - Feb 28th, 2010 at 6:13am
 
NightOwl wrote on Feb 22nd, 2010 at 11:30am:
@
pishposh

Quote:
Very interesting.  "-ib" = what you said.  "-ia -ib" (i.e. BOTH on the same command line) = what I said.

Hmmm....kind of an *undocumented* mode!  Referring back to the *Options* choices from within the Ghost program interface under the *Image/Tape* tab--the different modes are *either/or*--you can not select more than one--so that combined command line switch mode only is available from using the command line to start Ghost!


Yes.  It's quite bad that the [Image/Tape] GUI interface doesn't support representation of "-ia -ib" or "-ir" for that matter.  Frankly, it's dangerous too: if one uses either "-ia -ib" or "-ir" on the command line, going into that GUI interface just shows that "Image All" is selected.  What happens if you then click [Accept]?  Do your "-ia -ib" or "-ir" command line switches, within Ghost's internal memory variables, then get wiped out and replaced with pure "-ia"?!  Again, bad.  They need to address this.

Quote:
I was going to ask you if you had a reference that talks about how Ghost handles the *EBR* (Extended Boot Record) tracks--but your above referenced link, Switches: Sector copy, seems to cover that (in Symantec's usual confusing manner!).

Again, another point I don't quite get--in the User Guide and *Help* menu from the Ghost program, Symantec says that the *Image Disk* (*-id*) is the *Forensic* mode--but, in the above reference you now have:

Quote:
Question/Issue:

This document discusses the Ghost switches to use for forensic imaging or for creating raw images (sector copies) that avoid error detection problems.

Solution:

Normally, Ghost does not create an exact duplicate of a disk. Instead, Ghost recreates the partition information as needed and copies the contents of the files. Creating a copy rather than an exact duplicate reduces the time it takes to copy a disk and reduces the amount of disk space required.

Ghost uses specific switches to create more exact duplicates of the original disk. To copy the entire disk, including the entire boot track, all sectors, and unpartitioned space, and to prevent Ghost from filtering extraneous or erroneous information from the boot track, run Ghost with the -IR switch.

Seems like that's the more *Forensic* mode than *Image Disk*!


I might be able to offer perspective on this one.  I recall reading that Ghost introduced -id in an attempt to appeal to (i.e. pick up extra sales from) law enforcement agencies, but that -id proved inadequate for court admissability (because it didn't create bitwise disk images).  So they introduced -ir, and just left -id available so as not to deprive those who did like it.  *shrug*  Anyway, in a sense then, I guess you can say -ir is their second attempt at -id.  And this would explain why they call both -id and -ir their "forensics" switches; depending on when the documentation making such claims was written, -id was the forensics switch -- OR later, -ir was.

Here's my concern though.  This new "Switches: Sector copy" document I've found implies that even -ir re-aligns partitions to cylinder boundaries (while Ghost's implementation guide says it doesn't).  I don't know which one to believe.  But if the "Switches: Sector copy" document is the one that's correct, and -ir does do this, then that would mean even -ir doesn't satisfy court admissability requirements.  Shesh.  Symantec really needs to get their Ghost documentation up to par.  Nothing makes me lose faith in software faster than bad documentation -- or worse, documentation that's self-contradictory.

Quote:
I'm going to have to spend a little more time with that Switches: Sector copy to digest what is or is not included in different modes--I need to figure out how the command line with *-ib -ia* differs from the other sector copy modes!


I thought this had already become clear?  Smiley
 
 
IP Logged
 
pishposh
Dude
*
Offline


I Love Radified!

Posts: 24
Cambria, California


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #13 - Feb 28th, 2010 at 6:15am
 
NightOwl wrote on Feb 24th, 2010 at 11:56am:
@
pishposh

Quote:
If you've got any more, lay it on me.  This "homework" assignment of mine appears to be due Wednesday, according to Da Boss.

So, it looks like we have now passed your dead line--FWIW I didn't see any other issues in the information you posted.  But, I've spent a little more time reading (and re-reading  Wink ) some of the information, and thought I'd make a few more comments.....


Go ahead.  I can always produce a revision.  Wink

Quote:
From Switches: Sector copy:

Quote:
Normally, Ghost does not create an exact duplicate of a disk.

Comparing the source and destination after cloning

When copying a disk to another disk, a checksum of the destination disk will nearly always result in a different value than a checksum of the original disk, even when using the -IR switch. This difference is due to differences in disk geometry between the source and destination disks. Because Ghost locates the partitions on the destination disk on cylinder boundaries, the difference in disk geometry causes the partition to be located in a slightly different place than previously. Ghost adjusts partition tables accordingly, and this does not result in a loss of data. If Ghost did not locate the partitions on cylinder boundaries, it probably would not be possible to access the restored partitions other than with a disk editor.

I've seen this comment multiple times from various sources--all well and good!  But, what has always *troubled* me is this fact--if restored partitions from the image (or direct cloning from source to destination HDD) were not located on cylinder boundaries to begin with--how exactly is it that the original source HDD did not have those partitions located on cylinder boundaries?  These partition were presumable created, and were in use prior to making a Ghost image--and someone was successfully accessing the data without using a *disk editor*--why does Ghost have to adjust the restored partitions to anything other than what was used on the original source HDD from which the image was created--or used to do a direct clone to another HDD?????!

There must be some *voodoo* magic going on in the background that no one bothers to explain--source HDD can be accessed just fine (I would think this means that the partitions *are* located on the necessary cylinder boundaries), but destination HDD must have the partition aligned in some other fashion to have them start on cylinder boundaries in order to able to access data successfully--my head hurts......


Simple explanation.  It comes down to different HDDs having different CHS geometry despite all HDDs being equal in the LBA sector numbering domain:

Assume LBA sector number 10,000,000 on HDD X is the start of a new cylinder, and that a partition also starts there.  Now, on HDD Y, absolute LBA sector number 10,000,000 may NOT map to the start of a new cylinder given HDD Y's unique CHS geometry.  With this in mind, consider that most operating systems (until very recently*) use CHS to access disks and require partitions to begin on new cylinders, and the problem becomes obvious.

So, this issue that's wracking your brain need not wrack your brain in the first place because the issue itself has nothing to do with partitions not being aligned to cylinders on source HDDs.  It has to do with Ghost making a LBA-sector-by-LBA-sector backup, and then when restoring, needing to possibly paste those sectors onto the destination drive at a slightly different LBA sector offset -- one that is the start of what is a new cylinder on the destination HDD.

(*) = Vista is the first Windows operation system to abandon internal CHS addressing of disks.  It uses LBA sector addressing internally instead.  When Microsoft made this change, abandoning CHS, it was forced to decide (arbitrarily) on a new number for how many sectors would represent "boundaries" for partitions.  As it turns out, they settled on 2048.  2048 because at 512 bytes per sector, 512 bytes * 2048 sectors = 1,048,576 bytes, or exactly 1 megabyte.  Thus with 2048 as the partitioning boundary block size, partitioning becomes very simple: you can now specify partition sizes in increments of exactly 1 MB!  (This is also, incidentally, why the MBR boot track -- and EBR boot tracks -- inflated from 63 sectors under CHS operating systems to 2048 sectors under the new LBA Vista/7 operating systems.  Since partitions should now start on 2048 sector boundaries under them, and since *some* amount of the first 2048 sector block (LBA sectors 0-2048) is used for the MBR, the NEXT/FIRST available sector to start a partition at the very beginning of becomes sector absolute LBA sector 2048.  Thus the MBR boot track expands as a mere coincidence of that.  (And of course, same with EBR boot tracks.)  If you want more info on this subject: http://www.mytechsupport.ca/forums/index.php?topic=12612.0

Anyway, continuing to the next items...

Quote:
*Image All* (*-ia* switch)--seems to say it *All*--but, actually this really means *sort of all*!!!!!  Well, I guess they had to name it *something*!  But, I guess it's easiest to understand what *is not* included in *Image All* vs *Image Disk*....


Well, when thinking exclusively of the bytes on a HDD that lie *within* partitions, "Image All" does in deed image "all"...

...continued in next post...
 
 
IP Logged
 
pishposh
Dude
*
Offline


I Love Radified!

Posts: 24
Cambria, California


Back to top
Re: Classic Ghost fact-checking session: anyone bored enough to join in?
Reply #14 - Feb 28th, 2010 at 6:16am
 
...continuing from last post...


See, what Symantec needs to do is abandon these ridiculous "Image All/Image Boot/Image Disk/Image Raw" designations entirely.  They made sense when Ghost was in its infancy and vastly simpler.  But today, they're keeping them and senselessly trying to make Ghost's more granular imaging controls "logically fit" the old designation descriptors.  All that does is create tons of pointless confusion.

If I were a programmer on their staff, I'd re-design the [Image/Tape] tab entirely -- so rather than modes like those above, you instead saw a table -- scrollable, IFRAME-style if necessary -- of checkboxes that you could tick or untick to configure how Ghost will perform imaging at the granular level.  Look at that "Ghost Backup Mode Quick Reference Guide" page in my draft and imagine checkboxes besides all those lines.  That would be IDEAL.  No need to know what strange descriptors like "Image All" 'really' mean -- instead, every possible granular control presented in english with a simple on/off checkbox.  (Then I'd do away with -ia/-ib/-id/-ir/etc. switches and add completely new commandline switches so those checkboxes could be controlled from the command line too.)

Quote:
*Image All* does a sector-by-sector image of all partitions--but, leaves out any *unpartitioned* space--*Image Disk* would add sector-by-sector data of the unpartitioned space!  And, *Image All* includes the absolute sector 0 boot sector, but leaves out the rest of the *boot tract*.  And *Image All* leaves out any extended partition table sector-by-sector data--it just saves the needed information to *recreate* the extended partition table(s).


Yes.

Quote:
Quote:
When using the switches -IA and -IB on the same command line, Ghost copies the entire boot track.

So, using both *-ia* plus *-ib*, you get a sector-by-sector image of partitions (unpartitioned space is left out), and you now get the entire boot tract sector-by-sector, but all extended partition tables and tracts are left out--but the necessary information to recreate the extended partition tables is saved, or transferred if cloning directly!


Also yes.

Quote:
*Image Disk* creates a sector-by-sector of all partitioned and unpartitioned space, the entire boot tract, and all extended partition tables and tracts.


Yes again.

Quote:
But, what exactly is meant by *boot tract*?!

Quote:
Image Boot

Use the Image Boot switch when applications use the boot track to store information. The Image Boot switch does a sector copy of the boot track. The image file includes the master boot record, partition information, and information stored in the boot track by boot managers and other programs.

The Image Boot switch does not, by itself, do a sector copy of the disk or partition.

I think the definition of *boot tract* has changed over time!  Back when Ghost 2003 was out, along with Corporate Ghost 8.x--this meant *sectors 0 thru 63!  With the advent of WinVista (and now Win7), I think *boot tract* may mean *sectors 0 thru 2048*--or *sectors 0 thru 63*--depending on the partitioning tool used initially--someone who understands this better than I would have to clarify that!!!!


Yes, 2048 boot tracts starting with Vista.  However, Vista will "tolerate" partitions that *don't* start on its new 2048 sector boundaries (i.e. MBR boot tracks that span LBA sectors 0-62 with the first partition starting at LBA sector 63) in order for Vista itself to remain backwards compatible with older partitioning tools.  So I guess the correct way to look at this isn't by saying "Vista/7 are 2048 or 63", but rather, by saying "Vista/7 are only 2048 but put up with 63."

FYI: there actually is no such term as "boot track" at the official level.  When the IBM partitioning scheme (MBR) was invented, there was absolutely NO expectation that anyone would ever use the empty sectors between the end of the MBR loader code+partition table and the start of the first partition.  Those sectors were simply expected to be "wasted and forgotten" and weren't even given a name.  "Boot track" is therefore a slang term and was only coined when multiboot software authors discovered those sectors and began "exploiting" them to store their code, causing people to suddenly need a name to call that area where said code was being stored.  I guess this is why everyone seems to have their own name for the "boot track," and even why some people have a problem conceptualizing it -- "it's not in the specs."  I suppose you could just as easily call the non-first-sector areas of EBR/MBR boot tracks "MBR/EBR slack space" or "the MBR/EBR demilitarized zone" if you wanted.  Wink  Personally, I've adopted the term "boot track" because not only is it apparently the most popular name for that area, but it also makes logical sense -- under CHS, sectors 0-62 represent a single track (one 360 degree magnetic track as seen by one head looking at one side of one platter).

Quote:
But, earlier Ghost versions prior to Vista compatibility, probably are not *sectors 0 thru 2048* boot tract aware.  Here's a reference as to when Ghost was made Vista compatible--GSS v2.5:   Ghost Solution Suite Compatibility with Windows Vista SP1, Windows XP SP3, Windows Server 2008, Windows Server 2008 R2, and Windows 7.

So, you have to be very *alert* as to what version of Ghost you are using--and how it functions, what OS is being used, and what partitioning tool was used originally if you want to avoid attempting a Ghost procedure that might *mess* thing up for you!!!!


Yes, in deed.
 
 
IP Logged
 
Pages: 1 2 
Send Topic Print