Radified Community Forums - All Data Unreadable Due to One Corrupt File in Span

Elipsis

N00b
Offline

I Love Radified!

Posts: 2

All Data Unreadable Due to One Corrupt File in Span
Aug 30^th, 2013 at 1:28pm

Hey all, I've spent all day with this so far and I'm in desperate need of help. I have a spanned backup (on an external hard drive, not on a CD). There are a total of 60 files. Apparently windows update decided to reboot the computer while I using GhostExplorer to restore some of the data I needed, and now I can no longer open the entire thing due to a single corrupted .ghs file.

After doing some research, I discovered which file is corrupt and have the headers. But now what do I do?

Using the header utility:

000000 FE EF 01 00 2A 21 1F 52 01 01 00 00 00 00 00 00 (first file, .gho)
000000 FE EF 09 00 2B 21 1F 52 90 CE FF FF 00 00 00 00 (001.ghs)
000000 FE EF 09 00 2C 21 1F 52 06 C9 FF FF 01 00 00 00 (002.ghs)
* * *
000000 FE EF 09 00 44 21 1F 52 4A 7C FA FF 19 00 00 00 (026.ghs)

000000 D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00 00 00 (027.ghs) !!!!

000000 FE EF 09 00 46 21 1F 52 A8 F7 F9 FF 1B 00 00 00 (028.ghs)
* * *
000000 FE EF 09 00 65 21 1F 52 28 A0 F0 FF 3A 00 00 00 (059.ghs)
000000 FE EF 09 00 66 21 1F 52 6A 47 F0 FF 3B 00 00 00 (060.ghs)

I know which file is corrupted obviously... but I have no idea how to fix it or what to do now. Ghost explorer won't open anything anymore, not even with the -corrupt or -ignoreindex flags.

If I lose some of the data on that 4G span, I can live with that... but right now I can't get ANYTHING off of the entire 250GB ghost. Please help... I don't know what to do next.

IP Logged

NightOwl

Radministrator

Offline

"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA

Back to top

Re: All Data Unreadable Due to One Corrupt File in Span
Reply #1 - Sep 1^st, 2013 at 9:39am

@

Elipsis

Quote:

I have a spanned backup (on an external hard drive, not on a CD). There are a total of 60 files.......

......I can't get ANYTHING off of the entire 250GB ghost

Wow! That's a huge Ghost file set!

Quote:

After doing some research, I discovered which file is corrupt and have the headers. But now what do I do?

Using the header utility:

Could you share what *header utility* you are using?

How did you decide which header was corrupt--just the change in the pattern seen in the other headers vs the one you have highlighted in red above?

Quote:

If I lose some of the data on that 4G span

What version of Ghost are you using? A 4G file size suggests that it is probably one of the Corporate Ghost versions, and probably above the 8.xx.

Nigel Bree, (a former Symantec employee on the development team for Ghost) in the past, on the Symantec Ghost Solution Suite Forum, has attempted to help a number of individuals with corrupt image files. But, he is no longer with the company, and support for Corp Ghost appears to in the decline--there is evidence that Symantec is abandoning all forms of Ghost, both retail and corporate.

But, you could try posting your question to that forum to see if anyone can help there: Symantec Ghost Solution Suite (GSS) support forum

Quote:

Please help... I don't know what to do next.

You could try booting to DOS (or running *ghost32.exe* if you use that program), and running an integrity check (using any switches that might help with a corrupt image set) just to make sure Ghost will not access that image set.

If by any chance, Ghost will access the image set successfully in DOS, you could try to restore the image to a test HDD, and see if you can access the files in that fashion.

Beyond that, unfortunately,we here have not seen any way to repair a corrupt image set.

Quote:

Apparently windows update decided to reboot the computer while I using GhostExplorer to restore some of the data I needed, and now I can no longer open the entire thing due to a single corrupted .ghs file.

That's disturbing on several levels. The Ghost image files should have been a *read only* file set as far as Ghost Explorer and Windows are concerned. Why would a shutdown and reboot have any effect on an image set and the individual file headers? I could see a shutdown affecting the integrity of a file being restored that's in mid-restored state--but the image file header.....hmmm?!

Were you using Ghost Explorer to modify the image set in some way when the event happened?

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink

!

IP Logged

Elipsis

N00b
Offline

I Love Radified!

Posts: 2

Back to top

Re: All Data Unreadable Due to One Corrupt File in Span
Reply #2 - Sep 1^st, 2013 at 2:49pm

NightOwl wrote on Sep 1^st, 2013 at 9:39am:

@

Elipsis

Wow! That's a huge Ghost file set!

I don't want to brag... but... yeah I hear that alot. Wink

NightOwl wrote on Sep 1^st, 2013 at 9:39am:

Could you share what *header utility* you are using?

How did you decide which header was corrupt--just the change in the pattern seen in the other headers vs the one you have highlighted in red above?

It was based on some research I did just googling other people with similar problems.

I think it was in this discussion that I had found this hex dump .vbs.

NightOwl wrote on Sep 1^st, 2013 at 9:39am:

What version of Ghost are you using? A 4G file size suggests that it is probably one of the Corporate Ghost versions, and probably above the 8.xx.

Nigel Bree, (a former Symantec employee on the development team for Ghost) in the past, on the Symantec Ghost Solution Suite Forum, has attempted to help a number of individuals with corrupt image files. But, he is no longer with the company, and support for Corp Ghost appears to in the decline--there is evidence that Symantec is abandoning all forms of Ghost, both retail and corporate.

But, you could try posting your question to that forum to see if anyone can help there: Symantec Ghost Solution Suite (GSS) support forum

I'll have to go back and check, but I believe it was made with Ghost 11 run off of a separate bootable Windows P.E. recovery disk. I've noticed that Nigel Bree seems to be the only person who is remotely interested in Symantec Ghost having any semblance of the ability to recover from ghost image files from errors and corruption. It was based off some of his responses to other people with similar problems that directed me to look at the headers in the first place. I'm looking for the result that I found where someone posted something very similar to what is happening to me... I think it was this.

NightOwl wrote on Sep 1^st, 2013 at 9:39am:

You could try booting to DOS (or running *ghost32.exe* if you use that program), and running an integrity check (using any switches that might help with a corrupt image set) just to make sure Ghost will not access that image set.

If by any chance, Ghost will access the image set successfully in DOS, you could try to restore the image to a test HDD, and see if you can access the files in that fashion.

Beyond that, unfortunately,we here have not seen any way to repair a corrupt image set.

The integrity check fails when it gets to the part of the span that is supposed to go to the corrupt span. It prompts me for the next file and accepts nothing I give it as any use. I don't think I'll be able to restore the image if the integrity check is telling me that the ghost is no good.

NightOwl wrote on Sep 1^st, 2013 at 9:39am:

That's disturbing on several levels. The Ghost image files should have been a *read only* file set as far as Ghost Explorer and Windows are concerned. Why would a shutdown and reboot have any effect on an image set and the individual file headers? I could see a shutdown affecting the integrity of a file being restored that's in mid-restored state--but the image file header.....hmmm?!

Were you using Ghost Explorer to modify the image set in some way when the event happened?

Don't I know it! My friend and I were talking yesterday about how the eff an operation that should by all rights be read-only managed to corrupt the headers on the file it was reading. My best guess would be sloppy coding. I certainly had no intention to modify the data that was part of the ghost, in fact I don't think Ghost Explorer can even do that, can it? I honestly have no idea. What's more upsetting is that the one bad file stops Ghost Explorer, as well as the regular ghost program, from doing anything useful with the spanned ghost. At worst you think it would be able to go from span 26 to span 28 and just lose some of the data... Cry

...

...

...

Wiiiiiiiiiith all that said... I made a desperation maneuver since my original post and solved my problem. The solution that worked was to manually hex-edit 027.ghs. After making a copy of it... I opened it up in a hex editor and changed it to this:

FE EF 09 00 45 21 1F 52 9C 9C FA FF 1A 00 00 00

Some of these values were just pattern matching off of 026.ghs and 028.ghs - while others I just completely made up. (I believe they are just the timestamp?)

Anyway I stuffed my mauled version of 027.ghs back into the sequence of files... and believe it or not... the thing worked! Ghost took my file and managed to load everything up in ghost explorer. It seemed to then extract everything I wanted out of there normally. If there is any corruption in the payload of 027.ghs, I'll probably never find it - as that section of the span correspond, mostly, to one large video file... which is a file format that handles errors rather gracefully.

Thanks for getting back to me.

IP Logged

NightOwl

Radministrator

Offline

"I tought I saw a puddy
tat..."

Posts: 5826
Olympia, WA--Puget Sound--USA

Back to top

Re: All Data Unreadable Due to One Corrupt File in Span
Reply #3 - Sep 2^nd, 2013 at 10:01am

@

Elipsis

Quote:

Wiiiiiiiiiith all that said... I made a desperation maneuver since my original post and solved my problem.

Excellent, excellent! Good detective work and reasoning! Great experimental effort!

And thank you for reporting back with your results. This thread may serve others who have a similar corrupt image file set to possibly resolve their problem.

Quote:

I certainly had no intention to modify the data that was part of the ghost, in fact I don't think Ghost Explorer can even do that, can it? I honestly have no idea.

If the file system is FAT, I think you can add or remove files from an image set--but not on a NTFS partition (at least using the Ghost 2003 version--Ghost 11.xx may have the ability to work with NTFS partitions). And if you look under the *File* menu item, there's a *Compile...* item. This allows you to take an existing file set, and re-save it with a changed .gho and .ghs file size. This function allows you to take larger file sizes, and make them smaller to better fit, for instance, on CDs or DVDs. You set the new file size under the *View* menu item, and selecting *Options...*. I think you have to set that first before you start the Compile process.

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink

!

IP Logged

OldCasper

Technoluster

Offline

I Love Ghost!

Posts: 126
Florida, USA

Back to top

Re: All Data Unreadable Due to One Corrupt File in Span
Reply #4 - Sep 19^th, 2013 at 9:26pm

Don't fight with Ghost, and it won't fight with you.

If while running Ghost, it stops with a file error message, then I stop too.
Back out of Ghost and in Windows run '

chkdsk C: /r

' and after Check Disk repairs the errors on the Hard drive, run Ghost again. A simple fix, for a simple problem.

Casper Cool

A man with experience is never at the mercy of a man with an argument.

IP Logged

	Welcome, Guest. Please Login