Ghost Solution Suite

 View Only
Expand all | Collapse all

Can't extract files from ghost image

  • 1.  Can't extract files from ghost image

    Posted Apr 07, 2012 04:21 PM

     

    I created an image of a disk C: in the size of 5 363 533 064 bytes without errors. In attempt to recover data from this image with the ghost.exe there is an error. Ghost explorer in attempt of opening of the file requests the following GHS file of which never was. Keys - ignoreindex and - corrupt don't help. The utility ghofixup.exe also doesn't give result. Help to recover, please, documents from this image.

    *********************************
    Date : Sat Apr 07 21:08:44 2012
    Error Number: (27074)
    Message: Corrupt ID header encountered
    Version: 11.5.1.2269 (Feb 2 2010, Build=2269)
    OS Version: Microsoft Windows XP Professional Service Pack 3 (Build 2600)
    Command line arguments:
    Active Switches :
    AutoName
    PathName : 11497 pngfilt.dll
    DumpFile : 2.2:\Backup_other\Videofon Natalya\BAD2.GHO
    DumpPos : 1088053558
    Last LFO Buffersize : 0
    Last LFO Path :
    Full Path : 2.2:\Backup_other\Videofon Natalya\BAD2.GHO
    Disk:Partition : 2:2
    Drive Letter : H:\
    Last LFO Filesystem : Native
    FlagImplode : 0
    FlagExplode : 3

    Operation Details :
    Total size.........13590
    MB copied..........2367
    MB remaining.......11223
    Percent complete...17%
    Speed..............95 MB/min
    Time elapsed.......24:46
    Time remaining.....1:58:08

    Thread #1416 Call Stack
    AbortLog
    Generic_Abort
    readIDHeader
    NTFSReadMFT
    loadMFTRec
    loadMFT
    loadVol
    CheckNTFSImage
    CheckPartition2
    CheckFileIntegrity
    CopyMainline
    AttemptOperation
    sub_main
    main

    Call Stack
    Address Frame Logical Addr Module
    0x000000007c90e4f4 0x000000000012d524 KiFastSystemCallRet+0x0000000000000000
    0x000000000012d824 0x0000000000000003 0x0000:0x0000000000000000
    End Call Stack


    Start heap available: 776867840
    Cur heap available: 771170304
    Total Memory: 1072410624

    Allocated
    33500 ..\ghost.cpp:1511
    Free

    Fat details:

    NTFS details:
    ----------------

    NTFS Global Flags:
    ----------------
    contiguousWrite=1 forceDiskClusterMapping=0
    inhibitCHKDSK=1 ignoreBadLog=0 ignoreCHKDSKBit=0
    enable_cache=0 xfrbuflen=32768
    last_attr_type = 0
    loadExact = 0
    sameSize = 0
    ----------------
    =======================================================
    NTFS volume 0:
    ----------------
    initialised..............1
    read cached..............N
    Selective caching........N
    flags....................Volume OK
    No drive - probably sourced from file image
    part order...............0
    version..................0x0400
    volsize..................83884143
    blocksize................512
    clusterfactor............8
    clustersize..............4096
    mftrecordsize............1024
    indexrecordsize..........4096
    indexclustperrecord......1
    bootSectorCopyOffset.....83884143
    pagefileSys..............-1
    bootIni..................3395
    volumeLabel..............[]
    sectorsInUse.............30954480
    totalNonCopiedBytes......0
    bytesToCopy..............0
    bitmapClusters...........320
    bitmapUsedBytes..........1310696
    estimatedClusters........320
    estimatedUsedBytes.......1310696
    clustersizeShift.........12
    blocksizeShift...........9
    mftrecordsizeShift.......10
    indexrecordsizeShift.....12
    totalRootMftRecs.........67558
    clustermap failover......N
    Boot sector details
    name....................[NTFS ]
    blocksize...............512
    clusterfactor...........8
    reservedSectorsUnused...0
    mediaType...............0xf8
    secPerTrack.............16
    numHeads................53
    hiddenSectors...........16
    volsize.................83884143
    mftcluster..............786432
    mftmirrorcluster........16
    clustersPerMFTRecord....246
    clustersPerIndexBuffer..1

    ---------------------------------------------------
    Cluster Allocation Map
    ---------------------------------------------------
    Start: 10485517 Length: 0 Next: 10485517


    =======================================================

    Disk Info :
    remote.............0
    drive..............1
    sectorsUsedCount.......488394544
    estimatedUsedCount.....27833329
    numPartitions..............1
    Version............1150
    Full structure dump....
    {
    PID_START_BYTE: 0
    PID_WIN_9X_ID_PRESERVE: false
    SVersion: 1150
    SCylinders: 1024
    PID_WIN_9X_ID: 2330210894
    SDiskFormat: 13
    PID_WIN_NT_ID: 3062871695
    SMbr:
    0x0000 33 c0 8e d0 bc 00 7c fb 50 07 50 1f fc be 1b 7c
    0x0010 bf 1b 06 50 57 b9 e5 01 f3 a4 cb bd be 07 b1 04
    0x0020 38 6e 00 7c 09 75 13 83 c5 10 e2 f4 cd 18 8b f5
    0x0030 83 c6 10 49 74 19 38 2c 74 f6 a0 b5 07 b4 07 8b
    0x0040 f0 ac 3c 00 74 fc bb 07 00 b4 0e cd 10 eb f2 88
    0x0050 4e 10 e8 46 00 73 2a fe 46 10 80 7e 04 0b 74 0b
    0x0060 80 7e 04 0c 74 05 a0 b6 07 75 d2 80 46 02 06 83
    0x0070 46 08 06 83 56 0a 00 e8 21 00 73 05 a0 b6 07 eb
    0x0080 bc 81 3e fe 7d 55 aa 74 0b 80 7e 10 00 74 c8 a0
    0x0090 b7 07 eb a9 8b fc 1e 57 8b f5 cb bf 05 00 8a 56
    0x00a0 00 b4 08 cd 13 72 23 8a c1 24 3f 98 8a de 8a fc
    0x00b0 43 f7 e3 8b d1 86 d6 b1 06 d2 ee 42 f7 e2 39 56
    0x00c0 0a 77 23 72 05 39 46 08 73 1c b8 01 02 bb 00 7c
    0x00d0 8b 4e 02 8b 56 00 cd 13 73 51 4f 74 4e 32 e4 8a
    0x00e0 56 00 cd 13 eb e4 8a 56 00 60 bb aa 55 b4 41 cd
    0x00f0 13 72 36 81 fb 55 aa 75 30 f6 c1 01 74 2b 61 60
    0x0100 6a 00 6a 00 ff 76 0a ff 76 08 6a 00 68 00 7c 6a
    0x0110 01 6a 10 b4 42 8b f4 cd 13 61 61 73 0e 4f 74 0b
    0x0120 32 e4 8a 56 00 cd 13 eb d6 61 f9 c3 49 6e 76 61
    0x0130 6c 69 64 20 70 61 72 74 69 74 69 6f 6e 20 74 61
    0x0140 62 6c 65 00 45 72 72 6f 72 20 6c 6f 61 64 69 6e
    0x0150 67 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74
    0x0160 65 6d 00 4d 69 73 73 69 6e 67 20 6f 70 65 72 61
    0x0170 74 69 6e 67 20 73 79 73 74 65 6d 00 00 00 00 00
    0x0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01b0 00 00 00 00 00 2c 44 63 8f b6 8f b6 00 00 80 01
    0x01c0 01 00 07 34 d0 ff 10 00 00 00 70 f8 ff 04 00 34
    0x01d0 d0 ff 0f 34 d0 ff 80 f8 ff 04 d0 56 1c 18 00 00
    0x01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
    0x0200
    SIsSpanned: false
    SOs2Name:
    0x0000 00 00 00 00 00 00 00 00 00 00
    SFingerprint: 4f78c46a
    SHeadsPerCyl: 35
    SectorsPerTrack: 10
    SRemote: false
    SEndOfImagePosition: 13fb10508
    PID_BYTE_COUNT: 3a38b2e000
    SFlags: 1
    SPatchedFileCount: 0
    SDrive: 1
    PID_BOOT_CODE:
    0x0000 33 c0 8e d0 bc 00 7c fb 50 07 50 1f fc be 1b 7c
    0x0010 bf 1b 06 50 57 b9 e5 01 f3 a4 cb bd be 07 b1 04
    0x0020 38 6e 00 7c 09 75 13 83 c5 10 e2 f4 cd 18 8b f5
    0x0030 83 c6 10 49 74 19 38 2c 74 f6 a0 b5 07 b4 07 8b
    0x0040 f0 ac 3c 00 74 fc bb 07 00 b4 0e cd 10 eb f2 88
    0x0050 4e 10 e8 46 00 73 2a fe 46 10 80 7e 04 0b 74 0b
    0x0060 80 7e 04 0c 74 05 a0 b6 07 75 d2 80 46 02 06 83
    0x0070 46 08 06 83 56 0a 00 e8 21 00 73 05 a0 b6 07 eb
    0x0080 bc 81 3e fe 7d 55 aa 74 0b 80 7e 10 00 74 c8 a0
    0x0090 b7 07 eb a9 8b fc 1e 57 8b f5 cb bf 05 00 8a 56
    0x00a0 00 b4 08 cd 13 72 23 8a c1 24 3f 98 8a de 8a fc
    0x00b0 43 f7 e3 8b d1 86 d6 b1 06 d2 ee 42 f7 e2 39 56
    0x00c0 0a 77 23 72 05 39 46 08 73 1c b8 01 02 bb 00 7c
    0x00d0 8b 4e 02 8b 56 00 cd 13 73 51 4f 74 4e 32 e4 8a
    0x00e0 56 00 cd 13 eb e4 8a 56 00 60 bb aa 55 b4 41 cd
    0x00f0 13 72 36 81 fb 55 aa 75 30 f6 c1 01 74 2b 61 60
    0x0100 6a 00 6a 00 ff 76 0a ff 76 08 6a 00 68 00 7c 6a
    0x0110 01 6a 10 b4 42 8b f4 cd 13 61 61 73 0e 4f 74 0b
    0x0120 32 e4 8a 56 00 cd 13 eb d6 61 f9 c3 49 6e 76 61
    0x0130 6c 69 64 20 70 61 72 74 69 74 69 6f 6e 20 74 61
    0x0140 62 6c 65 00 45 72 72 6f 72 20 6c 6f 61 64 69 6e
    0x0150 67 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74
    0x0160 65 6d 00 4d 69 73 73 69 6e 67 20 6f 70 65 72 61
    0x0170 74 69 6e 67 20 73 79 73 74 65 6d 00 00 00 00 00
    0x0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01b0 00 00 00 00 00 2c 44 63 8f b6 8f b6 00 00
    PID_WIN_NT_ID_PRESERVE: false
    PID_DISK_NOTIFY_OS: true
    PID_PARTITION_NODE_FORMAT: d
    SEstimatedUsed: 1a8b3f1
    STotalSectors: 1d1c5970
    SPartitions:
    {
    PID_POSITION_ID: 2.1:
    SFlagInp: 3
    SFileOperationOffset: 0
    PID_VOLUME_NAME:
    PID_FIND_FIRST: false
    PID_FIND_BEST_FIT: false
    SSlot: 0
    SNumSects: 4fff870
    PID_VOLUME_TYPE: 1
    PID_START_CHS_MAXED_OUT: false
    PID_FORMAT_TYPE: 8
    SOrder: 0
    SFpos: 1400
    PID_VOLUME_SLOT_NUMBER: 0
    PID_END_CHS:
    {
    PID_SECTOR: 10
    PID_HEAD: 34
    PID_CYLINDER: 3ff
    }
    PID_VOLUME_START: 1e00
    SBootable: true
    PID_CLEANLY_SHUTDOWN: true
    SExtended: false
    SSystemId: 7
    SSizeAdjustment: 0
    PID_IS_VOLUME_CONTAINER: false
    PID_SYSTEM_ID: 7
    PID_START_CHS:
    {
    PID_SECTOR: 1
    PID_HEAD: 1
    PID_CYLINDER: 0
    }
    PID_FORMAT: 8
    PID_ACTIVE: true
    PID_EXTENT:
    {
    PID_EXTENT_CONTAINER_EXTENT_INDEX: 0
    PID_EXTENT_START: 1e00
    PID_EXTENT_SIZE_MINIMUM: 9fff0e000
    PID_EXTENT_SIZE_MAXIMUM: 9fff0e000
    }
    SFirstSect: 10
    PID_READ_ONLY: false
    PID_FIND_LAST: false
    PID_NAME:
    SFlags: 0
    PID_ROLE_FORMAT_MATCHING_TYPE: 0
    SEndFpos: 13fad614c
    PID_VOLUME_SIZE_MINIMUM: 9fff0e000
    PID_PARENT_BOOT_RECORD_SECTOR_OFFSET: 0
    PID_FIND_WORST_FIT: false
    SGflags: 4
    PID_NO_HARD_ERROR: true
    PID_VOLUME_SIZE_MAXIMUM: 9fff0e000
    PID_END_CHS_MAXED_OUT: true
    PID_HIDDEN: false
    PID_IS_VOLUME: true
    PID_VOLUME_NOTIFY_OS: true
    PID_PARENT_BOOT_RECORD_SLOT_NUMBER: 0
    SSectorsUsed: 1d853f0
    PID_ROLE: 2
    }
    PID_CONTAINER_ID: 2:
    SSectorsUsed: 1d1c4f30
    }


    # Ord Boot Id Ext First Num Last Used NTFS
    0 0 1 7 No 16 83884144 83884160 30954480 Yes

    Disk Info :
    remote.............0
    drive..............0
    sectorsUsedCount.......0
    estimatedUsedCount.....0
    numPartitions..............0
    Version............0
    Full structure dump....
    {
    SVersion: 0
    SCylinders: 0
    SDiskFormat: 1
    SMbr:
    0x0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0200
    SIsSpanned: false
    SOs2Name:
    0x0000 00 00 00 00 00 00 00 00 00 00
    SFingerprint: 0
    SHeadsPerCyl: 0
    SectorsPerTrack: 0
    SRemote: false
    SEndOfImagePosition: 0
    SFlags: 0
    SPatchedFileCount: 0
    SDrive: 0
    SEstimatedUsed: 0
    STotalSectors: 0
    SPartitions:
    [
    ]
    SSectorsUsed: 0
    }


    # Ord Boot Id Ext First Num Last Used NTFS

    Fixed Drives

    Drive 0 SAMSUNG SP0802N S00JJ30XC49722

    Total Sectors 156368016
    Bytes per Sector 512
    MB 76351
    Cylinders 9733
    Heads 255
    Sectors per Track 63

    Drive 0 SAMSUNG SP0802N S00JJ30XC49722
    WinNT (Active)
    Total Sectors 156368016
    Bytes per Sector 512
    MB 76351
    Cylinders 9733
    Heads 255
    Sectors per Track 63
    Successful IO Count 11

    Drive 1 ZMVE Ext Hard Disk

    Total Sectors 488397168
    Bytes per Sector 512
    MB 238475
    Cylinders 30401
    Heads 255
    Sectors per Track 63

    Drive 1 ZMVE Ext Hard Disk
    ASPI
    Total Sectors 488397168
    Bytes per Sector 512
    MB 238475
    Successful IO Count 0

    WinNT (Active)
    Total Sectors 488397168
    Bytes per Sector 512
    MB 238475
    Cylinders 30401
    Heads 255
    Sectors per Track 63
    Successful IO Count 7

    AsyncIo : 0

    Image Devices

    Key[1] 1.1:
    Key[2] 1:1
    Key[3] C:
    Path C:
    Desc C: 1.1: []
    Type NTFS
    Disk 0
    Offset 63

    Key[1] 1.2:
    Key[2] 1:2
    Key[3] D:
    Path D:
    Desc D: 1.2: []
    Type NTFS
    Disk 0
    Offset 83891493

    Key[1] 2.1:
    Key[2] 2:1
    Key[3] G:
    Path G:
    Desc G: 2.1: []
    Type NTFS
    Disk 1
    Offset 2048

    Key[1] 2.2:
    Key[2] 2:2
    Key[3] H:
    Path H:
    Desc H: 2.2: []
    Type NTFS
    Disk 1
    Offset 215048192

    Key[1] E:
    Path E:
    Desc E:
    Type CD

    Key[1] F:
    Path F:
    Desc F: [GHBOOTCD]
    Type CD

    Key[1] @CD-R1
    Path @CD-R1
    Desc @CD-R1 ASUS CD-S520B
    Type CD

    Key[1] @CD-R2
    Path @CD-R2
    Desc @CD-R2 ZMVE Virtual CDRom
    Type CD


    Volume attributes
    =================
    1.1:
    Attribute dump
    BiosId:128
    DiskSignature9x:2330210894
    DiskSignatureNt:837366248
    DiskModelNumber:SAMSUNG SP0802N
    DiskSerialNumber:S00JJ30XC49722
    VolumeSectorOffset:63

    1.2:
    Attribute dump
    BiosId:128
    DiskSignature9x:2330210894
    DiskSignatureNt:837366248
    DiskModelNumber:SAMSUNG SP0802N
    DiskSerialNumber:S00JJ30XC49722
    VolumeSectorOffset:83891493

    2.1:
    Attribute dump
    DiskSignature9x:2330210894
    DiskSignatureNt:1812603631
    DiskModelNumber:ZMVE Ext Hard Disk
    VolumeSectorOffset:2048

    2.2:
    Attribute dump
    DiskSignature9x:2330210894
    DiskSignatureNt:1812603631
    DiskModelNumber:ZMVE Ext Hard Disk
    VolumeSectorOffset:215048192

    80.1:
    Attribute dump
    DiskSignature9x:2330210894
    DiskSignatureNt:837366248
    DiskModelNumber:OS Volumes
    VolumeSectorOffset:63

    80.2:
    Attribute dump
    DiskSignature9x:2330210894
    DiskSignatureNt:837366248
    DiskModelNumber:OS Volumes
    VolumeSectorOffset:83891493

    80.3:
    Attribute dump
    DiskSignature9x:2330210894
    DiskSignatureNt:837366248
    DiskModelNumber:OS Volumes
    VolumeSectorOffset:156360704

    80.4:
    Attribute dump
    DiskSignature9x:2330210894
    DiskSignatureNt:837366248
    DiskModelNumber:OS Volumes
    VolumeSectorOffset:371408896

    LargeMemoryAllocationFactory diagnostic...
    ==========================================

    Heap available at construction: 776601600
    Current heap available: 771100672
    Total Memory: 1072410624

    Allocated

    DiskManager diagnostic...
    =========================

    Fixed Drives

    Drive 0 SAMSUNG SP0802N S00JJ30XC49722

    Total Sectors 156368016
    Bytes per Sector 512
    MB 76351
    Cylinders 9733
    Heads 255
    Sectors per Track 63

    Drive 0 SAMSUNG SP0802N S00JJ30XC49722
    WinNT (Active)
    Total Sectors 156368016
    Bytes per Sector 512
    MB 76351
    Cylinders 9733
    Heads 255
    Sectors per Track 63
    Successful IO Count 11

    Drive 1 ZMVE Ext Hard Disk

    Total Sectors 488397168
    Bytes per Sector 512
    MB 238475
    Cylinders 30401
    Heads 255
    Sectors per Track 63

    Drive 1 ZMVE Ext Hard Disk
    ASPI
    Total Sectors 488397168
    Bytes per Sector 512
    MB 238475
    Successful IO Count 0

    WinNT (Active)
    Total Sectors 488397168
    Bytes per Sector 512
    MB 238475
    Cylinders 30401
    Heads 255
    Sectors per Track 63
    Successful IO Count 7

    FilesystemMounter diagnostic...
    ===============================


    FilesystemManager diagnostic...
    ===============================

    Volume 1
    VolumePos: 1.1:
    DriveLetter: C:
    Description: 40GB Primary Disk 0 Offset 31.50KB 40GB SAMSUNG SP0802N S00JJ30XC49722
    Type: fsfNtfsWindowsXP
    Name:

    Volume 2
    VolumePos: 1.2:
    DriveLetter: D:
    Description: 34.56GB Logical Disk 0 Offset 40GB 34.56GB SAMSUNG SP0802N S00JJ30XC49722
    Type: fsfNtfsWindowsXP
    Name:

    Volume 3
    VolumePos: 2.1:
    DriveLetter: G:
    Description: 102.54GB Primary Disk 1 Offset 1MB 102.54GB ZMVE Ext Hard Disk
    Type: fsfNtfsWindowsXP
    Name:

    Volume 4
    VolumePos: 2.2:
    DriveLetter: H:
    Description: 130.34GB Primary Disk 1 Offset 102.54GB 130.34GB ZMVE Ext Hard Disk
    Type: fsfNtfsWindowsXP
    Name:

    Volume 5
    VolumePos: 80.1:
    DriveLetter: C:
    Description: 40GB Disk 79 Offset 31.50KB 40GB OS Volumes
    Type: fsfNtfsWindowsXP
    Name:

    Volume 6
    VolumePos: 80.2:
    DriveLetter: D:
    Description: 34.56GB Disk 79 Offset 40GB 34.56GB OS Volumes
    Type: fsfNtfsWindowsXP
    Name:

    Volume 7
    VolumePos: 80.3:
    DriveLetter: G:
    Description: 102.54GB Disk 79 Offset 74.56GB 102.54GB OS Volumes
    Type: fsfNtfsWindowsXP
    Name:

    Volume 8
    VolumePos: 80.4:
    DriveLetter: H:
    Description: 130.34GB Disk 79 Offset 177.10GB 130.34GB OS Volumes
    Type: fsfNtfsWindowsXP
    Name:


    LfoFilesystemManager diagnostic...
    ==================================

    Filesystem Index: 0
    Filesystem Descriptor:
    ID's:
    ID Type: 2
    ID: C:
    ID Type: 1
    ID: 1.1:
    DriveType: 4
    FilesystemInfo:
    formatType: 8
    volumeName:

    Filesystem Index: 1
    Filesystem Descriptor:
    ID's:
    ID Type: 2
    ID: D:
    ID Type: 1
    ID: 1.2:
    DriveType: 4
    FilesystemInfo:
    formatType: 8
    volumeName:

    Filesystem Index: 2
    Filesystem Descriptor:
    ID's:
    ID Type: 2
    ID: E:
    DriveType: 8
    No FilesystemInfo structure.
    Filesystem has no VolumePtr

    Filesystem Index: 3
    Filesystem Descriptor:
    ID's:
    ID Type: 2
    ID: F:
    DriveType: 8
    No FilesystemInfo structure.
    Filesystem has no VolumePtr

    Filesystem Index: 4
    Filesystem Descriptor:
    ID's:
    ID Type: 2
    ID: G:
    ID Type: 1
    ID: 2.1:
    DriveType: 4
    FilesystemInfo:
    formatType: 8
    volumeName:

    Filesystem Index: 5
    Filesystem Descriptor:
    ID's:
    ID Type: 2
    ID: H:
    ID Type: 1
    ID: 2.2:
    DriveType: 4
    FilesystemInfo:
    formatType: 8
    volumeName:

    Filesystem Index: 6
    Filesystem Descriptor:
    ID's:
    ID Type: 1
    ID: 80.1:
    DriveType: 4
    FilesystemInfo:
    formatType: 8
    volumeName:

    Filesystem Index: 7
    Filesystem Descriptor:
    ID's:
    ID Type: 1
    ID: 80.2:
    DriveType: 4
    FilesystemInfo:
    formatType: 8
    volumeName:

    Filesystem Index: 8
    Filesystem Descriptor:
    ID's:
    ID Type: 1
    ID: 80.3:
    DriveType: 4
    FilesystemInfo:
    formatType: 8
    volumeName:

    Filesystem Index: 9
    Filesystem Descriptor:
    ID's:
    ID Type: 1
    ID: 80.4:
    DriveType: 4
    FilesystemInfo:
    formatType: 8
    volumeName:


    Environment Variables
    =====================

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\user\Application Data
    CLIENTNAME=Console
    COMMANDER_DRIVE=C:
    COMMANDER_INI=C:\Program Files\Total Commander\wincmd.ini
    COMMANDER_PATH=C:\Program Files\Total Commander
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=COMP02
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\user
    LOGONSERVER=\\COMP02
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 3 Stepping 4, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0304
    ProgramFiles=C:\Program Files
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\user\LOCALS~1\Temp
    TMP=C:\DOCUME~1\user\LOCALS~1\Temp
    USERDOMAIN=COMP02
    USERNAME=user
    USERPROFILE=C:\Documents and Settings\user
    windir=C:\WINDOWS


    *********************************



  • 2.  RE: Can't extract files from ghost image

    Posted Apr 08, 2012 10:53 AM

    What device was the image created on?  If an external USB device, it is possible that the image has been corrupted if the device is a low cost unit. Try running CHKDSK on the storage volume to see if there are any bad sectors.



  • 3.  RE: Can't extract files from ghost image

    Posted Apr 09, 2012 01:49 AM

    The image formed on disk D: SATA HDD on serviceable computer Core2Duo with serviceable RAM. There was also a second image in some hours after carrying out of preventive operations (it is given in a log-file). Both images aren't subject to extraction. :(
    Then the computer has been returned, and the second image has been copied on exterior HDD for the further attempts of extraction.



  • 4.  RE: Can't extract files from ghost image

    Posted Apr 09, 2012 07:33 AM

    How were the images created? Did you boot to WinPE and run Ghost from the bootable device?  Please detail the image creation process and also specify what Ghost command line options were used.

    Also, what machine make and model did you image?



  • 5.  RE: Can't extract files from ghost image

    Posted Apr 10, 2012 06:51 AM

     

    The image was created by means of a load flash card in the DOS 4.10.1998 mode from Windows 98 on Ghost 11.5 without keys of command line. By means of this flash card hundreds other images on different computers were created.
    Besides, on the same computer a year ago the Ghost-image is created by the same method, and with it problems aren't present.
    I can lay out on FTP both of an image.



  • 6.  RE: Can't extract files from ghost image

    Posted Apr 10, 2012 08:51 AM

    DOS cannot access SATA hard disks. Check your bios settings and make sure you have "Compatibility mode" selected for the SATA device, so that it emulates the older parallel ATA hard disk interface, as this is the only standard that DOS can access. DOS also has disk size limitations due to the 32 bit limit on sector addressing - this equates to around 132Gb.

    That is why we now recommend WinPE for imaging modern hardware.



  • 7.  RE: Can't extract files from ghost image

    Posted Apr 10, 2012 09:02 AM

    From ghost32 the same results.

    WinPE for creation of new images? Probably.

    At me now task to derive data from an image. There are any else means?



  • 8.  RE: Can't extract files from ghost image

    Posted Apr 10, 2012 11:42 AM

    Did you try a CHKDSK on the affected volume holding the image? The third line of your log states: Message: Corrupt ID header encountered

    Since this indicates data corruption of your image, it may not be recoverable. Try making a copy of your GHO file onto another hard disk as backup then try CHKDSK to fix the existing image.

     



  • 9.  RE: Can't extract files from ghost image

    Posted Apr 11, 2012 04:05 AM

     

    You were absolutely right, when advised to make chkdsk d: / F

    After this procedure the bad.gho and bad2.gho files (on original HDD) steel of zero length.
    ============================
    D:\Backup>chkdsk d: / F
    Type of file system: NTFS.
    It is not possible to disable the current disk.

    It is impossible to execute the Chkdsk command on this volume since the volume is used by another
    process. To launch Chkdsk, in the beginning it is necessary to disconnect this volume.
    ВCE OPEN VOLUME DESCRIPTORS WILL BE INCORRECT FURTHER.
    Confirm volume switch-off? [Y (da)/N isn't present)] y
    The volume is disconnected. BCE OPEN VOLUME DESCRIPTORS BECAME INCORRECT.

    Verification of files (stage 1 of 3)...
    Deleting the damaged record of attribute (128, "")
    from a segment of 26624 records about the file.
    Deleting the damaged record of attribute (128, "")
    from a segment of 26634 records about the file.
    Verification of files is complete.
    Check of indexes (stage 2 of 3)...
    Check of indexes is complete.
    Check of security descriptors (stage 3 of 3)...
    Check of security descriptors is complete.
    Insertion of attribute of data in file 26624.
    Insertion of attribute of data in file 26634.
    In a figure of volume the empty seat marked as selected is revealed.
    Windows made changes in file system.

    202255199 CBs of all on a disk.
    16299872 CBs in 38976 files.
    11368 CBs in 3053 indexes.
    0 CBs in the defective sectors.
    114399 CBs are used by system.
    65536 CBs are occupied under the log file.
    185829560 CBs are free on a disk.

    Cluster size: 4096 bytes.
    In total clusters on a disk: 50563799.
    46457390 clusters on a disk.
    ============================

    On external HDD they remained in the copied look.



  • 10.  RE: Can't extract files from ghost image

    Posted Apr 11, 2012 04:31 AM

    So are you confirming that your images were corrupt, or were you able to recover data after running CHKDSK?



  • 11.  RE: Can't extract files from ghost image

    Posted Apr 11, 2012 05:39 AM

     

    In case of creation of images with an interval both at 3 o'clock were damaged.
    Now they zero length, also that with them farther to do, yet I do not know. I already almost reconciled to loss of these files.



  • 12.  RE: Can't extract files from ghost image

    Posted Apr 11, 2012 09:49 AM

    Hello everyone i am new to imaging, can someone tell me where can i get some more info on creating images, editing and troubleshooting.

     

     

     



  • 13.  RE: Can't extract files from ghost image

    Posted Apr 11, 2012 01:13 PM

    Hi Joe,

     

    In order to create image there are three methods and four different PreOS option left for us.

     

    The three methods are as follows

    1. Console

    2. Boot Disc(CD/DVD)

    3. Network Boot(PXE- 3Com Boot Services)

     

    The four PreOS are as Follows

    1. PCDos

    2. MSDos

    3. WinPE

    4. Linux

     

    Out of all the four PreOS the best one recommended is WinPE as it has advantages over PCDos and is easier compared to others.

    ** To image using WinPE we should add required drivers for the network and/or storage components to the Boot Wizard

    ** Remember to add Vista 32drivers as the version of WinPE used is based on Vista 32 Kernel

    ** Follow the document mentioned below to add drivers to WINPE

    URL: http://www.symantec.com/docs/TECH110136

     

    To Create image using the three different methods refer these documents

    To Use PXE(Network Boot Option) follow this document

    URL: http://www.symantec.com/docs/TECH110129

    To Use Console to create or restore image follow this document

    URL: http://www.symantec.com/docs/TECH110408

    To create a Bootable CD/DVD and Ghostcast server follow this document

    URL: http://www.symantec.com/docs/TECH110729

     

    Here is the video tutorial on adding drivers to WINPE

    URL: http://www.symantec.com/connect/videos/adding-vista-driver-nic-windows-pe-ghost-solution-suite-251

    Hope this helps