Ghost Solution Suite

I am creating Ghost images of Windows OS(system drive) for deployment on multiple systems. In order to improve performance, I am thinking of defragmenting the OS drive before creating ghost image of it. Before doing it, I executed degragmentor software on a system on which I applied the Ghost image. The application reported that defragmentation is not necessary.

So, my question here is, Is Ghost image by default a defragmented image?

When creating a partition image, Ghost works by imaging files - therefore there is an implicit defragmentation going on as the file segments are gathered from the sectors they are stored on and held as a single file and not as sector images. When restoring, the files are laid down sequentially so there should be minimal, if any, fragmentation.  

Of course, there are other switches which can be used with Ghost which change the way that the data is stored. A disk image will record all sectors including empty ones, but I'm assuming you are using partition imaging based on what you are seeing.

One small correction: Ghost Solution Suite disk images are pretty much just a bunch of partition images glommed together, and don't record empty sectors unless you use -ia or -id, much as it doesn't record the content of the pagefile or the hibernation file either.

The other more technical point is that Ghost on NTFS doesn't actually work file by file (as the FAT32 and the ext3 imaging does), but rather because it was written when the structure of NTFS wasn't as well-explored as it is today some 15 years later it works more at the level of MFT records. Now, ideally MFT records do map very roughly simply to files, but they aren't *exactly* the same thing.

This affects how Ghost "defragments"; any data clusters which are referred to by an MFT record are by default laid out on disk contiguously. However, Ghost generally doesn't rewrite the MFT attribute *structures* to reflect this simplified layout, but leaves them as is. For most volumes, this doesn't matter very much as non-contiguous data runs are the most visible kind of fragmentation and the most harmful to performance.

However, it's sometimes important to understand that NTFS file expansion goes through many levels of structural complexity; so, although Ghost winds back files to (mostly) being laid out in a simple way on disk, it doesn't completely eliminate the structural complexities that have arisen. Most of the time this doesn't matter, because the later stages of this process only happen when disks are constantly run at critically low levels of free space with a lot of file turnover, and images created to master systems (which is most of what Ghost is used for) generally aren't built that way anyway.

So in general, Genuine Ghost does defragment (although remember that Norton Ghost is different, it's not genuine Ghost, and is a sector imager that not only preserves fragmentation, but sometimes even introduces it), and it's mostly pointless running defragmentation tools before capture because in order for defragmentations tools to work properly you need a fair amount of free disk space -and if you have that much free disk space then then the level of fragmentation will almost always be pretty small anyway.