Ghost Solution Suite

Someone in my department accidentally deleted some of our spanned ghost images.  By using an undelete program, I was able to restore some of the files, but not the gho file for the image that I need.  Is there any way to restore data from a ghs file if the gho file is not present?  I'm hoping that the data that I need may be located in one of the ghs files that I was able to undelete.

It'd be extremely difficult to recover much data without the first span; there's a lot of data about the image itself stored in the initial image header that isn't replicated elsewhere in the span set.

Since the image index that Ghost Explorer uses is actually at the end of the image, it's in theory conceivable that we could perhaps use that to get a partial recovery done, but we don't have any version of Explorer that is capable of working without the initial span being present and without having actually tried building that capability into a tool I'm only speculating that we'd be able to get much of anything useful out, and it'd take us a chunk of developer time to build the recovery tools :-(

Hello,

I have a similair situation. So I started to create the tool myself because it is not available. I have a non compressed image from a NTFS partition. With a hex editor I can read parts of the information. Ik think it is possible to extract the data from the GHS files.  I found out you use the word FILE0 like a sort of split between files (or directories). Also directories are included and all they consist is a list of files underneath that directory.

I found out that both the dosname (in 8.3 format) and the full name are in the header of a file (I see a file as all the information between FILE0 ..... FILE0 At least as far as I can see all data is in between). I found out you use 1 byte to denote the length of the file (for both the dos aswell as the full filename). In between the names are most of the times bytes with value 0. Also the file length is stored as hex value in the header but in reverse order. For instance the values : 9897 denotes the hexvalue : 9798 = 8 + 9*16 + 7*16*16 + 9 * 16*16*16 = 39808 bytes.

The troubles I have is that this information is not always at a fixed place within the header. Could you maybe give me some more information about this so I could continue with my tool.

For instance what are the splitters between chunks of information. How come not always a 00 is between filenames, where is file length start and is it always a fixed number of information (I guess 4 bytes).

I hope you could help me, but I understand if you won't because it might be considered as valuable company information. And I don't know wheter you like it that I try to create my own tool, but I just need the information and I know it is in there and I could extract it without the .gho.

sorry got it wrong, posted a new topic in stead