Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Mounting Ghost images
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Other Things Gentoo
View previous topic :: View next topic  
Author Message
kramer2718
Tux's lil' helper
Tux's lil' helper


Joined: 24 Mar 2006
Posts: 78

PostPosted: Sun Jul 16, 2006 2:56 am    Post subject: Mounting Ghost images Reply with quote

Hi. I've got Linux running decently one my laptop (still working on WPA, but that's another issue...).

Anyway, I'd like to put Windows back on it, but it came with one f those crappy OEM versions of windows which will format the entire drive if I install it normally. After browsing the installation CD, I believe that the OS resides in one of several .ghs files or possibly a .gho file. I'd like to mount these files so that I can browse them to see which one to install. Can anyone explain how to do this?

I would also need to install the required file onto the partition that is reserved for Windows.

Any help would be appreciated.
_________________
God save us from His followers.
Back to top
View user's profile Send private message
i92guboj
Bodhisattva
Bodhisattva


Joined: 30 Nov 2004
Posts: 10315
Location: Córdoba (Spain)

PostPosted: Sun Jul 16, 2006 3:04 am    Post subject: Reply with quote

I remember someone looking for the same thing in these forums, and AFAIK he never got a solution.

I doubt that thing has changed, since the ghost format is propietary, close, and symantec is not willing to provide the specifications. Thing would be different is more people had this need hehe, surely someone could reverse it to make a kernel fs module, or something, but as far as I know such a thing does not exist for ghost files.

I 'd like to be wrong...
Back to top
View user's profile Send private message
kramer2718
Tux's lil' helper
Tux's lil' helper


Joined: 24 Mar 2006
Posts: 78

PostPosted: Sun Jul 16, 2006 3:18 am    Post subject: Reply with quote

Hmm. I hope you are wrong, too. Anyone know anything different? Anyone have any idea about a work around?
_________________
God save us from His followers.
Back to top
View user's profile Send private message
phorn
Tux's lil' helper
Tux's lil' helper


Joined: 01 Jul 2006
Posts: 109

PostPosted: Sun Jul 16, 2006 7:47 am    Post subject: Reply with quote

First of all, it would be easier to use ghost to do this, since that's probably how you created them.

Most likely, unless you used compression when you created the ghost images, they will be stored in the file, at a certain offset.

I recommend using a hex editor to do this.
I have had different experiences with many editors for things like this.
You can try ghex2, hexedit (console), and probably a number of other ones.

You may want to extract the first megabyte or so from the file:
Code:
head -c 1000000 image_file.gho > header.bin


I'm not sure if the gho or ghs is correct. You will have to do an ls -l and see which file actually contains data (the one that is hundreds of megabytes)

Now, once you hexedit the header.bin (so that it doesn't overload the hexeditor -- some load the whole file into memory), you will need to look for signatures.

So that you can compare, here is an example fat32 partition and a NTFS partition.

Here is the beginning of my FAT32 partition.
Code:
00000000   EB 58 90 4D  53 57 49 4E  34 2E 31 00  02 40 20 00  .X.MSWIN4.1..@ .
00000010   02 00 00 00  00 F8 00 00  3F 00 FF 00  3F 00 00 00  ........?...?...
00000020   82 91 A8 04  44 25 00 00  00 00 00 00  02 00 00 00  ....D%..........
00000030   01 00 06 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000040   80 00 29 F4  6F CA BE 4E  4F 20 4E 41  4D 45 20 20  ..).o..NO NAME
00000050   20 20 46 41  54 33 32 20  20 20 33 C9  8E D1 BC F4    FAT32   3.....

Here is the beginnning of my NTFS partition.
Code:
00000000   EB 52 90 4E  54 46 53 20  20 20 20 00  02 01 00 00  .R.NTFS    .....
00000010   00 00 00 00  00 F8 00 00  20 00 02 00  01 00 00 00  ........ .......
00000020   00 00 00 00  80 00 80 00  FE 27 00 00  00 00 00 00  .........'......
00000030   20 00 00 00  00 00 00 00  FF 13 00 00  00 00 00 00   ...............
00000040   02 00 00 00  08 00 00 00  69 63 93 20  69 93 20 C2  ........ic. i. .
00000050   00 00 00 00  FA 33 C0 8E  D0 BC 00 7C  FB B8 C0 07  .....3.....|....
00000060   8E D8 E8 16  00 B8 00 0D  8E C0 33 DB  C6 06 0E 00  ..........3.....

So what I recommend doing is searching for "NTFS" or "MSWIN", depending on if it is FAT or NTFS (searching for both won't hurt).

Then, that string is offset 3 bytes in front of the start of the partition, so go back 3 bytes from there, and that is your offset.
If you had this
Code:
000098A0   20 20 20 00  02 01 00 00  20 EB 52 90 4E  54 46 53     ..... .R.NTFS

The offset would be 0x98A0 + 9 = 0x98A9 -- using a calculator to convert 0x98A9 from hex to decimal gives 39081

That's the first part. Usually, when I have used ghost, it has given me a lot of files like 1.ghs, 2.ghs, etc. (or it may have been 1.gho 2,gho... not sure)
cat *.ghs > partition.bin

If there is only one file, then you can avoid the cat part (and then you don't need harddrive space to do it)

Then, you can mount the partition as a loopback device with an offset.
Code:
mount -o loop,offset=39081 /path/to/partition.bin /mnt/temp


And then you can pull the data off the mount point.

Of course, if it is compressed then it's a different story. That is much harder to do.

Anyway good luck.
Back to top
View user's profile Send private message
i92guboj
Bodhisattva
Bodhisattva


Joined: 30 Nov 2004
Posts: 10315
Location: Córdoba (Spain)

PostPosted: Sun Jul 16, 2006 8:09 am    Post subject: Reply with quote

I never tried anything like that, but maybe you can run ghost under wine. It has a DOS based part, I think that, at least that, should run ok under wine or dosemu... Never tried it myself, though. Just came to my mind five minutes ago and I figured that maybe it would worth to try it.
Back to top
View user's profile Send private message
kramer2718
Tux's lil' helper
Tux's lil' helper


Joined: 24 Mar 2006
Posts: 78

PostPosted: Tue Jul 18, 2006 4:56 pm    Post subject: Reply with quote

Thanks for the thoughts guys. I wish that I had created the images myself. Then I could get them back easily. Actually they came as part of a recovery disk that Toshiba (stay away from Toshiba, guys) sent with my laptop.

As to doing ls -l to see which file actually had the data, I tried that. The strange thing is that several of the files had file sizes in excess of 600MB!

Strange, huh? I can only guess that some are hard links (which I didn't know were possible under iso 9660). It gets even weirder, though. The large files don't have the same sizes! Toshiba is doing some strange things with their filesystem.

Another option that has occured to me but which I haven't had time to try is to reverse engineer Toshibas recovery cd to use whatever mechanism they use to extract the Ghost images. That could be a serious pain in the ass, but it would be sweet to distribute a reasonable to use Toshiba recovery CD.
_________________
God save us from His followers.
Back to top
View user's profile Send private message
devsk
Advocate
Advocate


Joined: 24 Oct 2003
Posts: 3003
Location: Bay Area, CA

PostPosted: Thu Aug 31, 2006 12:56 am    Post subject: Reply with quote

it may be pretty late but one option is to extract and restore ghost images inside vmware. you can download a win98 dos install with CDROM driver and install it within VMWare. Re-partition your main hard drive using livecd and make the first primary partition as big as you want to give to windows xp. Restore your linux onto other partitions. Run vmware in linux, add the physical disk to the win98 virtual machine and boot the win98 VM. Then, insert your CD and find the ghost.exe on the CD and run it. Save the image partition onto the first partition of your main hard drive. You should now be able to modify grub to boot XP from 1st partition.
Back to top
View user's profile Send private message
daddio
Tux's lil' helper
Tux's lil' helper


Joined: 11 Oct 2003
Posts: 145
Location: Orem, UT

PostPosted: Mon Sep 11, 2006 2:34 pm    Post subject: Reinstall windows Reply with quote

Again this reply may come WAAAY too late, but you don't need toshiba's restore disks unless you simply must have the silly applications (MS Works Suite anyone?) that they may have thrown in. You need a windows XP OEM disk, (NOT Retail, Not upgrade and Not the infamous corporate/bulk license). If you know someone with a custom PC they probably have it and could burn you a copy, or a smaller computer shop might be willing to burn you a copy for a fee.

It would work with the OEM sticker on the bottom of your laptop

You would still need to get drivers from toshiba... but
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Other Things Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum