View previous topic :: View next topic |
Author |
Message |
kramer2718 Tux's lil' helper


Joined: 24 Mar 2006 Posts: 78
|
Posted: Sun Jul 16, 2006 2:56 am Post subject: Mounting Ghost images |
|
|
Hi. I've got Linux running decently one my laptop (still working on WPA, but that's another issue...).
Anyway, I'd like to put Windows back on it, but it came with one f those crappy OEM versions of windows which will format the entire drive if I install it normally. After browsing the installation CD, I believe that the OS resides in one of several .ghs files or possibly a .gho file. I'd like to mount these files so that I can browse them to see which one to install. Can anyone explain how to do this?
I would also need to install the required file onto the partition that is reserved for Windows.
Any help would be appreciated. _________________ God save us from His followers. |
|
Back to top |
|
 |
i92guboj Bodhisattva


Joined: 30 Nov 2004 Posts: 10315 Location: Córdoba (Spain)
|
Posted: Sun Jul 16, 2006 3:04 am Post subject: |
|
|
I remember someone looking for the same thing in these forums, and AFAIK he never got a solution.
I doubt that thing has changed, since the ghost format is propietary, close, and symantec is not willing to provide the specifications. Thing would be different is more people had this need hehe, surely someone could reverse it to make a kernel fs module, or something, but as far as I know such a thing does not exist for ghost files.
I 'd like to be wrong... |
|
Back to top |
|
 |
kramer2718 Tux's lil' helper


Joined: 24 Mar 2006 Posts: 78
|
Posted: Sun Jul 16, 2006 3:18 am Post subject: |
|
|
Hmm. I hope you are wrong, too. Anyone know anything different? Anyone have any idea about a work around? _________________ God save us from His followers. |
|
Back to top |
|
 |
phorn Tux's lil' helper

Joined: 01 Jul 2006 Posts: 109
|
Posted: Sun Jul 16, 2006 7:47 am Post subject: |
|
|
First of all, it would be easier to use ghost to do this, since that's probably how you created them.
Most likely, unless you used compression when you created the ghost images, they will be stored in the file, at a certain offset.
I recommend using a hex editor to do this.
I have had different experiences with many editors for things like this.
You can try ghex2, hexedit (console), and probably a number of other ones.
You may want to extract the first megabyte or so from the file:
Code: | head -c 1000000 image_file.gho > header.bin |
I'm not sure if the gho or ghs is correct. You will have to do an ls -l and see which file actually contains data (the one that is hundreds of megabytes)
Now, once you hexedit the header.bin (so that it doesn't overload the hexeditor -- some load the whole file into memory), you will need to look for signatures.
So that you can compare, here is an example fat32 partition and a NTFS partition.
Here is the beginning of my FAT32 partition. Code: | 00000000 EB 58 90 4D 53 57 49 4E 34 2E 31 00 02 40 20 00 .X.MSWIN4.1..@ .
00000010 02 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 ........?...?...
00000020 82 91 A8 04 44 25 00 00 00 00 00 00 02 00 00 00 ....D%..........
00000030 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 80 00 29 F4 6F CA BE 4E 4F 20 4E 41 4D 45 20 20 ..).o..NO NAME
00000050 20 20 46 41 54 33 32 20 20 20 33 C9 8E D1 BC F4 FAT32 3..... |
Here is the beginnning of my NTFS partition. Code: | 00000000 EB 52 90 4E 54 46 53 20 20 20 20 00 02 01 00 00 .R.NTFS .....
00000010 00 00 00 00 00 F8 00 00 20 00 02 00 01 00 00 00 ........ .......
00000020 00 00 00 00 80 00 80 00 FE 27 00 00 00 00 00 00 .........'......
00000030 20 00 00 00 00 00 00 00 FF 13 00 00 00 00 00 00 ...............
00000040 02 00 00 00 08 00 00 00 69 63 93 20 69 93 20 C2 ........ic. i. .
00000050 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 .....3.....|....
00000060 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 ..........3..... |
So what I recommend doing is searching for "NTFS" or "MSWIN", depending on if it is FAT or NTFS (searching for both won't hurt).
Then, that string is offset 3 bytes in front of the start of the partition, so go back 3 bytes from there, and that is your offset.
If you had this Code: | 000098A0 20 20 20 00 02 01 00 00 20 EB 52 90 4E 54 46 53 ..... .R.NTFS |
The offset would be 0x98A0 + 9 = 0x98A9 -- using a calculator to convert 0x98A9 from hex to decimal gives 39081
That's the first part. Usually, when I have used ghost, it has given me a lot of files like 1.ghs, 2.ghs, etc. (or it may have been 1.gho 2,gho... not sure)
cat *.ghs > partition.bin
If there is only one file, then you can avoid the cat part (and then you don't need harddrive space to do it)
Then, you can mount the partition as a loopback device with an offset. Code: | mount -o loop,offset=39081 /path/to/partition.bin /mnt/temp |
And then you can pull the data off the mount point.
Of course, if it is compressed then it's a different story. That is much harder to do.
Anyway good luck. |
|
Back to top |
|
 |
i92guboj Bodhisattva


Joined: 30 Nov 2004 Posts: 10315 Location: Córdoba (Spain)
|
Posted: Sun Jul 16, 2006 8:09 am Post subject: |
|
|
I never tried anything like that, but maybe you can run ghost under wine. It has a DOS based part, I think that, at least that, should run ok under wine or dosemu... Never tried it myself, though. Just came to my mind five minutes ago and I figured that maybe it would worth to try it. |
|
Back to top |
|
 |
kramer2718 Tux's lil' helper


Joined: 24 Mar 2006 Posts: 78
|
Posted: Tue Jul 18, 2006 4:56 pm Post subject: |
|
|
Thanks for the thoughts guys. I wish that I had created the images myself. Then I could get them back easily. Actually they came as part of a recovery disk that Toshiba (stay away from Toshiba, guys) sent with my laptop.
As to doing ls -l to see which file actually had the data, I tried that. The strange thing is that several of the files had file sizes in excess of 600MB!
Strange, huh? I can only guess that some are hard links (which I didn't know were possible under iso 9660). It gets even weirder, though. The large files don't have the same sizes! Toshiba is doing some strange things with their filesystem.
Another option that has occured to me but which I haven't had time to try is to reverse engineer Toshibas recovery cd to use whatever mechanism they use to extract the Ghost images. That could be a serious pain in the ass, but it would be sweet to distribute a reasonable to use Toshiba recovery CD. _________________ God save us from His followers. |
|
Back to top |
|
 |
devsk Advocate


Joined: 24 Oct 2003 Posts: 3003 Location: Bay Area, CA
|
Posted: Thu Aug 31, 2006 12:56 am Post subject: |
|
|
it may be pretty late but one option is to extract and restore ghost images inside vmware. you can download a win98 dos install with CDROM driver and install it within VMWare. Re-partition your main hard drive using livecd and make the first primary partition as big as you want to give to windows xp. Restore your linux onto other partitions. Run vmware in linux, add the physical disk to the win98 virtual machine and boot the win98 VM. Then, insert your CD and find the ghost.exe on the CD and run it. Save the image partition onto the first partition of your main hard drive. You should now be able to modify grub to boot XP from 1st partition. |
|
Back to top |
|
 |
daddio Tux's lil' helper


Joined: 11 Oct 2003 Posts: 145 Location: Orem, UT
|
Posted: Mon Sep 11, 2006 2:34 pm Post subject: Reinstall windows |
|
|
Again this reply may come WAAAY too late, but you don't need toshiba's restore disks unless you simply must have the silly applications (MS Works Suite anyone?) that they may have thrown in. You need a windows XP OEM disk, (NOT Retail, Not upgrade and Not the infamous corporate/bulk license). If you know someone with a custom PC they probably have it and could burn you a copy, or a smaller computer shop might be willing to burn you a copy for a fee.
It would work with the OEM sticker on the bottom of your laptop
You would still need to get drivers from toshiba... but |
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
|