Can Norton Ghost read raw format image files ?

  • Thread starter Thread starter david.balazic
  • Start date Start date
D

david.balazic

I have an image of a hard disc in raw format (1:1 copy of all sectors
in a single file, created with /bin/dd, no header, no compression).

Does Ghost support image files like this ?
What about Acronis TrueImage or other programs ?
Is there a program that can convert this file to some other format
(Ghost , Acronis) ?

What I want is to browse the content of the saved partitions (they are
NTFS) and copy out a few files.

I can not restore the image to the disc, because I don't have that (or
other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
partitions).

Thanks for any reply,
David
 
I have an image of a hard disc in raw format (1:1 copy of all sectors
in a single file, created with /bin/dd, no header, no compression).

Does Ghost support image files like this ?
Click to expand...

I think not.
What about Acronis TrueImage or other programs ?
Click to expand...

I think not. Maybe some forensic suite, Encase and such that can.
Is there a program that can convert this file to some other format
(Ghost , Acronis) ?
Click to expand...

I think not.
What I want is to browse the content of the saved partitions (they are
NTFS) and copy out a few files.
Click to expand...

There are open source (NT/2000/XP) drivers around that can mount raw image
files and assign them a drive letter.
I can not restore the image to the disc, because I don't have that (or
other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
partitions).
Click to expand...

But it's one file on a hard disk? Or spread accros multiple disks? If the
latter I do not think the drivers I mentioned will work. I dot have a URL
handy .... HD Workbench from www.diydatarecovery.nl comes with a driver, you
just rename your file to an extension HD Workbench recognizes. Wait, found
the URL: http://www.acc.umu.se/~bosse/, look for FileDisk.
 
Since you have a disk image, not a volume image, there are few tools.

If you examine the partition table, you can extract primary parts.
For example, this copies 8GB of the first primary.

dd if=image of=first.img bs=63b count=254 skip=1
dd if=image of=/dev/hdc1 bs=63b count=254 skip=1

Note: hdc is a scratch disk. You can use of=//./X: on WinNT.
The volume image first.img can be mounted on WinNT with filedisk,
or opened with some image browsers. WinImage will open FAT images.
 
Eric Gisin said:
Since you have a disk image, not a volume image, there are few tools.
Click to expand...

Whoops! Indeed, the drivers I mentioned in above message will not work then.
 
Whoops! Indeed, the drivers I mentioned in above message will not work then.
Click to expand...

Just make a virtual machine with VMWare or Virtual PC, then use dd to
restore the image to the virtual machine, and extract your files.
 
Michael Cecil said:
then.

Just make a virtual machine with VMWare or Virtual PC, then use dd to
restore the image to the virtual machine, and extract your files.
--
Click to expand...

You'd need VMWare or VirtualPC for that obviously ...
 
Eric Gisin said:
Since you have a disk image, not a volume image, there are few tools.

If you examine the partition table, you can extract primary parts.
For example, this copies 8GB of the first primary.
Click to expand...
I meant 8MB. The partition table has offset and length values.
Use offset/63 for skip value, and length/63 for count value.
 
I am developing a program that will do this - and currently looking for
Beta testers. If you would like a free try then download the program
from www.cnwrecovery.com and e-mail me the machine key and I will send
you a code to do what you want. The program is currently Beta for
Memory chip recovery, but probably Alpha for NTFS. - hence
documentation wizard etc are not very good for NTFS recovery. It is an
XP, 2000 program

Michael
 
Wow!

Folkert is still alive. Annoying as always. How old is he now ? 40 ? 50
?

This sure brings back memories . . . .

;)
 
Wow!

Folkert is still alive.
Click to expand...

I hope that wasn't some sort of invitation.

So, who did rise you from the dead then?
Annoying as always. How old is he now ? 40 ? 50
?

This sure brings back memories . . . .
Click to expand...

Oh, and thanks for responding to me and not anyone else,
showing what the real intention of your question was.
 
Great thanks.

I already tried to extract individual partition and they don't work.
I also tried to restore the image to a virtual disk in VMWare nd it
does not work there anyway ( Widows install CD or bartPE CD wont even
boot if the restored HD is present on the emulated system ... ).
I will now try to get the original har drive back and try to restore to
it.

Regards,
David
 
I have an image of a hard disc in raw format (1:1 copy of all sectors
in a single file, created with /bin/dd, no header, no compression).

Does Ghost support image files like this ?
What about Acronis TrueImage or other programs ?
Is there a program that can convert this file to some other format
(Ghost , Acronis) ?
Click to expand...

Not with Ghost or Acronis.
What I want is to browse the content of the saved partitions (they are
NTFS) and copy out a few files.

I can not restore the image to the disc, because I don't have that (or
other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
partitions).
Click to expand...

Try with Knoppix CD. I had some good success with it.
I had a dd image of /dev/hda1 saved in temporary attached
/dev/hdb1/hda1image.img.

Boot Knoppix CD ver 3.9
Launch terminal.
Create a mount point for your image:
mkdir /mnt/hdz1
Mount second disk containing image:
mount -o rw /dev/hdb1 /mnt/hdb1
Mount disk image:
mount -o loop /mnt/hdb1/hda1image.img /mnt/hdz1

Launch File Manager in Super User mode and peruse /mnt/hdz1

You should be able to see and copy files from your disk image.
 
Back
Top