Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

Cannot create a good disk image from a.gho file

- - - - -

  • Please log in to reply
41 replies to this topic

#1
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag
I created an image of a HDD, in an external enclosure, with Ghost v11.0.2.1573 under WinXP SP2, then:
- wiped the HDD
- restored the .gho image onto the same HDD
- inserted the restored HDD back into the original computer

BUT:
1) System Commander v9.04 on the restored HDD comes up and detects a new operating system (i.e. the boot code is not what it was originally). Regardless of what I select, Save or Bypass, System Commander eventually stops loading any operating system at all and displays a cryptic err msg "Error Boot 2>" or similar. This may be caused by System Commander detecting a changed partition table. I had not changed an obscure default setting in System Commander, effective for WinNT thru 2003 [not for Vista], "Automatic Win Boot Repair" enabled, instead of disabling it. In any case, System Commander does not work with a HDD restored from a .gho file. System Commander is my preferred boot manager, and I have been using it for about 14 years.

2) When I checked the restored HDD with Partition Table Doctor v3.5 under Win98 it didn't find anything wrong. But PartitionMagic v8.01 displayed 10x [maybe because of 8 logical partitions + 1 extended partitions + unallocated space??] the err msg: "Error 114 on the partition starting at sector xxxx. The EPBR is not positioned at the beginning of a cyclinder. If this is not corrected the operating system could cause data loss. PowerQuest Partion Magic can easily fix this problem by moving the EPBR to sector yyyy." If I don't let PartitionMagic fix this, the HDD is displayed as "BAD" by PartitionMagic. If I fix it, I get 10 msgs: "Success. The partition table error was successfully fixed!".

3) Furthermore, FAT32 partitions, originally having 2k clusters, now had 4k clusters. Also, an NTFS partition, originally in NTFS 3.00 format [Win2k], now had NTFS 3.01 format (WinXP]

The original HDD was partitioned in an external enlosure with PartitonMagic v8.01, before WinXP was installed onto it on H:. The cluster sizes were set automatically by PartitionMagic. This is the partition layout:
C: BOOT_FAT16 FAT 2.047.3 Active Primary 32k
D: BLANK1 FAT32 2.047.3 Logical 2k
E: BLANK2 FAT32 2.047.3 Logical 2k
F: DIAG_FAT32 FAT32 8.189.4 Logical 4k
G: 98_FAT32 FAT32 12.284.0 Logical 8k
H: XP_FAT32 FAT32 30.710.2 Logical 16k
I: SWAP_FAT32 FAT32 15.359.0 Logical 8k
J: DATA_FAT32 FAT32 40.946.9 Logical 32k
K: DATA_NTFS NTFS [v3.0] 30.710.2 Logical Default=4k
Unallocated [for Linux etc] 50.124.7

I had created and restored the .gho image under WinXP SP2 via a desktop shortcut with the following target:
H:\Ghost\ghost32.exe -z9 -ib -szee -fatlimit -fdsp -align=chs -fmbr

Why can Ghost not create a useful image? Did I miss any parameters?

I did not use the sector-by-sector forensic -id option because creating and restoring an image in this "forensic" way may take 24 hours, with unknown results.

Is there other software which actually can clone from a file a HDD containing tricky boot code by System Commander, and which doesn't alter important partition characteristics?


How to remove advertisement from MSFN

#2
submix8c

submix8c

    Inconceivable!

  • Patrons
  • 4,279 posts
  • OS:none specified
  • Country: Country Flag
Have you tried -
-clone,mode=create,src=n,dst=x:\backup.gho
src is the source disk#, dst is the path/name of the cloned disk image
This is what Ghostcast is automatically inserting, so... And as I remember, restoring to a different size HDD worked (not sure if it handles smaller).

This assumes you're not backing up a "running system" and not backing a disk onto itself (naturally). My understanding is that only Ghost System Suite can back up a "running system". Look into the docs on the "clone+mode" switches to see if this works better. (?Checked and I believe your version is GSSv2.0?)

Kind of confused as to the errors (don't use the other software mentioned)...

HTH

Edited by submix8c, 08 January 2010 - 12:41 PM.

Someday the tyrants will be unthroned... Jason "Jay" Chasteen; RIP, bro!

Posted Image


#3
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Supervisor
  • 5,862 posts
  • OS:98SE
  • Country: Country Flag

Donator

I had created and restored the .gho image under WinXP SP2 via a desktop shortcut with the following target:
H:\Ghost\ghost32.exe -z9 -ib -szee -fatlimit -fdsp -align=chs -fmbr

Why can Ghost not create a useful image? Did I miss any parameters?

I did not use the sector-by-sector forensic -id option because creating and restoring an image in this "forensic" way may take 24 hours, with unknown results.

And that's where things went wrong... But even "-id" is simply not enough, if you want to be 100% sure. If you already knew System Commander creates unusual structures, you should have used "-z9 -ir" for, in the raw mode ghost makes no assumptions whatsoever and copies everything sector-by-sector. This is as guaranteed to work, when you put it back, as it can get. Then again, in this case, there would be no point in wiping the disk because, as you put the image back, all the trash (such as the contents of file slack and non-partition unused areas) will get back in, too. You can't both have your cake and eat it, you know.

#4
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag

-clone,mode=create,src=n,dst=x:\backup.gho
src is the source disk#, dst is the path/name of the cloned disk image.

Hi submix8c,
Thanks for your suggestion, I'll try it out tomorrow, I am stuck right now emptying a 750GB PATA drive for further experimentation with the image restores. I currently don't have any other empty PATA HDD for testing the image restore, only empty SATA drives :angry: Yes, I am not backing up a running system, but have removed the HDD and put it into a USB enclosure, to be cloned/restored on a 2nd computer.

(?Checked and I believe your version is GSSv2.0?)

Yes, kind of, it consists of a set of files from the live update to v11.0.2.1573 of an older legal version. Works under Win98 and WinXP from a single set of files, no installation. Under WinXP this set of files had cloned fine another HDD (of an Asus Eee with a special non-MS partition type), but under Win98 there were issues cloning the Asus HDD, that's why I cloned the System Commander HDD under WinXP.

Kind of confused as to the errors ([I] don't use the other software mentioned)

These errors are mainly relevant in a multi-booting environment. When I put the badly cloned HDD in a USB enclosure and ran Checkdisk under WinXP, WinXP found everything Ok. But WinXP Checkdisk does NOT check whether the HDD layout is compatible with other operating systems.

My main operating system is Win98SE. I use 2 programs under Win98SE to check whether a HDD has a clean layout, compatible with Win98:
- PowerQuest PartitionMagic v.8.01, which is the ultimate tool for checking Win98 compatibility (it has a 192GB FAT32 partition size limit, which I am also respecting, mainly because Xrayer also uses 192GB partitions)
- Partition Table Doctor v3.5, which can fix errors reported by PartitionMagic, but which PartitionMagic cannot fix (e.g. disk geometry errors)

2 years ago I had installed Vista on my desktop, onto a primary partition on the 2nd HDD, keeping the layout of the 1st HDD (a primary FAT16 partition + several logical partitions for Win98, XP etc). I removed Vista again because PowerQuest PartitionMagic v8.01 and Partition Table Doctor v3.5 were not able to handle the Vista partition type. Eventually I'll try to install Vista and Win7 again, but this time into LOGICAL FAT32 partitions on the 1st HDD. There is a good chance that System Commander, R.I.P., will be able to do it.

#5
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag

But even "-id" is simply not enough, if you want to be 100% sure. If you already knew System Commander creates unusual structures, you should have used "-z9 -ir" for, in the raw mode ghost makes no assumptions whatsoever and copies everything sector-by-sector. This is as guaranteed to work, when you put it back, as it can get.

Hi dencorso, I did read the docu of the Ghost "-ir" switch (p.476) before starting my imaging/restoring attempts:
"The image raw switch copies the entire disk, ignoring the partition table. This is useful when a disk does not contain a partition table in the standard PC format, or you do not want partitions to be realigned to track boundaries on the destination disk. Some operating systems may not be able to access unaligned partitions."

I guess I was wrong in interpreting this to mean that the original partition table does not get copied (I assumed "ignoring" means "except"). This might apply to UDF-formatted HDDs, which contain no partition table.

My System Commander HDD probably contains a "partition table in standard PC format", whatever that means. If I:
- create with Partition Table Doctor 3.5 a "Backup partition table'" file on a floppy of a System Commander HDD
- then remove the System Commander HDD from the 1st computer
- insert the System Command HDD in an USB enclosure of a 2nd PC
- in that 2nd PC, under Win98, Clear the System Commander HDD with Acronis Disk Director + reboot (i.e. the whole HDD is unallocated now)
- power up the 2nd PC and restore the "Backup partition table" from the floppy with Partition Table Doctor 3.5
RESULT: The System Commander HDD with the restored "Backup partition table" works fine again, so it should probably have a "partition table in standard PC format".

Are you sure that Ghost with "-ir" copies the partition table via sector-by-sector copying of the entire disk, and that the partition table is not skipped?

Is it possible to image/restore the 1st primary partition (=boot partition) sector-by-sector, and the remaining partitions in the normal way? With a single image file for the whole disk, in one step?

Then again, in this case, there would be no point in wiping the disk because, as you put the image back, all the trash (such as the contents of file slack and non-partition unused areas) will get back in, too. You can't both have your cake and eat it

Is there some reliable software which can wipe unneeded leftovers, before creating an image with Ghost? This would at least keep the size of the resulting compressed archive file smaller.

Edited by Multibooter, 08 January 2010 - 06:13 PM.


#6
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,390 posts
  • OS:none specified
  • Country: Country Flag
If I may, the whole problem is about "assumptions".

  • Partition Magic "assumes" that certain limits/boundaries/settings are "wrong"
  • Ghost "assumes" that a given filesystem "needs" to have a given cluster size
  • System Commander probably "assumes" something yet different.
  • XP formatting/partitioning utilities have different "assumptions"
  • Vista/Win 7 formatting/partitioning utilities have different "assumptions"
(and though inaccessible at this time, due to boot-land problems, there is a recent thread where we are trying to understand, at least partly, some of these assumptions)

You won't be able to install Vista/Win 7 directly on FAT32, AFAIK:

Wiping unused space is a possibility:
http://www.cezeo.com.../disk-redactor/
http://eraser.heidi....s/20091215.html
http://sourceforge.n.../wipefreespace/
http://www.somacon.com/p336.php
http://www.killdisk.com/

jaclaz

#7
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag
Hi jaclaz, I am so glad that you joined in.

I have tried out Clonezilla, recommended by net user in his posting #2 at the parallel topic http://www.msfn.org/...tml#entry902053
Clonezilla clones the System Commander HDD from an image file with much better results than Ghost:
1) PartitionMagic v8.01 does not find anything wrong with the HDD produced by Clonezilla, in contrast to the HDD produced by Ghost
2) Clonezilla reproduced the two FAT32 partitions correctly in the original cluster size (2k), while Ghost changed the cluster size to 4k
3) Clonezilla, like Ghost, changed the partition type from NTFS 3.00 to NTFS 3.01
4) The image file produced by Clonezilla was about 50% smaller than the image file produced by Ghost

Unfortunately, the HDD produced from an image file by Clonezilla, did NOT work either. System Commander still came up with the window "Possible new operating system detected". I guess this window is loaded by a component program of System Commander, CHKMBR.EXE, which "verifies that System Commander's MBR has not been destroyed by a new OS installation and corrects the condition if necessary". So CHKMBR.EXE detected something on the cloned HDD which led it to believe that the "System Commander's MBR", whatever that is, had been destroyed.

When CHKMBR.exe detects "a new operating system", I select "Bypass". The "OS [=operating system] Selection Menu" then comes up, as usual. But when I select the last active operating system (e.g. Windows XP), I get an err msg "NTLDR missing", then "Boot 2> error". Then all files were gone from C:, C: was corrupted with 2 different FATs.

When I select "Save", instead of "Bypass", and then select the newly detected operating system, Windows XP loads Ok. But when I reboot and then select in the "OS Selection Menu" any of the previously existing operating system selections, System Commander goes on its destructive path and damages the boot partition C:, with a similar "Boot B1 error".

The user manual of System Commander v9.04 states (p.289): "The capacity of the MBR is not sufficient to place sophisticated boot programs. This means that the on-boot software uses the entire track 0 of the hard disk in addition to the 0 sector because it's not included in any partition. For example, boot managing utilities such as LILO, GRUB, and VCOM System Commander are located in the 0 track."

I then
- saved the whole track 0 of the original 200GB HDD, inserted in a USB enclosure, with MBRwizard: [mbrwizd /disk=1 /sector=head save=a:\track0.dat /ignore]
- restored the Clonezilla image onto a 750GB HDD
- wiped track 0 of the 750GB HDD [mbrwizd /wipe=head]
- restored track 0 [track0.dat had 32768 bytes] of the original 200GB HDD to the 750GB HDD [mbrwizd /restore=a:\track0.dat /ignore]
BUT: System Commander again detected a new operating system, then the "OS Selection Menu" came up etc, just as without the restored track 0, and then I got the boot error message plus a damaged boot partition C:

The problem might let one think of a sophisticated copy protection scheme, preventing a System Commander HDD from being used on a cloned HDD, but I doubt this was the intention. Also, I don't think that System Commander is reading hardware details from the HDD, since I had the Boot xx error msg also when I restored earlier with Ghost an image back onto the original HDD. In summary: I don't know how to get the various operating system selections to work again on a cloned HDD.

Up to now (except when I installed Vista experimentally on another computer) I have been using ancient System Commander 2000 [v5] and was able to get the opsys selections to work after cloning sector-by-sector from one disk to another [i.e. not from an image file]. The last version 9 of System Commander [I am using here v9.04] claimed to have a "super-hiding feature", to facilitate multitbooting with Vista; could that have something to do with the difficulty to clone/restore a System Commander HDD?

BTW, when I restored the Clonezilla image, 2 msg lines appeared very briefly on the screen, maybe about partitions D and E, it was too fast to write down, something like: "Error, could not create an identical partition... 4294MB... 6410MB")

Wiping unused space is a possibility:
http://www.cezeo.com.../disk-redactor/
http://eraser.heidi....s/20091215.html
http://sourceforge.n.../wipefreespace/
http://www.somacon.com/p336.php
http://www.killdisk.com/

Which one should I try first, before trying to make a sector-by-sector clone? Should I make a sector-by-sector clone with Ghost using the "-ir"switch? I doubt whether Clonezilla can make a sector-by-sector image: "Clonezilla saves and restores only used blocks in the harddisk." http://www.clonezilla.org/

Edited by Multibooter, 09 January 2010 - 01:28 PM.


#8
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,390 posts
  • OS:none specified
  • Country: Country Flag
Any of the above should work allright, I would use killdisk as first approach as it has, if I remember correctly, both a Windows and a Dos version. :unsure:

If you think your experience is crazy, read attentively this (still largely UNresolved):
http://www.boot-land...?...ic=9897&hl=

I am not sure about the 3.00 and 3.01: one of the othere things that everyone "assumes" is about NTFS versions).

Care to explain how you checked the version?

I don't want to "talk bad" about an application I don't really know/used extensively, but I do remember that many, many years ago I did test System Commander and then discarded it forever as it had "queer" ways.

At the time, it was however VERY powerful, nowadays, we have grub4dos and with all due respect System Commander is - to say the least - outdated. :(

I would try to however besides CLONING (with a separate program or whatever as you did) the first 63 hidden sectors (or more) as, if I recall correctly, System Commander uses them (or part of them) AND "backup/restore" the actual partition Volume ID's AND Disk Signature.

It is also possible that System Commander uses some kind of checksum of either MBR or Partition Tables or bootsectors... or whatever, you would need two fresh installations to compare... :ph34r:

Just for your interest, since a couple of unfortunate "accidents", agian MANY years ago, I DO NOT trust either:
  • Partition Magic (since version 3 that worked allright)
  • Acronis apps (for a number of reasons, including their "habit" to install in windows Filter Drivers)

I also never used (if not very, very old versions) of GHOST.

Heck, we have an entire range of freeware, and among them quite a few OpenSource alternatives:
http://www.msfn.org/...f...99.html&hl=

Why not using them? :whistle:

jaclaz

Edited by jaclaz, 09 January 2010 - 01:36 PM.


#9
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Supervisor
  • 5,862 posts
  • OS:98SE
  • Country: Country Flag

Donator

Is there some reliable software which can wipe unneeded leftovers, before creating an image with Ghost? This would at least keep the size of the resulting compressed archive file smaller.

sysinternals sdelete. v.1.5 and later have the "-c" option to zero out the free space (= fill it with zeroes). Zeroed sectors are the best for compression, and you get rid of most of the trash. Only the trash in the file slacks will remain. I still didn't find any app capable of reliably getting rid of that. But cleaning the file slacks is a risky busines, because it can damage useful code or data, if gone wrong.
I suggest you "sdelete -c" each partition first and then ghost the whole disk with "-z9 -ir".
Then again, searching for a reliable freeware capable of doing a blind, full-disk, sector-by-sector copy may be worth it.

#10
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag

I am not sure about the 3.00 and 3.01: one of the othere things that everyone "assumes" is about NTFS versions). Care to explain how you checked the version?

PartionMagic v8.01 -> right-click on NTFS partition -> Properties -> NTFS Version (displays 3.0 [=3.00] for original HDD, 3.1 [=3.01] for cloned HDD. Paragon Partition Manager 9.0 also displays the NTFS version (same results). Acronis Disk Director v10.0.2089 does not display NTFS version information.

I do remember that many, many years ago I did test System Commander and then discarded it forever as it had "queer" ways. At the time, it was however VERY powerful, nowadays, we have grub4dos and with all due respect System Commander is - to say the least - outdated. :(

System Commander does have a learning curve and there are a few essential tricks for using it. For example, I don't use the suggested way of "preparing a new operating system for installation", but my own way.

After System Commander was set up properly, it kept working invisibly for me, without major problems (except for this deployment/cloning problem). I am using 100+ applications on my computer, many of them replacements of older stuff. I have kept only 3 older applications, in use for about 15 years: InfoSelect v3, with my personal notes of the past 15 years, System Commander and DCF. At this stage I don't want to give up on System Commander; I have purchased over the years 4 different versions starting with v2, as a recognition of its usefulness to me.

Even if you don't use System Commander, the 2 docu .pdf files in it may be useful to you as additional reference material about the quirks of PC operating systems.

I would try to however besides CLONING (with a separate program or whatever as you did) the first 63 hidden sectors (or more) as, if I recall correctly, System Commander uses them (or part of them) AND "backup/restore" the actual partition Volume ID's AND Disk Signature.

MBRwizard http://www.mbrwizard.com/ backs up/restores easily only track 0, any other tool you could suggest for easy backing up/restoring of more tracks? How do I back up/restore the actual partition Volume ID's AND Disk Signature?

It is also possible that System Commander uses some kind of checksum of either MBR or Partition Tables or bootsectors... or whatever, you would need two fresh installations to compare... :ph34r:

I had created with Partition Table Doctor 3.5 a "Partition table backup" of the original System Commander HDD and of the HDD cloned/restored with Ghost, and then made a binary compare of the 2 partition table backup files (10240 bytes each) with Beyond Compare, and there were many differences.

I DO NOT trust either Partition Magic ... Acronis apps ... I also never used ... GHOST.

PartitionMagic 8.01 does give phony error messages. I have 3 partitioning utilities installed (PartitionMagic, Paragon Partition Manager and Acronis Disk Director), because none of them works to my full satisfaction. I would be glad if a single partitioning utility were fully satisfactory. I have just recently used Ghost again, and am a little disappointed with the results here.

we have an entire range of freeware, and among them quite a few OpenSource alternatives:
http://www.msfn.org/...f...99.html&hl=
Why not using them? :whistle:

Which one would you suggest for my next cloning attempt of the System Commander HDD?

Edited by Multibooter, 09 January 2010 - 06:26 PM.


#11
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag

sysinternals sdelete. v.1.5 and later have the "-c" option to zero out the free space (= fill it with zeroes). Zeroed sectors are the best for compression, and you get rid of most of the trash. Only the trash in the file slacks will remain.

Thanks a lot dencorso, Russinovich of 2005 sounds good. I'll clean the original System Commander HDD with pre-Microsoft sdelete v1.51, then I'll create a sector-by-sector image file with Ghost "-z9 -ir", as an over-night job. I was lucky to have used for my experimentation a 200GB HDD, not the 750GB one.

This disk imaging problem makes me question my whole partitioning plan. Maybe, for easy sector-by-sector backup of the System Commander "multiFAT" boot partition C:, I should use a very small HDD with a tiny single 2GB FAT16 C: partition, and a 2nd HDD containing the logical partitions. This 2nd HDD could also contain a primary NTFS partition for Vista/Win7.

Such a 2-HDD-setup should work with an SSD disk in my desktop, and also with my 10-year-old Inspiron 7500 laptops, which can hold up to 3 internal HDDs, and I had recently bought 20 right-bay-modules, to hold a 2nd internal HDD .....

Edited by Multibooter, 09 January 2010 - 07:51 PM.


#12
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,390 posts
  • OS:none specified
  • Country: Country Flag

MBRwizard http://www.mbrwizard.com/ backs up/restores easily only track 0, any other tool you could suggest for easy backing up/restoring of more tracks? How do I back up/restore the actual partition Volume ID's AND Disk Signature?

Track 0 is actually (normally) first 63 sectors.

A small bug seems to affect MBRWIZ:
http://www.boot-land...?...8168&st=143
(most probably completely unrelated - but I won't trust MBRwiz right now)

I personally only use dsfo/dsfi (as I know what they do) and MBRFIX (which as well I have tested extensively).
http://members.ozema...ware/index.html
http://www.sysint.no...ting/mbrfix.htm


Examples of my personal approach (for the reasons explained below):
http://www.boot-land...?showtopic=3191
http://www.boot-land...?showtopic=5000
http://www.boot-land...?showtopic=2362

Which one would you suggest for my next cloning attempt of the System Commander HDD?


The point, as far as I understand, is that you have an "atypical" configuration (please read as System Commander) and you want to do an "atypical" cloning (meaning that you are not doing a "real" cloning, which is a dd-like copy, or if you prefer a "forensic sound" one).

So it is difficult to suggest you an app over the other.

I can share my approach to this kind of things:
  • NEVER, and when I say NEVER I do mean NEVER "trust" anything that Commercial (or Freeware) utilities give as "implied" or do "automagically".
  • use as simple an approach as possible, leave "standard" tools for "standard" chores to people needing "standard" results
  • ALWAYS, and when I say ALWAYS I do mean ALWAYS have a way back or alternate way should "chosen" one fail.
  • use "plain" or however "documented" formats ONLY (and again I mean ONLY)

Usual critics to the above:
  • but it is difficult
  • but I have to learn about a lot of things
  • but it is not one click only
  • but ....

To which the reply is usually:
  • but it is SAFE for your DATA. :)

This said, I would try Odin:
http://www.boot-land...?showtopic=5871
http://sourceforge.n...jects/odin-win/

and Partition Saving:
http://www.partition-saving.com/

and Selfimage:
http://selfimage.excelcia.org/

Also, when PROPERLY accompanied with an application taking care of MBR and hidden sectors, DriveImageXML is not that bad (I would have never thought I would have ever written this sentence :ph34r:):
http://www.911cd.net...showtopic=22563
http://www.911cd.net...showtopic=22984
http://www.911cd.net...o...=23408&st=0
(though I never got around finding the compression used for compressed images)

About NTFS versions:
http://www.msfn.org/...ons-t38439.html
Most probably the version of GHOST you are using "thinks" you should be using XP instead of 2K. :whistle:

Volume ID can be gathered by using DIR or LABEL, and set besides through an HEX editor or dsfo/dsfi or similar dd-like tools, with a nice app from sysinternals, called, strangely enough, VolumeID ;):
http://technet.micro...s/bb897436.aspx

jaclaz

#13
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag

The point, as far as I understand, is that you have an "atypical" configuration (please read as System Commander) and you want to do an "atypical" cloning (meaning that you are not doing a "real" cloning, which is a dd-like copy, or if you prefer a "forensic sound" one)

Hi jaclaz,
I was first following dencorso's suggestions and ran sdelete -z on the original System Commander HDD, in preparation for a sector-by-sector cloning with Ghost "-ir". sdelete was very slow, about 0.22GB/min with my 10-year-old 700MHz laptop. I cleaned with sdelete 3 partitions (C: BOOT_FAT16, H: XP_FAT32 and J: DATA_FAT32, altogether 72GB), which took about 5.5 hrs. I then started to create a sector-by-sector image file with Ghost "-ir". The old laptop has been running for the past 12 hrs and will have finished creating the image file in about 2 more hrs. Restoring the image file to the 750GB HDD will probably take another 14 hrs, so please be patient with further feedback.

In the meantime, here some speculations about the "atypical" System Commander HDD:
1) The authors of System Commander called their boot partition the "multiFAT" partition, so possibly the difficulty of cloning a System Commander HDD has something to do with a special FAT created by System Commander on C:, not with the MBR or partitioning

2) This may be confirmed by my experience described in posting #7 here "...Then all files were gone from C:, C: was corrupted with 2 different FATs."

3) System Commander does not detect the installation of a new operating system if the newly-installed operating system is of the same type as a previously installed operating system (e.g. 2 instances of Win98SE, or 2 Win2000s with different service packs). For detecting the installation of the 2nd instance of an operating system you have to boot into DOS, run SCIN.exe -> Special Options -> Alter Current Boot Record Serial Number. Upon removing the boot floppy and rebooting from the HDD, System Commander then comes up with screen "Possible new operating system detected". I have no idea where this "Current Boot Record Serial Number" is stored, I would speculate somewhere related to the "multiFAT" FAT.
The same screen "Possible new operating system detected" comes up after starting a computer with a cloned System Commander HDD.

When Ghost has finished creating the image of the original System Commader HDD, I'll check whether the file-cleaning by sdelete has destroyed something "atypical" on the original System Commander HDD, like this "multiFAT", whatever that is.

#14
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Supervisor
  • 5,862 posts
  • OS:98SE
  • Country: Country Flag

Donator

I was first following dencorso's suggestions and ran sdelete -z on the original System Commander HDD, in preparation for a sector-by-sector cloning with Ghost "-ir". sdelete was very slow ...


:blink: No! sdelete -z is really slow and won't help because it overwrites the sectors 3 times with random characters (DOD 5220.22-M standard)! I recommended sdelete -c, which overwrites the sectors with zeroes just once. Not only this is much faster, but it compresses better. Random characters, because of not having any pattern, however, don't. Sorry, I should have stated this more clearly! :blushing: In any case, when in doubt, type just sdelete at the command prompt to see the brief help screen and remember which switch is for zeroing-out. I always do that, just in case, before I begin. For the full documentation see the sysinternals sdelete page.

Later edit: For what's worth, the usual secure deletion methods are:
  • DOD 5220.22-M = overwrite the sectors 3 times with random extended characters, then delete;
  • DOD 5200.28-STD = overwrite the sectors 7 times with random extended characters, then delete;
  • Zero-Out = overwrite the sectors once with only zeroes, then delete.


#15
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,390 posts
  • OS:none specified
  • Country: Country Flag
@dencorso

To sum up:
Q1. How can I zero out slack space?
A1. By using any of these 5 utilities.

Q2. Well, which one?
A2a. Killdisk
A2b. Sdelete -c

Action taken:
Sdelete -z

With all due respect to Multibooter, I cannot see how you can feel guilty of anything. :w00t:

;)

@Multibooter
The really bad news is that you will need to re-run again the Sdelete with the appropriate switch as random characters won't compress well, if you want to minimize the size of the image/clone.

:whistle:

jaclaz

#16
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag
@dencorso and @jaclaz
Thanks for noting my mistaken parameter, I must have been distracted last night :blushing: . In any case, the deed is done and the .gho image just finished. The resulting compressed split .gho image files are altogether 21.6 GB, huge, possibly also because I did not zero out partition I: SWAP_FAT32 with remnants of swap files on it. In any case, using sdelete and the .gho file were an experiment on a test computer, to find out whether System Commander works with a .gho image created with the "-ir" switch. On my main computer I wouldn't make dangerous experiments.

Here the positive news: sdelete didn't cause any damage to the original System Commander HDD. When I inserted the HDD, which had been worked on by sdelete, back into the computer, the operating systems on it came up fine, sdelete didn't do any damage to the possibly atypical "multiFAT" boot partition. :thumbup

Later edit:
I was checking on Ghost while it was creating the .gho file, and for long periods of time the .gho image-in-process didn't increase in size. During that time Ghost was probably reading and compressing identical characters, so the -z switch probably hadn't caused sdelete to overwrite the empty space with random characters. The parameters used (see docu http://technet.micro...s/bb897443.aspx ) is also kind of counter-intuitive, with c="zero free space" and z="cleanse free space"
Also, I'm not sure about the difference between zero and cleanse. Does c="cleanse" mean zeroing free space on a virtual drive (???), and z="zero" mean zeroing free space on a physical drive?
BTW, I did read the /? of sdelete before using sdelete, maybe I just used the switch which looked best ...

Edited by Multibooter, 10 January 2010 - 06:39 PM.


#17
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,390 posts
  • OS:none specified
  • Country: Country Flag
The actual patent of stoopidity goes to Sdelete, (sadly to say so) it's Author and of course the DOD.

This myth about the several passes will probably never die. :(

http://www.msfn.org/...pe-t125900.html

Such an option should be completely removed from ANY such app, it's a personal fight I try to carry on since a bit of time with no actual results, unfortunately:
http://www.forensicf...m...opic&t=3237

Result:
http://eraser.heidi.ie/

Welcome to the Eraser Home Page!

Eraser is an advanced security tool for Windows which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.

:no:

If the developers still want to perpetuate it, they should have the decency to put the option behind a two level minimum password protected access.


jaclaz

#18
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag

Such an option should be completely removed from ANY such app

Now I am completely confused. I don't believe in the usefulness of "secure overwriting" either, and maybe their docu and /? help is mixed up, it just doesn't make sense for "c" to stand for "zero", and "z" to stand for "clean"=secure delete(??).

I'll make another test with "sdelete -c", and check whether that is faster than the "sdelete -z" yesterday. The faster one should be the simple overwrite of the free space with zeroes. In any case, the "-z" parameter yesterday didn't do any harm to the System Commander HDD.

#19
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Supervisor
  • 5,862 posts
  • OS:98SE
  • Country: Country Flag

Donator

The parameters used (see docu http://technet.micro...s/bb897443.aspx ) is also kind of counter-intuitive, with c="zero free space" and z="cleanse free space"

Use the source, Luke! ...er, Multibooter. :P

[...]
//
// Global variables
//
BOOLEAN Silent = FALSE;
BOOLEAN Recurse = FALSE;
BOOLEAN ZapFreeSpace = FALSE;
BOOLEAN ZeroFreeSpace = FALSE;

[...]

} else if( !_tcsicmp( argv[i], _T("/z") ) || !_tcsicmp( argv[i], _T("-z") )) {
ZapFreeSpace = TRUE;

} else if( !_tcsicmp( argv[i], _T("/c") ) || !_tcsicmp( argv[i], _T("-c") )) {
ZapFreeSpace = TRUE;
ZeroFreeSpace = TRUE;

[...]

As jaclaz said, in that context "cleanse" means overwrite every byte with 0x00 (pass one), then 0xFF (pass two), then any random byte (pass three), according to Sdel.c, while zero means overwrite every byte with 0x00 and stop there. When ZeroFreeSpace = TRUE, the overwriting routine stops at pass one. That's what's coded.

#20
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag
BTW, I was running sdelete under Win98SE in a DOS window yesterday, it had looked like a DOS program. sdelete seems to work fine on FAT16/FAT32 partitions under Win98SE, even if the text "Cleaning MFT.../" came up for a long while.

The docu page http://technet.micro...s/bb897443.aspx lists as system requirements WinXP and higher. Would this mean that sdelete doesn't work properly under Win2k or with NTFS 3.00 partitions by Win2000?

Edited by Multibooter, 10 January 2010 - 09:50 PM.


#21
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag

"cleanse" means overwrite every byte with 0x00 (pass one), then 0xFF (pass two), then any random byte (pass three)

Thanks dencorso, this shows the big plus of sdelete being open source.

I just finished re-running sdelete with the "-c" switch on the 30GB FAT32 partition with the same 700MHz laptop under Win98. sdelete took 89 mins with the "-c" switch [0.34 GB/min], compared to 133 mins with the "-z" switch [0.22 GB/min].

Edited by Multibooter, 11 January 2010 - 08:38 PM.


#22
LoneCrusader

LoneCrusader

    Resistere pro causa resistentiam.

  • MSFN Sponsor
  • 810 posts
  • OS:98SE
  • Country: Country Flag

Donator

Most of this discussion has gone beyond my experience, however I believe jaclaz is on the right track when he said most of this problem is caused by the assumptions of all the different programs involved.

I saw that you tested Clonezilla, recommended in the other thread. If I remember correctly, I think it is based on Partimage, the program that I used on the SystemRescueCd to create images of my partitions. If I get an opportunity, I will try restoring my Windows 98 (System Commander) partition to another hard drive and see if it works.

Eventually I'll try to install Vista and Win7 again, but this time into LOGICAL FAT32 partitions on the 1st HDD. There is a good chance that System Commander, R.I.P., will be able to do it.

You probably saw where I mentioned this on the other thread, but the only problem that I ever had with System Commander was that it could not hide logical partitions from one another. I had a situation where I had an extended partition with two logicals in it, one for Win2K and the other for WinXP. System Commander was unable to hide the 1st logical partition from Windows XP, so XP assigned the Win2K partition drive letter C and then failed to finish booting. I solved this by using BootIt NG, which can hide logicals. I ended up with 24 operating systems on that machine :o


There seem to be a lot of bizarre problems mentioned here involving errors/quirks with System Commander. Other than the one mentioned above, I have never had a problem with it. However, I probably should note that I only use System Commander for three things:
1. To manually create & format partitions
2. To hide each OS from one another (at least during each install process, can always unhide later if necessary)
3. As a boot loader.

I do not use any of it's "wizards" etc. Using version 8.11.

#23
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Supervisor
  • 5,862 posts
  • OS:98SE
  • Country: Country Flag

Donator

Eventually I'll try to install Vista and Win7 again, but this time into LOGICAL FAT32 partitions on the 1st HDD. There is a good chance that System Commander, R.I.P., will be able to do it.

Four relevant pointers (to Vista and, AFAIK, to Win 7, too):
1)How to install Windows Vista on a Fat32 partition (it actually begins on post #1713, but I think it's only fair to point to the post above, from when Dietmar first found out how to do it!).
BTW, <STRG> <ALT> <DEL> means <CTRL> <ALT> <DEL>, of course.
2)Vista's New Partitioning Rules (there is much more interesting material in this site).
3)The case of the disappearing partitions
4)Partitions lost when working with more than one OS!!!

#24
Multibooter

Multibooter

    Friend of MSFN

  • Member
  • PipPipPipPipPip
  • 896 posts
  • OS:98SE
  • Country: Country Flag
I just put the the System Commander HDD, cloned with Ghost sector-by-sector with the "-ir"switch from a .gho file, into the original computer: it works fine :thumbup

Restoring the image to disk took 6 hrs 48 mins with my old 700MHz laptop. The bad side: the raw image/.gho file, from which I created the System Commander HDD clone, was 21.6GB. I will eventually repeat my experiment with sdelete -c on all partitions of the original HDD, to see whether the .gho image will shrink significantly in size.

Creating an image file of the original System Commander HDD is essential for me, to be able to re-create the identical System Commander HDD on multiple HDDs or on multiple nearly-identical computers, or to archive/restore an old System Commander HDD backup.

Zeroing out empty space on the original System Commander HDD is a time-consuming preparatory step before creating a raw image with Ghost -ir in another time-consuming step. I am still looking for a disk imaging tool which can create a workable image of the System Commander HDD, without copying the whole HDD/free space sector-by-sector, i.e. a disk imaging tool which satisfies the "assumptions" of System Commander. Any other suggestions?


2)Vista's New Partitioning Rules (there is much more interesting material in this site).

Excellent article, here a quote from it:

Partitions created by Vista are using new rules that are not entirely compatible with all previous versions of Windows or most current third-party tools for partitioning, imaging and cloning.


The above quote explains why I would tolerate on my computer Vista/Win7 only on a FAT32 partition. As I stated above in posting #4:

2 years ago I had installed Vista on my desktop, onto a primary partition on the 2nd HDD... I removed Vista again because PowerQuest PartitionMagic v8.01 and Partition Table Doctor v3.5 were not able to handle the Vista partition type.

I consider Partition Table Doctor http://www.ptdd.com/ to be an absolutely essential tool, incrementally more valuable to me than Vista or Win7. No Vista/Win7-compatible version of Partition Table Doctor has been released up to now, even if their EASEUS Data Recovery Wizard is Vista Compatible, so Vista/Win7 on a Vista/Win7-created partition is a no-no for me.

Edited by Multibooter, 11 January 2010 - 12:39 PM.


#25
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,390 posts
  • OS:none specified
  • Country: Country Flag

The above quote explains why I would tolerate on my computer Vista/Win7 only on a FAT32 partition. As I stated above in posting #4:

2 years ago I had installed Vista on my desktop, onto a primary partition on the 2nd HDD... I removed Vista again because PowerQuest PartitionMagic v8.01 and Partition Table Doctor v3.5 were not able to handle the Vista partition type.

I consider Partition Table Doctor http://www.ptdd.com/ to be an absolutely essential tool, incrementally more valuable to me than Vista or Win7. No Vista/Win7-compatible version of Partition Table Doctor has been released up to now, even if their EASEUS Data Recovery Wizard is Vista Compatible, so Vista/Win7 on a Vista/Win7-created partition is a no-no for me.


No. :(
I mean your reasoning is inaccurate for the first part.
The referenced articles are about partitioning problems which are perfectly INdependent from the filesystem used.
Your second problem is filesystem related and the intended solution is accurate in the sense that you won't have the same problems you have with NTFS if you use FAT32.

jaclaz




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users



How to remove advertisement from MSFN