i've got two ~120GB ghost V2i's; long story short both got deleted and partly overwrote. There's probably 100GB of each still 'there' and untouched, but the MFT pointer and the v2i file headers are gone.
Is there ANY way to recover the files, header and index notwithstanding, preferably by reading the disk free space directly, as I havne't found anything able to recover part of a file that's been orphaned. In older editions, as I understand it, 'ghost explorer' would have been able to extract what files that were still good, were I able to recover the remaining parts, or convert that free space into a raw file.
in researching this, there seems to be two answers: 'use ghost explorer' (which i can't find and I doubt reads NG15 files), and "no, no way at all, you're hosed"
I really hope there's a third one that's usable, some of this data is irreplacible family history.... and if I DO get this back, then i'm going to start double or triple backups
I'm still working on recovering the data - there's easily 100GB of raw v2i data on the disk, and 90% of it is still pristine IF I can find a way to recover it as raw data, image only the free space, etc. The problem is all the data recovery programs I've seen, even ones that claim to offer 'data carving', search for specific file extensions, and since the backup is orphaned, it's a contiguous clump of raw data, outside the MFT.
The best I can tell, if I can accomplish two things, I'll have at least the majority of my data back, and likely the most important 10GB or so of that 100+GB. I need to either (preferably) find a program that will scan the free space and read the raw Ghost data buried in it, then extract the files from it directly, or:
1. Write a raw image of /only/ the free space, to another drive
2. Find something like Ghost explorer for Ghost15 v2i's that will scan that image and extract the files from it, regardless of lacking header/index/etc.
I've got the drive the backups are on shut down for the moment, but the longer it's down the more the /other/ computers that backup to it are potentially at risk.
Ideally, I'd hope the v2i file structure'd let me recover the filenames as well as the content, but if not I can deal with that and rename what's recovered cleanly, manually. The v2i file structure has to have the files in discreet blocks that it can read. even without an index they'd be discreet, the index/header (best I can tell) is a mix of wrapper, and tree structure/file location, plus wrapper.
This doesn't seem like that impossible of a situation, if nothing else I'm sure the Symantec programmers could throw together a program in 30min. using the decompression/extract engine that'd be able to scan a raw image, akin to Ghost Explorer's -noindex/-corrupt options, if they don't already have something like that in-house. I simply can't believe that, with the huge enterprise and corporate level userbase that Ghost has, that there's no way to extract from a v2i with a corrupted header, and extracting from deleted/free space like I'm needing shouldn't be too much different than reading a file in the MFT.
In the MFT or 'out of it' and raw on the drive, the data is still data, and read cluster by cluster, I just need an "if it's marked as free space, scan till you find something then run it through the extract/recover engine" program There's 300GB of free space there, over half of it is Ghost data, and likely contiguous, at least some of it has to be recoverable!
Older versions of Ghost that used the .gho files were actually imaging the system on a folder and file level like Microsofts ImageX does.
Thats why it was sometimes able to open an incomplete or corrupted image, the data inside was files and folders.
The newer versions of Ghost that use the .v2i files are sector based images.
If you could open a incomplete image it would not do you any good because you would be seeing everything at the sector level and not know how to put it together.
As far as I know, there is no way to open an incomplete v2i file and if Symantec could have made such a tool they would have a long time ago.
I'm sorry to say I don't think you will be able to do anything unless you can recover the complete image file.
If it's been partially overwritten your going to be out of luck.
I know that most file recovery programs scan for a certain set of file extentions, but as far as I know they only use that information to try to rebuild the master fat table and then all files with other extentions can then be recovered.
At least that is the case with "Recover My Files", I have seen the developer on that forum tell people to do the complet scan with the deault file extention settings first.
The only problems with that program is if you never had any files with common extentions on that partition.
(you used that partition only for Ghost backups).
That program seems to work very well, I have had better luck with it than with any other free or paid for program and the free trial will let you see if the files can be recovered before you purchase it.
well, even sector by sectorwould work, if I can get it out of the ghost image and wrote, even a raw sata stream write would be recoverable, as long as it was decompressed from the ghost image. Something has to be doable-- file-by-file, or sector-by-sector, the data is still there and still pristine, just compressed in ghost's format. If what you're saying is right, then I just need to find something that can recognize that 'ghost' signature and just decompress it, write it as a raw data stream, and then I'd be able to recover from that with a normal recovery program.
Compressed, fragmented, sector-not-file-- regardless of the way it's stored, it's there still, and recovering some is better than recovering none-- it's not encrypted, ghost defaults to plain compression at most as far as I know, admittedly a mistake on my part in hindsight. But compression or not, the data's there, even if it's raw sector-by-sector, and thus recoverable by some means, even if it's just raw at the sector level, and not on a file-by-file basis like I'd thought. Even if I need to use 2,3,4 programs to finally get my files, that's fine, the first step is to extract whatever's in the ghost image remnants. Unlike a large company, I can afford to take things slow and take whatever time it'll take to do this. in slightly better new, I've got a couple incrementals I was able to save, but I doubt that'd help recover the base any easier, and it seems they're just as hosed as the base, despite being 'clean' files.
....So much for the 'good backup habits' I thought I had :p
I considered VMware, but it wouldn't be able to convert it without the header, wouldn't see it as a v2i file. (And I've got to find a program that can write a raw image of the free space, not the entire disk, first unless I can find something that can read it directly *sigh*)
I just can't see why "scan the disk for data that matches the v2i internal strucrure, and decompress it to a file" is so hard to do -- I'd love to talk to someone on the dev/programming team, there's *got* to be something in-house they use, someone someplace has to be able to do what I need, I'd code something myself if I had the skills but I'm just beginning to learn C#/java/etc, and something like that is lightyears beyond what I could do, but I know it /can/ be done... somehow.
If the data's there, then there's got to be a way to get it-- every format has a signature, the data has to be recognizable, even without the header, somehow, it's just a matter of finding the right person with the right knowledge and the right resources, to get at it-- and if the company that makes it, can't get at data in their own format....
That link's got potential, but it's discussing G14, and I don't know if 15 uses the same internal format and would be convertable with that. And it, still, would require the header in that case; I need to find something that'll ignore anytihng except the file content, and read the raw compressed innards of it or even better, read the disk freespace directly, ignoring anything else that doesn't match that signature, and decompress what it finds to another file- just decompress anything matching "v2i data" and stream it raw into a file. Once it's there, I can use any good disk image scanner/data recovery program to recover what I can, since it'd effectivly be a plain NTFS partition fragment. at that point.
i've got two ~120GB ghost V2i's; long story short both got deleted and partly overwrote. There's probably 100GB of each still 'there' and untouched, but the MFT pointer and the v2i file headers are gone.
Is there ANY way to recover the files, header and index notwithstanding, preferably by reading the disk free space directly, as I havne't found anything able to recover part of a file that's been orphaned. In older editions, as I understand it, 'ghost explorer' would have been able to extract what files that were still good, were I able to recover the remaining parts, or convert that free space into a raw file.
in researching this, there seems to be two answers: 'use ghost explorer' (which i can't find and I doubt reads NG15 files), and "no, no way at all, you're hosed"
I really hope there's a third one that's usable, some of this data is irreplacible family history.... and if I DO get this back, then i'm going to start double or triple backups
Example 1) to mount the image as a disk accessible through the ghost gui:
>ghost32.exe -ad=myGhost14.v2i
Example 2) to complete the clone without the gui:
>ghost32.exe -clone,mode=create,src=myGhost14.v2i,dst=myGSSimage.gho -sure -batch
I knew you could restore a v2i using Ghost32, but not convert to a gho file. I wish you could mount a gho file as a drive letter, like Norton Ghost can do with v2i files.
If I have a file that's a raw disk image, potentially with a full v2i including intact header; and/or partial v2i contents without header...
Is there something that can see those, in that image, and extract/decompress it, to another file? As I'm understanding it, once it's extracted it's a plain old basic NTFS partition (or partition fragment).
I would assume that ghost can recognize it's own compression format, and be able to extract that- ideally ignoring anything else that isn't v2i data.
As i'd said earlier, the data is there and except for the header, apparently pristine, but every recovery program I can find either uses the MFT to recover files, or only recovers certain types -- I haven't been able to find anything I can 'train' to see v2i data. I was able to recover a few incrementals intact, but without the base, I'm not sure how to recover them, either, and I don't know if that'll help recover the base since they were from the same set.
I'd think someone SOMEpalce can do this-- if I knew what signatures to look for I could carve out just the v2i data manually with a hex editor (at least as I understand things), but still would have the issue of decompressing it. I'm not sure ghost 11 with the v2i lib DLL can do what I want, even with the -ignoreindex and -corrupted switches added to ghostexp.
I'd love to talk to someone on the dev team that knows the compression format *sigh*
Not sure why i can't edit my original post, but as an addendum, I do have ghost explorer and ghost32/11.5, and the v2i disk lib DLL. I don't know if thre's any way to work with those to do it, but the v2i disk lib is apparently what does the compression/decompression, so there's got to be a way to feed what data I have through that, header or not.
I've found a few places that claim they're able to recover data out of corrupted v2i's even on dead drives, which means it can be done, even if there's no way I could afford the $$$$ that'd likely cost, unfortunatly. But if they can, then somehow, someplace, there's something that will let me or someone willing to throw something together than can. (I'd rather not take who-knows-how-long to find out how to write something myself using that DLL, I know it's way beyond my programming skills :p)
i've been able to recover the V2I's finally, thanks to data carving -- only about 90% though, but more than enough to recover at least most of the data I need to get.
Now, step two: How can I feed this file thru Ghost's extraction engine, to another file? I.e. decompress it as a whole, directly to another file, Fragment.v2i --> Decompressed_v2i.raw
If I'm understanding the file structure properly, "restoring" a v2i simply decompresses it, writing it as raw data to the drive, en masse by sector rather than file-by-file.... i want that, but into a file rather than directly to the drive -- then I can use decent data recovery to get the data I need, back since at that point it would (best I can tell) be a plain, normal, NTFS partition fragment, and if I'm really lucky, with a backup MFT buried somepalce.
If it's not possible to feed it to a file, direct to a drive would work, I've got a couple spares big enough, file would just be easier to deal with in this case-- but either way I need to find a way to hijack the decompression engine to take an input file and decompress it to the destination of my choice regardless of header/ToC/etc, just brute force input=decompression_to_destination
I don't know of anytihng built-in Ghost with the ability to decompress 'broke' v2i's, since the recovery point browser obviously doesn't recognize it without a ToC -- So, any chance someone could hack together something quick an dirty to pull off that I/O for me?
I'm shocked that there's nothing already there to recover corrupted backup files, I can't be the first one with an issue like this!
