Can Norton Ghost read raw format image files ?

[david.balazic]

I have an image of a hard disc in raw format (1:1 copy of all sectors
in a single file, created with /bin/dd, no header, no compression).

Does Ghost support image files like this ?
What about Acronis TrueImage or other programs ?
Is there a program that can convert this file to some other format
(Ghost , Acronis) ?

What I want is to browse the content of the saved partitions (they are
NTFS) and copy out a few files.

I can not restore the image to the disc, because I don't have that (or
other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
partitions).

Thanks for any reply,
David

 

[Joep]

I have an image of a hard disc in raw format (1:1 copy of all sectors
in a single file, created with /bin/dd, no header, no compression).

Does Ghost support image files like this ?

I think not.

What about Acronis TrueImage or other programs ?

I think not. Maybe some forensic suite, Encase and such that can.

Is there a program that can convert this file to some other format
(Ghost , Acronis) ?

I think not.

What I want is to browse the content of the saved partitions (they are
NTFS) and copy out a few files.

There are open source (NT/2000/XP) drivers around that can mount raw image
files and assign them a drive letter.

I can not restore the image to the disc, because I don't have that (or
other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
partitions).

But it's one file on a hard disk? Or spread accros multiple disks? If the
latter I do not think the drivers I mentioned will work. I dot have a URL
handy .... HD Workbench from www.diydatarecovery.nl comes with a driver, you
just rename your file to an extension HD Workbench recognizes. Wait, found
the URL: http://www.acc.umu.se/~bosse/, look for FileDisk.

 

[Eric Gisin]

Since you have a disk image, not a volume image, there are few tools.

If you examine the partition table, you can extract primary parts.
For example, this copies 8GB of the first primary.

dd if=image of=first.img bs=63b count=254 skip=1
dd if=image of=/dev/hdc1 bs=63b count=254 skip=1

Note: hdc is a scratch disk. You can use of=//./X: on WinNT.
The volume image first.img can be mounted on WinNT with filedisk,
or opened with some image browsers. WinImage will open FAT images.

 

[Joep]

Since you have a disk image, not a volume image, there are few tools.

Whoops! Indeed, the drivers I mentioned in above message will not work then.

 

[Michael Cecil]

Whoops! Indeed, the drivers I mentioned in above message will not work then.

Just make a virtual machine with VMWare or Virtual PC, then use dd to
restore the image to the virtual machine, and extract your files.

 

[Joep]

then.

Just make a virtual machine with VMWare or Virtual PC, then use dd to
restore the image to the virtual machine, and extract your files.
--

You'd need VMWare or VirtualPC for that obviously ...

 

[Eric Gisin]

Since you have a disk image, not a volume image, there are few tools.

If you examine the partition table, you can extract primary parts.
For example, this copies 8GB of the first primary.

I meant 8MB. The partition table has offset and length values.
Use offset/63 for skip value, and length/63 for count value.

 

[Folkert Rienstra]

You'd need VMWare or VirtualPC for that obviously ...

I fail to see the 'obvious'ly in it.

 

[Joep]

I fail to see the 'obvious'ly in it.

i do not care

 

[Folkert Rienstra]

i do not care

Twice wrong in a single thread, I can just see why.

 

[Joep]

"Michael Cecil" (e-mail address removed)> wrote in message

Twice wrong in a single thread, I can just see why.

i do not care

 

[mscotgrove]

I am developing a program that will do this - and currently looking for
Beta testers. If you would like a free try then download the program
from www.cnwrecovery.com and e-mail me the machine key and I will send
you a code to do what you want. The program is currently Beta for
Memory chip recovery, but probably Alpha for NTFS. - hence
documentation wizard etc are not very good for NTFS recovery. It is an
XP, 2000 program

Michael

 

[david.balazic]

Wow!

Folkert is still alive. Annoying as always. How old is he now ? 40 ? 50
?

This sure brings back memories . . . .

 

[Eric Gisin]

I just found a utility to mount raw whole disk images: OsrVirtualCdAndDisk
http://www.osronline.com/article.cfm?article=410 [register to download[

Also useful for experimenting in Disk Manager if you don't have a spare disk.

 

[Folkert Rienstra]

Wow!

Folkert is still alive.

I hope that wasn't some sort of invitation.

So, who did rise you from the dead then?

Annoying as always. How old is he now ? 40 ? 50
?

This sure brings back memories . . . .

Oh, and thanks for responding to me and not anyone else,
showing what the real intention of your question was.

 

[david.balazic]

Great thanks.

I already tried to extract individual partition and they don't work.
I also tried to restore the image to a virtual disk in VMWare nd it
does not work there anyway ( Widows install CD or bartPE CD wont even
boot if the restored HD is present on the emulated system ... ).
I will now try to get the original har drive back and try to restore to
it.

Regards,
David

 

[Peter]

I have an image of a hard disc in raw format (1:1 copy of all sectors
in a single file, created with /bin/dd, no header, no compression).

Does Ghost support image files like this ?
What about Acronis TrueImage or other programs ?
Is there a program that can convert this file to some other format
(Ghost , Acronis) ?

Not with Ghost or Acronis.

What I want is to browse the content of the saved partitions (they are
NTFS) and copy out a few files.

I can not restore the image to the disc, because I don't have that (or
other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
partitions).

Try with Knoppix CD. I had some good success with it.
I had a dd image of /dev/hda1 saved in temporary attached
/dev/hdb1/hda1image.img.

Boot Knoppix CD ver 3.9
Launch terminal.
Create a mount point for your image:
mkdir /mnt/hdz1
Mount second disk containing image:
mount -o rw /dev/hdb1 /mnt/hdb1
Mount disk image:
mount -o loop /mnt/hdb1/hda1image.img /mnt/hdz1

Launch File Manager in Super User mode and peruse /mnt/hdz1

You should be able to see and copy files from your disk image.