Can Norton Ghost read raw format image files ?

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I have an image of a hard disc in raw format (1:1 copy of all sectors
in a single file, created with /bin/dd, no header, no compression).

Does Ghost support image files like this ?
What about Acronis TrueImage or other programs ?
Is there a program that can convert this file to some other format
(Ghost , Acronis) ?

What I want is to browse the content of the saved partitions (they are
NTFS) and copy out a few files.

I can not restore the image to the disc, because I don't have that (or
other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
partitions).

Thanks for any reply,
David

 

[joeP]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

<david.balazic@hermes.si> wrote in message
news:1126106786.258311.78030@g49g2000cwa.googlegroups.com...
> I have an image of a hard disc in raw format (1:1 copy of all sectors
> in a single file, created with /bin/dd, no header, no compression).
>
> Does Ghost support image files like this ?

I think not.

> What about Acronis TrueImage or other programs ?

I think not. Maybe some forensic suite, Encase and such that can.

> Is there a program that can convert this file to some other format
> (Ghost , Acronis) ?

I think not.

>
> What I want is to browse the content of the saved partitions (they are
> NTFS) and copy out a few files.

There are open source (NT/2000/XP) drivers around that can mount raw image
files and assign them a drive letter.

>
> I can not restore the image to the disc, because I don't have that (or
> other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
> partitions).

But it's one file on a hard disk? Or spread accros multiple disks? If the
latter I do not think the drivers I mentioned will work. I dot have a URL
handy .... HD Workbench from www.diydatarecovery.nl comes with a driver, you
just rename your file to an extension HD Workbench recognizes. Wait, found
the URL: http://www.acc.umu.se/~bosse/, look for FileDisk.

--
Joep

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Since you have a disk image, not a volume image, there are few tools.

If you examine the partition table, you can extract primary parts.
For example, this copies 8GB of the first primary.

dd if=image of=first.img bs=63b count=254 skip=1
dd if=image of=/dev/hdc1 bs=63b count=254 skip=1

Note: hdc is a scratch disk. You can use of=//./X: on WinNT.
The volume image first.img can be mounted on WinNT with filedisk,
or opened with some image browsers. WinImage will open FAT images.

<david.balazic@hermes.si> wrote in message
news:1126106786.258311.78030@g49g2000cwa.googlegroups.com...
> I have an image of a hard disc in raw format (1:1 copy of all sectors
> in a single file, created with /bin/dd, no header, no compression).
>
> Does Ghost support image files like this ?
> What about Acronis TrueImage or other programs ?
> Is there a program that can convert this file to some other format
> (Ghost , Acronis) ?
>
> What I want is to browse the content of the saved partitions (they are
> NTFS) and copy out a few files.
>
> I can not restore the image to the disc, because I don't have that (or
> other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
> partitions).
>

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Eric Gisin" <ericgisin@hotmail.com> wrote in message news:dfob7s0mgr@enews3.newsguy.com...
> Since you have a disk image, not a volume image, there are few tools.
>
> If you examine the partition table, you can extract primary parts.
> For example, this copies 8GB of the first primary.
>
I meant 8MB. The partition table has offset and length values.
Use offset/63 for skip value, and length/63 for count value.

> dd if=image of=first.img bs=63b count=254 skip=1
> dd if=image of=/dev/hdc1 bs=63b count=254 skip=1
>
> Note: hdc is a scratch disk. You can use of=//./X: on WinNT.
> The volume image first.img can be mounted on WinNT with filedisk,
> or opened with some image browsers. WinImage will open FAT images.
>

 

[joeP]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Eric Gisin" <ericgisin@hotmail.com> wrote in message
news:dfob7s0mgr@enews3.newsguy.com...
> Since you have a disk image, not a volume image, there are few tools.
>

Whoops! Indeed, the drivers I mentioned in above message will not work then.

--
Joep

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On Thu, 8 Sep 2005 10:27:47 +0200, "Joep" <available@request.nl> wrote:

>"Eric Gisin" <ericgisin@hotmail.com> wrote in message
>news:dfob7s0mgr@enews3.newsguy.com...
>> Since you have a disk image, not a volume image, there are few tools.
>>
>
>Whoops! Indeed, the drivers I mentioned in above message will not work then.

Just make a virtual machine with VMWare or Virtual PC, then use dd to
restore the image to the virtual machine, and extract your files.
--
Michael Cecil
http://home.comcast.net/~macecil/
http://home.comcast.net/~safehex/

 

[joeP]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Michael Cecil" <macecil@comcast.net> wrote in message
news:d030i1d67rq10rnpa17pskuig36qgtuftu@4ax.com...
> On Thu, 8 Sep 2005 10:27:47 +0200, "Joep" <available@request.nl> wrote:
>
> >"Eric Gisin" <ericgisin@hotmail.com> wrote in message
> >news:dfob7s0mgr@enews3.newsguy.com...
> >> Since you have a disk image, not a volume image, there are few tools.
> >>
> >
> >Whoops! Indeed, the drivers I mentioned in above message will not work
then.
>
> Just make a virtual machine with VMWare or Virtual PC, then use dd to
> restore the image to the virtual machine, and extract your files.
> --

You'd need VMWare or VirtualPC for that obviously ...

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Joep" <available@request.nl> wrote in message news:35b17$43201159$3eddca68$8906@nf1.news-service.com
> "Michael Cecil" <macecil@comcast.net> wrote in message
> news:d030i1d67rq10rnpa17pskuig36qgtuftu@4ax.com...
> > On Thu, 8 Sep 2005 10:27:47 +0200, "Joep" <available@request.nl> wrote:
> >
> > > "Eric Gisin" <ericgisin@hotmail.com> wrote in message
> > > news:dfob7s0mgr@enews3.newsguy.com...
> > > > Since you have a disk image, not a volume image, there are few tools.
> > > >
> > >
> > > Whoops! Indeed, the drivers I mentioned in above message will not work then.
> >
> > Just make a virtual machine with VMWare or Virtual PC, then use dd to
> > restore the image to the virtual machine, and extract your files.
> > --
>
> You'd need VMWare or VirtualPC for that obviously ...

I fail to see the 'obvious'ly in it.

 

[joeP]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Folkert Rienstra" <see_reply-to@myweb.nl> wrote in message
news:4320df51$0$73457$892e7fe2@authen.white.readfreenews.net...
> "Joep" <available@request.nl> wrote in message
news:35b17$43201159$3eddca68$8906@nf1.news-service.com
> > "Michael Cecil" <macecil@comcast.net> wrote in message
> > news:d030i1d67rq10rnpa17pskuig36qgtuftu@4ax.com...
> > > On Thu, 8 Sep 2005 10:27:47 +0200, "Joep" <available@request.nl>
wrote:
> > >
> > > > "Eric Gisin" <ericgisin@hotmail.com> wrote in message
> > > > news:dfob7s0mgr@enews3.newsguy.com...
> > > > > Since you have a disk image, not a volume image, there are few
tools.
> > > > >
> > > >
> > > > Whoops! Indeed, the drivers I mentioned in above message will not
work then.
> > >
> > > Just make a virtual machine with VMWare or Virtual PC, then use dd to
> > > restore the image to the virtual machine, and extract your files.
> > > --
> >
> > You'd need VMWare or VirtualPC for that obviously ...
>
> I fail to see the 'obvious'ly in it.

i do not care

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Joep" <available@request.nl> wrote in message news:69d43$43214fbf$3eddca68$20349@nf1.news-service.com
> "Folkert Rienstra" <see_reply-to@myweb.nl> wrote in message news:4320df51$0$73457$892e7fe2@authen.white.readfreenews.net...
> > "Joep" <available@request.nl> wrote in message news:35b17$43201159$3eddca68$8906@nf1.news-service.com
> > > "Michael Cecil" macecil@comcast.net> wrote in message news:d030i1d67rq10rnpa17pskuig36qgtuftu@4ax.com...
> > > > On Thu, 8 Sep 2005 10:27:47 +0200, "Joep" <available@request.nl> wrote:
> > > > > "Eric Gisin" ericgisin@hotmail.com> wrote in message news:dfob7s0mgr@enews3.newsguy.com...
> > > > > > Since you have a disk image, not a volume image, there are few tools.
> > > > > >
> > > > >
> > > > > Whoops! Indeed, the drivers I mentioned in above message will not work then.
> > > >
> > > > Just make a virtual machine with VMWare or Virtual PC, then use dd to
> > > > restore the image to the virtual machine, and extract your files.
> > > > --
> > >
> > > You'd need VMWare or VirtualPC for that obviously ...
> >
> > I fail to see the 'obvious'ly in it.
>
> i do not care

Twice wrong in a single thread, I can just see why.

 

[joeP]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Folkert Rienstra" <see_reply-to@myweb.nl> wrote in message
news:43237595$0$91994$892e7fe2@authen.white.readfreenews.net...
> "Joep" <available@request.nl> wrote in message
news:69d43$43214fbf$3eddca68$20349@nf1.news-service.com
> > "Folkert Rienstra" <see_reply-to@myweb.nl> wrote in message
news:4320df51$0$73457$892e7fe2@authen.white.readfreenews.net...
> > > "Joep" <available@request.nl> wrote in message
news:35b17$43201159$3eddca68$8906@nf1.news-service.com
> > > > "Michael Cecil" macecil@comcast.net> wrote in message
news:d030i1d67rq10rnpa17pskuig36qgtuftu@4ax.com...
> > > > > On Thu, 8 Sep 2005 10:27:47 +0200, "Joep" <available@request.nl>
wrote:
> > > > > > "Eric Gisin" ericgisin@hotmail.com> wrote in message
news:dfob7s0mgr@enews3.newsguy.com...
> > > > > > > Since you have a disk image, not a volume image, there are few
tools.
> > > > > > >
> > > > > >
> > > > > > Whoops! Indeed, the drivers I mentioned in above message will
not work then.
> > > > >
> > > > > Just make a virtual machine with VMWare or Virtual PC, then use dd
to
> > > > > restore the image to the virtual machine, and extract your files.
> > > > > --
> > > >
> > > > You'd need VMWare or VirtualPC for that obviously ...
> > >
> > > I fail to see the 'obvious'ly in it.
> >
> > i do not care
>
> Twice wrong in a single thread, I can just see why.

i do not care

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I am developing a program that will do this - and currently looking for
Beta testers. If you would like a free try then download the program
from www.cnwrecovery.com and e-mail me the machine key and I will send
you a code to do what you want. The program is currently Beta for
Memory chip recovery, but probably Alpha for NTFS. - hence
documentation wizard etc are not very good for NTFS recovery. It is an
XP, 2000 program

Michael

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Wow!

Folkert is still alive. Annoying as always. How old is he now ? 40 ? 50
?

This sure brings back memories . . . .

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I just found a utility to mount raw whole disk images: OsrVirtualCdAndDisk
http://www.osronline.com/article.cfm?article=410 [register to download[

Also useful for experimenting in Disk Manager if you don't have a spare disk.

<david.balazic@hermes.si> wrote in message
news:1126106786.258311.78030@g49g2000cwa.googlegroups.com...
> I have an image of a hard disc in raw format (1:1 copy of all sectors
> in a single file, created with /bin/dd, no header, no compression).
>
> Does Ghost support image files like this ?
> What about Acronis TrueImage or other programs ?
> Is there a program that can convert this file to some other format
> (Ghost , Acronis) ?
>
> What I want is to browse the content of the saved partitions (they are
> NTFS) and copy out a few files.
>
> I can not restore the image to the disc, because I don't have that (or
> other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
> partitions).
>

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

<david.balazic@hermes.si> wrote in message news:1126711968.825305.274750@g44g2000cwa.googlegroups.com
> Wow!
>
> Folkert is still alive.

I hope that wasn't some sort of invitation.

So, who did rise you from the dead then?

> Annoying as always. How old is he now ? 40 ? 50
> ?
>
> This sure brings back memories . . . .

Oh, and thanks for responding to me and not anyone else,
showing what the real intention of your question was.

>
>

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Great thanks.

I already tried to extract individual partition and they don't work.
I also tried to restore the image to a virtual disk in VMWare nd it
does not work there anyway ( Widows install CD or bartPE CD wont even
boot if the restored HD is present on the emulated system ... ).
I will now try to get the original har drive back and try to restore to
it.

Regards,
David

 

[peter]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

<david.balazic@hermes.si> wrote in message
news:1126106786.258311.78030@g49g2000cwa.googlegroups.com...
> I have an image of a hard disc in raw format (1:1 copy of all sectors
> in a single file, created with /bin/dd, no header, no compression).
>
> Does Ghost support image files like this ?
> What about Acronis TrueImage or other programs ?
> Is there a program that can convert this file to some other format
> (Ghost , Acronis) ?

Not with Ghost or Acronis.

> What I want is to browse the content of the saved partitions (they are
> NTFS) and copy out a few files.
>
> I can not restore the image to the disc, because I don't have that (or
> other same sized) disc any more. (it is a 60 GB image with about 5 NTFS
> partitions).

Try with Knoppix CD. I had some good success with it.
I had a dd image of /dev/hda1 saved in temporary attached
/dev/hdb1/hda1image.img.

Boot Knoppix CD ver 3.9
Launch terminal.
Create a mount point for your image:
mkdir /mnt/hdz1
Mount second disk containing image:
mount -o rw /dev/hdb1 /mnt/hdb1
Mount disk image:
mount -o loop /mnt/hdb1/hda1image.img /mnt/hdz1

Launch File Manager in Super User mode and peruse /mnt/hdz1

You should be able to see and copy files from your disk image.