Free alternatives to Ghost Options

[Former_skewltek_post]

I've been trying out as many free alternatives to Ghost that I could dig up. I've only been interested in 32bit alternatives because I really like how fast I can write and restore an image from USB hard drives under PE. Obviously I want a fast option that will skip blank sectors but still image an entire disk, not just partitions. This is what I've found and tested so far:

Dubaron DiskImage
Really slow, but I like all the extras. Won't skip blank sectors or compress quite enough to even compete with Ghost. But it shows promise!

DriveImage XML
Very promising, pretty fast, very comparable to Ghost on write and restore BUT it can't make an image of an entire volume. That's really discouraging.

Lexun DrvImagerXP
Just a glorified xcopy. Offers compression, but that's about it.

SelfImage
This one is under active developement, and I can't wait to see what they'll do next, it shows a lot of promise. But again, not as fast as Ghost because it can't skip blank sectors.

Partition Saving
Obviously NOT 32bit, but I include it here because It does everything I'm looking for, it just cant do it in PE! It does not, however, skip blank sectors on a volume image, only on a partition image. It's under very active developement, though, so I'm sure this is in the works.


There's my list, tell me yours! I really want to hear what you all are using and how it stacks up against the venerable and reliable benchmark, Ghost.

If you would like me to post a plugin for any of the above options, make it known below, but they are all very simple, single executable proggies.

[jaclaz]

Well, you have made quite a complete list.

I might add the DSFOK package:
http://www.ozemail.com.au/~nulifetv/freezip/freeware/
(no compression, though)

I want to say that (I know that in this times of 64 bits I seem like a dinosaur) it is not the 16 bits that slow the transfer, but rather the missing of UDMA drivers.

If you try some DOS utilities under the newish FREEDOS kernel WITH UDMA (and USB) support, you'll find that speed has GREATLY improved.

jaclaz

[nitro001]

If you want to get real cheap and like the command line:

You may want to try dd and gzip to compress. Can use in tandem (|) with netcat or better yet, cryptcat to stream over network to store image elsewhere.

dd is a native linux/unix utility but has been ported to windows:
http://uranus.it.swin.edu.au/~jn/linux/rawwrite/dd.htm

or better yet, get here: http://unxutils.sourceforge.net/
provides other nice utilities as well.

Cryptcat: http://farm9.org/Cryptcat/

Nathan

[jaclaz]

@nitro001
Last time I tried piping dd to gzip it did not work, maybe I did not try hard enough.


However, there is also a version of dd for Win32 that you can find here:
http://users.erols.com/gmgarner/forensics/

that has GZIP already included:

Command Line: dd --help
Based on original version developed by Paul Rubin, David MacKenzie, and Stuart K
emp
Microsoft Windows: Version 5.0 (Build 2195.Professional Service Pack 4)

28/03/2006 16:37:52 (UTC)
28/03/2006 18:37:52 (local time)

Current User: xdeletedforprivacyx

Usage: dd.exe [OPTION]...[-md5out=FILE]
Copy a file, converting and formatting according to the options.

bs=BYTES force ibs=BYTES and obs=BYTES
cbs=BYTES convert BYTES bytes at a time
conv=KEYWORDS convert the file as per the comma separated keyword list
count=BLOCKS copy only BLOCKS input blocks
ibs=BYTES read BYTES bytes at a time
if=FILE read from FILE instead of stdin
obs=BYTES write BYTES bytes at a time
of=FILE write to FILE instead of stdout, don't truncate file
seek=BLOCKS skip BLOCKS obs-sized blocks at start of output
skip=BLOCKS skip BLOCKS ibs-sized blocks at start of input
--help display this help and exit
--version output version information and exit
--md5sum generate md5 checksum for copied data
--verifymd5 computes the md5 checksum of the output file
--sparse enables support for sparse output files
--lockin lock input file during dd
--lockout lock output file during dd
--md5out=FILE writes the md5 checksum to FILE
--log=FILE writes status information to the specified log file

BYTES may be suffixed: by xM for multiplication by M, by c for x1,
by w for x2, by b for x512, by k for x1024. Each KEYWORD may be:

noerror continue after read errors
comp Compress output
decomp Decompress input

I just tested it on a 16 Mb almost empty disk image mounted in Win2k with Ken Kato's VDK driver:

CODE

dd if=\\.\PHYSICALDRIVE2 of=E:\USBKEY\DSFOK\testdsk.gz conv=comp

and it compressed it to a 632Kb file.

restoring it:

CODE

dd if=E:\USBKEY\DSFOK\testdsk.gz of=\\.\PHYSICALDRIVE2 conv=decomp

works as well.

Anyone willing to experiment with larger/more complex images?

jaclaz

[Former_frodo_post]

@nitro001
Last time I tried piping dd to gzip it did not work, maybe I did not try hard enough.
However, there is also a version of dd for Win32 that you can find here:
http://users.erols.com/gmgarner/forensics/

that has GZIP already included:
I just tested it on a 16 Mb almost empty disk image mounted in Win2k with Ken Kato's VDK driver:

CODE

dd if=\\.\PHYSICALDRIVE2 of=E:\USBKEY\DSFOK\testdsk.gz conv=comp

and it compressed it to a 632Kb file.

restoring it:

CODE

dd if=E:\USBKEY\DSFOK\testdsk.gz of=\\.\PHYSICALDRIVE2 conv=decomp

works as well.

Anyone willing to experiment with larger/more complex images?

jaclaz

Yeah, ill give it a go when i get home tonight, ill restore my clean xp image (1.5Gb) i use for tracing, then dd it, wipe the drive and try restoring it. If it works i might even add to my list of chores by making an AutiIT GUI for it.

[Former_skewltek_post]

Wow, thanks for all the responses. This is good info.

I want to say that (I know that in this times of 64 bits I seem like a dinosaur) it is not the 16 bits that slow the transfer, but rather the missing of UDMA drivers.

If you try some DOS utilities under the newish FREEDOS kernel WITH UDMA (and USB) support, you'll find that speed has GREATLY improved.

I got a response from the author today that said the same thing about the UDMA drivers, and that a Windows version is pretty far off. I will definitely try the FREEDOS option on the DOS side of my disk. That would be awesome!

Yeah, ill give it a go when i get home tonight, ill restore my clean xp image (1.5Gb) i use for tracing, then dd it, wipe the drive and try restoring it. If it works i might even add to my list of chores by making an AutiIT GUI for it.

Love to hear how it goes. Please post details when you give it a try. An AutoIT gui would be sweet!

[jowaju]

Just came across this one, it's called EaseUS. Haven't tried it yet.

http://www.easeus.com/disk-copy/

[Former_frodo_post]

Just came across this one, it's called EaseUS. Haven't tried it yet.

http://www.easeus.com/disk-copy/

Just make sure you visit the "Quick Tour page" BEFORE doing anything with this program, here are some highlights:

CODE

Warning: If original disk is mistakenly connected with IDE second master, the original disk data may be erased!!


1. Disk Setup.
Source disk must be located IDE1 Master, destination disk must be located IDE2 Master. Setup computer to start from Floppy.

The stipulation that Source=IDE Master and Target=IDE Master is okay if the machine is set up this way, otherwise it will be time to remove the case cover, and play with jumpers.

Im not saying its bad/good, just thought i'd point out the important points for those who dont like to read (im usually one of them, except when it comes to data backup/restore topics:) )

[Former_skewltek_post]

That could be a problem, thanks for pointing that out, frodo.

Thanks for the link, jowaju, but I'd have to group that in with cloning software. It definitely has its use in recovery, but I'm more interested in deployment.

But since you bring it up, I've used CloneMaxx which is supposed to use UDMA under DOS for "speeds up to 3.3 GB per minute." I started using it to clone one 40gig to another 40gig on an Optiplex GX260 but after 20 minutes and only 4% I ditched it and did it under Ghost in DOS in under 5 minutes. I'll give this one a try and see if it would be a worthy replacement for CloneMaxx. Thanks again!

[Former_skewltek_post]

Well, I gave dd a go. I used the Win32 version jaclaz suggested. It certainly does what its supposed to, but it's still not a suitable deployment type imager, it's much better suited for forensics. The 40gig drive that i made a 1.2gig image of in 10minutes using ghost took forever with dd. Before i stopped it it had been chuggin' away for an hour and a half and had created a 4.5 gig image. I think i'll add this to my disk for forensic imaging, but it's back to the drawing board to find a suitable (and free) replacement for Ghost.

I'm afraid this topic will probably fade away into the fog after this post, so if anyone has any last words, post them now. Can you tell i'm depressed?

[google]

Maybe g4u, xxcopy or hdclone (free edition) can be an alternative.

[jaclaz]

Well, if we can go in the "linux" field, there are several ones, like PING (Partimage Is Not Ghost):
http://ping.windowsdream.com/

jaclaz

[Former_frodo_post]

Sorry for the lag in replying, but real life has been keeping me busy.....

I finally got around to testing DD, but got bored after 40 mins and also shutdown AutoIT as it wasnt going to be used to make a GUI for DD after all. The UDMA drivers under FreeDOS made little difference by the way.

[tonedeaf]

Looks like SelfImage 1.1 can skip blank sectors.

NEW Skip reading a disk's "free space", treating it as if it were zero. This decreases the size of a compressed image and makes it process MUCH faster.
NEW Network Block Device support to make images of disks on remote machines, and restore back to them.

Can anyone test this and post some results?

[Former_skewltek_post]

Ha, Ha. I remember seeing that but it just didn't register. The problem I had when testing it was that it would bomb out at around 40% for me when I was making an image. After taking a quick look at the SelfImage forum I realized that the problem didn't lie in the program itself, or from running it within BartPE, I was trying to back up to a FAT32 volume and it was bombing out at the 4gig limit.

I'll give it a try in the morning, but I can say from what I saw before it hit 4gigs, SelfImage is definitely on the right track. It is considerably faster that other free imaging programs. However, the final image will be (I'm estimating) 3 to 4 times larger than its Ghost counterpart... but the speed isn't bad! I'm going to keep my eye on SelfImage, hoping that it may include some better compression options in the future.

I'll give a full comparison of Ghost vs. SelfImage tomorrow.

[oscar]

no way to replace ghost32 with something else


test of a 5gb linux partition

ghost32: 13 minutes - 1gb image

shelfimage: 42 minutes - 1.8gb image

[nitro001]

Sorry for the lag in replying, but real life has been keeping me busy.....

I finally got around to testing DD, but got bored after 40 mins and also shutdown AutoIT as it wasnt going to be used to make a GUI for DD after all. The UDMA drivers under FreeDOS made little difference by the way.

Never said it was efficient or fast, just free and reliable.
Used in a LOT of Forensics analysists toolkits and works really nice on Linux-based systems.
Windows, well.... No comment.

[oscar]

linux alternatives partimage, dd, etc. are pieces of poo too if compared with ghost32 or ghost for DOS

[bilou_gateux]

Ghost32.exe v8.2 (This is part of Ghost Solution Suite 1.0) with Ghost Server is very useful for deployment in corporate.

but i like SelfImage as a freeware solution. If you save your image without compression, you can even mount it as virtual drive with the help of Bo Branten filedisk virtual disk driver.


I have tried to create a System Deployment Image (SDI) file and select my new SDI drive as output. But SelfImage fails to write to this virtual drive.

[jaclaz]

We have a couple of new entries :
http://sourceforge.net/projects/nfgdump/

nfgdump (Ntfs-Fat-Generic-dump) is a Win32/Linux tool that dumps/restores NTFS (including 3.1=XP), COMPRESSED NTFS, FAT16, FAT32 and arbitrary (generic) partitions. Dump files support compression, encryption, splits, page file content removal, etc.

http://sourceforge.net/projects/windd/

WinDD - Disk Dump for Windows! Windows XP version of Unix 'dd' command. Safe, effort-free backup for FAT, FAT32, NTFS, ext2, ext3 partitions.

Expecially the first one seems like a viable alternative as it features file splitting (for CD-Rom backup) and compression.....

jaclaz