Sections

Click on a link to jump to a specific section in this tutorial

1) Introduction
2) Required tools & setup
3) Creating Ghost image
4) Preparing files
5) Burning Boot Disc
6) Notes NORTON GHOST
7) Usage

Introduction
When you buy a new computer you will usually get some sort of restore/ recovery disc.
This is used to restore your operating system and software back to factory condition so
your PC will run as it did when you bought it. This is usually done by saving an image of
the partition where the OS & installed programs are located. The image is saved to a
single file or split into a spanned set of files if it's total size exceeds FAT32's 4GB file size
limitation. This guide will explain various ways to make a restore disc that you can
customize and tweak to your needs. Since it uses Symantec Norton Ghost it can be used
on just about any computer including those that are custom built or running Linux. The
two main methods of doing this is by either storing the image on the hard disk or on a
recordable disc. The advantage of storing the image to hard disk is faster speed and the
flexibility of overwriting images. Very useful if you make frequent changes to your
images. Ghost has the option of burning images directly to CD or DVD. The downside is
that it requires the user to use the bootable floppy along with those discs. This tutorial
will take it one step further and eliminate the need for a bootable floppy.

Required tools & setup

The screenshots from this tutorial are from a Windows XP machine. The software used is
Nero 6 Ultra Edition. If you are using a different Windows OS or burning program the
instructions will differ slightly, but the process is still same.
1) Windows Millennium startup diskette ( http://www.bootdisk.com/ ) or Ghost boot
disk
2) CD or DVD burning program capable of making a bootable disc. (
http://www.nero.com/, http://www.roxio.com/ )
3) CD or DVD burner
4) BIOS capable of booting up from a CD or DVD ( El Torito format specification. )

Creating Ghost image

This part assumes you know how to use the home or business versions of Symantec
Norton Ghost. Create your partition image (partition to image). Choose the partition that
the operating system & programs are installed on. Ghost does not use alphabetical DOS
drive assignment. Instead it uses numeric assignment in the form of Number1:Number2.
the first number is the drive. The second number is the partition within that drive. If you
have no clue what this means just pay attention to the size and volume label of the
partition you are selecting. Make note of what it says on the very last menu screen. What
you need to know is the source & destination locations. It also says this at the very
bottom of the screen. 1:2\ghost\winxp.gho usually means the image will be written to a
file called winxp.gho inside a folder called ghost on drive D: So 1:1 would usually be
drive C: the typical source partition where the OS & programs are install to. When
restoring 1:1 will be our destination so it is reversed.
Preparing files
The Windows Millennium startup diskette is going to provide the files used to make our
restore disc bootable. The configuration files of the boot data cannot be changed after
the disc is burned. There may be a lot of trial and error so using a re-writable CD will
save you from burning tons of coasters. There are hidden & system files we need to edit
inside the startup disk. You need to change
folder options to see them by enabling "show
hidden files" and disabling "hide OS files".
View the contents of the Windows Millennium startup diskette. We need to change only
two files: autoexec.bat and config.sys. Open autoexec.bat with notepad or WordPad. We
are going to tell ghost.exe where the image is stored and where to restore it to. Note if
ghost.exe is in some other folder than you must specify the directory before you issue
this command. After the Millennium diskette boots the computer it will start executing
what we really need it to do. These are the Ghost command line switches.

IF "%config%"=="NOCD" GOTO QUIT

IF "%config%"=="HELP" GOTO HELP
LH %ramd%:\MSCDEX.EXE /D:mscd001 /L:%CDROM%
ghost.exe -clone,mode=pload,src=1:2\ghost\winxp.gho:1,dst=1:1
::If MSCDEX doesn't find a drive...
IF ERRORLEVEL 1 SET CDPROB=1
::
GOTO QUIT

In this example src=1:2\ghost\winxp.gho:1 is the location of the image file (source)

with :1 designating the partition number within the image. If your image contains
multiple partitions you can restore a specific partition by specifying the partition number
inside the image. The comma is a separator so ,dst=1:1 (destination) means we are
restoring this image to partition one on physical hard disk one (this is usually drive C:).
You cannot restore an image to the same partition it is saved to. If it's a spanned image
all files have to be located in the same folder. This example is for an image saved to
hard disk. Using a CD or DVD burner is still very similar. You would replace the source
with something like src=CDR0001\ghost\winxp.gho:1 or whichever your burner is
assigned as in Ghost.

Click here for more Ghost command line switches

http://service1.symantec.com/SUPPORT/ghost.nsf/docid/1998082413392025?
Open&src=sg&docid=1998082612540625&nsf=ghost.nsf&view=40c79ec65
039a2b588256a0d004ca98e&dtype=&prod=&ver=&osv=&osv_lvl=
Config.sys
Open config.sys and edit the following to the very top of the configuration. We are
reducing the DOS menu to only one choice which will execute in one second:

Original:
[menu]
menuitem=HELP, Help
menuitem=CD, Start computer with CD-ROM support.
menuitem=NOCD, Start computer without CD-ROM support.
menuitem=QUICK, Minimal Boot
menudefault=HELP,30
menucolor=7,0

Revised:
[menu]
menuitem=CD, Restore Ghost Image.
menudefault=CD,1
menucolor=7,0

Optional: If you want to show people what a Sci-Fi geek you are open setramd.bat and
edit the echo messages like this. This step is not necessary and will be displayed while
the computer is being booted up:

@echo off
set RAMD=
set CDROM=

echo.
echo Retinal Scan Sequencing.....
echo Optical Neural Net Database .....Searching....Verified
echo Access Granted
echo.
--------------------------------------------------
a:\findramd
if "%RAMD%"=="C" goto c_drive
goto success
:c_drive
echo Initializing Partition Load Sequence.
echo System Sequence Initialized. Executing Primary Command.
echo Please wait.......
echo.
goto success

Another method which I haven't tried is using a Ghost boot floppy. This floppy can be
made with Ghost within windows. This method would replace the Millennium disk
entirely. It would also provide DOS mouse, USB2.0, firewire, and network support with
Ghost. You will still have to append the command line switches to an autoexec.bat file
otherwise the user will have to choose the target and source manually which makes
doing all of this pointless.

Burning Boot Disc

Open Nero and create a Boot CD or Boot DVD compilation. Don't use the expert settings
unless you have a reason to. If you are restoring the image from hard disk than a
recordable CD is good enough. If you want to save the image to disc you can either span
the it over multiple CD's or DVD's. If you are spanning images you must enable spanning
option within ghost before creating the image. You cannot split them after the image is
made. You can also choose to password protect your image. When this disc is being
made it will read the Millennium diskette we just edited. Make sure you do not finalize
this compilation. Don't add any extra files to it yet.

After it is burnt put the recordable disc back in the drive and create a CD-ROM ISO
continue with multisession. There is only session you can continue from so choose it. It
will complain about the CD not created using the multisession option, just ignore than
and accept. Here is where the files will be added. You can add whatever other files you
want, but leave room for the images unless it is on hard disk. For the other spanned
images just burn them to separate CD's. Ghost will prompt you to insert the next volume
when it's done reading each spanned image. They must be read in consecutive order.
When you burn the second part of the boot disc the required file you need to add to the
compilation is ghost.exe. You need at least Ghost version 2003 if you are restoring an
image with an operating system using an NTFS filing system.

Notes
You can use Ghost Explorer to add and replace files within a Ghost image if it is saved to
hard disk. This saves you the hassle of creating new images if you need to make only
minor changes. Gdisk can create hidden hard disk partitions. Useful if you want to save
images to a hidden partition for user protection. Compaq/HP sometimes put the images
to a hidden partition because people can't screw with it unless they know the partition is
there. But than again some people will still delete these partitions with a partitioning
utility like FDISK not knowing what it is or what it holds. After you make a partition
hidden with GDISK you can still save images to it with Ghost. GDISK is also partitioning
utility like FDISK. It can also be used to perform secure disk wiping to US Department of
Defense standards. This insures no data can be recovered from the hard disk.
Here's an example from my own machine. Note the H indicating a hidden partition. It is
where the Ghost image is stored.

C:\Program Files\Symantec\Norton Ghost 2003>gdisk32.exe /?

GDISK32 Fixed Disk Partitioning Utility

GDISK32 [disk] [/STATUS] [/RAW|/LBA] [/SER] [/X] [/I] [/S] [/Y] [/R]
GDISK32 disk /[-]ACT /P:partn-no [/X] [/I] [/S] [/Y] [/R]
GDISK32 disk /[-]HIDE /P:partn-no [/X] [/I] [/S] [/Y] [/R]
GDISK32 /BOOTINI {/ADD|/REMOVE|/DEFAULT} [/D:disk-no] [/P:partn-no]
[/DESC:desc] [/ENTRY:no] [/TIMEOUT:sec] [/INIFILE:filename]
[/BSECTFILE:filename] [/WINNT [/SYSFOLDER:folder]] [/R]
GDISK32 [disk] /BATCH[:filename] [switch[switch...]]
GDISK32 /? [/STATUS|/[-]ACT|/[-]HIDE|/BOOTINI|/BATCH]

Copyright (C) 1998-2002 Symantec Corp. All rights reserved. 2003.775.

C:\Program Files\Symantec\Norton Ghost 2003>gdisk32.exe 1 /status

Disk Partitions Cylinders Heads Sectors Mbytes Model
1 4 14593 255 63 114473.5 WDC WD1200JB-00CRA1

Partition Status Type Volume Label Mbytes System Usage

C:1 A PRIMARY 20481.3 NTFS/HPFS 18%
 2 EXTENDED 93989.7 82%
3 LOGICAL 81925.2 UNKNOWN 72%
4 H LOGICAL 12064.4 NTFS/HPFS 11%

Usage
Set your CD-rom as the first boot device in your motherboard's BIOS. Pressing F8 or
DELETE keys at computer bootup will usually get you into the CMOS configuration setup
utility.

BIOS SETUP UTILITY

------BOOT-------
1st Boot Device [ATAPI CD-ROM]
2nd Boot Device [Floppy]
3rd Boot Device [Hard Disk]
Other Boot Device [Enabled]

Put the restore disc in your CDROM drive and restart the computer. It will boot up and at
the very end Ghost will prompt a message asking "Proceed with Partition Clone
YES/NO?". It typically takes five minutes to restore the operating system & software back
depending on the total size of the image. If you make changes to the image on hard disk
you can still use the same restore disc to initiate the process as long as the image
location and destination are still the same.
_________________________________________________________________________________________
_________
Switches: Cloning
Question/Issue:
This document describes Ghost's -CLONE switch and the command-line parameters that are used as arguments for that switch.
Solution:
Ghost uses the -CLONE switch to specify the cloning operation that you want Ghost to perform.

Note that many additional switches can also be used while cloning. For a description of other Ghost switches, see the Ghost
Implementation Guide that accompanied your copy of Ghost, or read the document
Switches: Alphabetical list of switches.

-CLONE
The full syntax for this switch is:
-clone, MODE={copy|load|dump|pcopy|pload|pdump},
SRC={drive|file|drive:partition|@MCsessionname|@MTx},
DST={drive|file|drive:partition|@MCsessionname|@MTx},
SZE{F|L|n={nnnnM|nnP|F|V} }

Each -CLONE command can be used for only one imaging process at a time. For instance, you can use a single -CLONE command to restore one partition
from an image file that has five partitions, but you cannot use a single -CLONE command to restore two partitions from an image file that has five partitions.
To perform multiple imaging operations, use successive -CLONE commands on the same command line with the -BATCH command, or create a batch file
that has multiple Ghost.exe or Ghostpe.exe command lines. For an example of the -BATCH command, see Example 14 in this document.

Note: For information on the clone switches for Norton Ghost 2003, refer to page 166 of the Norton Ghost 2003 User's Guide
located on the CD or on your hard drive. The Norton Ghost 2003 User's Guide is automatically installed on your hard drive
during the installation. The default location and file name for the Norton Ghost 2003 User's Guide is \Program
Files\Symantec\Norton Ghost 2003\Ghost_Guide.pdf. Adobe Acrobat Reader must be installed to view the User's Guide. A copy
of Adobe Acrobat Reader is included on the Norton Ghost 2003 CD or it can be downloaded from www.adobe.com.
MODE=COPY
Used to copy the contents of one hard drive to another.
,SRC=drive number Number of the source drive. For example, 1 for the first drive.
,DST=drive number Number of the destination drive.
For an internal drive: The drive number of the destination drive in the computer.
For example, use 2 for the second internal drive.
For an LPT connection: The drive number of the drive in the slave computer. For
example, use 1 for the first drive on the slave computer.
For a NetBIOS connection: The drive number of the drive in the slave computer.
For example, use 1 for the first drive on the slave computer.
,SZE Set the size of the destination partitions. See explanation of SZE switch below.

MODE=LOAD
Used to copy the contents of an image file to a disk. This will copy all the partitions in the image file.

,SRC=<path and For an internal drive: The path and filename of the image on the local drive. For
filename> or tape example: C:\IMAGE.GHO.
device For a tape drive: Use @MTx where x is the number of the SCSI device starting at 0
and incrementing for each device present.
For an LPT connection: The image file on the slave computer. For example:
C:\IMAGE.GHO. Must also use -LPM switch.
For a NetBIOS connection: The image file on the slave computer. For example:
C:\IMAGE.GHO. Must also use -NBM switch.
For Multicasting: The multicast session name using @Mcsessionname where
sessionname is the name of the multicast session. For example, @MCsession1.
,DST=drive number The number of the destination drive. This refers to the internal drive on the computer.
For example, use 2 for drive two.
,SZE Set the size of the destination partitions. See explanation of SZE switch below.

MODE=DUMP
Used to create an image file of a disk. This copies all of the partitions to an image file

,SRC=drive number Number of the source drive. For example, use 1 for drive one.
,DST=<path and For an internal drive: The path and filename of the image on the local drive. For
filename> or tape example: C:\IMAGE.GHO.
device For a tape drive: Use @MTx where x is the number of the SCSI device starting at 0
and incrementing for each device present.
For an LPT connection: The image file on the slave computer. For example:
C:\IMAGE.GHO. Must also use -LPM switch.
For a NetBIOS connection: The image file on the slave computer. For example:
C:\IMAGE.GHO. Must also use -NBM switch.
For Multicasting: The multicast session name using @Mcsessionname where
sessionname is the name of the multicast session. For example, @MCsession1.
For a CD-R or CD-RW drive: Use @CDx where x is the number of the CD/R or
CD/RW device on the IDE or SCSI chain.

MODE=PCOPY
Used to duplicate a partition to another partition.

,SRC=source The Drive number:Partition number of source drive. For example: 1:2 refers to the
partition second partition on the first drive.
,DST=destination The Drive number:Partition number of the destination drive.
partition For an internal drive: The drive number and partition number of the internal drive
you are writing to. For example, use 2:1 to specify the first partition on the second
drive.
For an LPT connection: The drive number and partition number of the drive on the
slave computer. Number the drives as if they were connected locally. For example, use
1:3 to specify the third partition on the first drive on the slave computer. Must also
use the -LPM switch.
For a NetBIOS connection: The drive number and partition number of the drive on
the slave computer. Number the drives as if they were connected locally. For example,
use 1:3 to specify the third partition on the first drive on the slave computer. Must
also use -NBM switch.
For Multicasting: The multicast session name using @Mcsessionname where
sessionname is the name of the multicast session. For example, @MCsession1.
MODE=PLOAD or MODE=PRESTORE
Used to copy a partition from an image file to a local drive.

Note: The pload switch is replaced by the prestore switch in Symantec Ghost 8.x and higher. The pload switch is still fully
functional and is interchangeable with prestore.

,SRC=<path and For an internal drive: The path and file name of the image on the local drive
filename>:<partition followed by the partition number in the image. For example: C:\IMAGE.GHO:2
number> or tape For a tape drive: @MTx where x is the number of the SCSI device starting at
device 0 and incrementing for each device present.
For an LPT connection: The image file on the slave computer. For example:
C:\IMAGE.GHO. Must also use -LPM switch.
For a NetBIOS connection: The image file on the slave computer. For
example: C:\IMAGE.GHO. Must also use -NBM switch.
For Multicasting: The multicast session name using @Mcsessionname where
sessionname is the name of the multicast session. For example, @MCsession1.

NOTE: When the location of the image file is not a tape device, the SRC
parameter requires the partition number even when the source image file has
only one partition. That is, when the source image file contains more than one
partition, use the partition number to specify which partition you want to write
to the destination partition. When the source image contains only one
partition, use the numeral 1.

All disk images contain at least one partition. For instance, when a computer
has two physical hard drives, one labeled C and the other labeled D and E, the
first drive is one partition and the second drive has two partitions. Similarly, a
disk image of the first hard drive, C, contains one partition.

For example, when a disk image file contains only one partition and you want
to write the disk image from a CD-ROM to the first partition of a two partition
disk, use the following command line:

ghost.exe -clone,mode=pload,src=D:GHOSTIMAGE.GHO:1,dst=1:2
,DST=<drive The Drive number:Partition number of destination drive. For example: 1:2
number>:<partition refers to the second partition on the first drive.
number>

MODE=PDUMP
Used to create an image file of a partition.

,SRC=source The Drive number:Partition number of source drive. For example: 1:2 refers to the
partition second partition on the first drive.
,DST=<path and For an internal drive: The path and filename of the image on the local drive. For
filename> or tape example: C:\IMAGE.GHO.
device For a tape drive: Use @MTx where x is the number of the SCSI device starting at 0
and incrementing for each device present.
For an LPT connection: The image file on the slave computer. For example:
C:\IMAGE.GHO. Must also use -LPM switch.
For a NetBIOS connection: The image file on the slave computer. For example:
C:\IMAGE.GHO. Must also use -NBM switch.
For Multicasting: The multicast session name using @Mcsessionname where
sessionname is the name of the multicast session. For example, @MCsession1.
For a CD/R or CD/RW drive: Use @CDx where x is the number of the CD/R or
CD/RW device on the IDE or SCSI chain.
SZE switch
Used to set the size of the destination partitions for a disk load or disk copy operation. This switch is only effective with the
LOAD and COPY modes. The SZE switch can be used more than once in the same command.

SZEE The size of all partitions remains fixed. That is, the size of the destination partition will
not be different from the source drive.
SZEF Resizes the first partition to maximum size allowed based on file system type.
SZEL Resizes the last partition to maximum size allowed based on file system type. If
additional space remains, other partition sizes will be increased.
SZEn=xxxxM Indicates that the nth destination partition is to have a size of xxxx MB. For example,
SZE2=800M indicates that the second partition should be 800 MB.
SZEn=mmP Indicates that the nth destination partition is to have a size of mm percent of the
target disk. For example, SZE2=40P indicates that the second partition is to be 40%
of the total disk space on the target drive.
SZEn=F Indicates that the nth destination partition is to remain fixed in size. For example,
SZE3=F indicates that the third partition size is unchanged on the target drive.
SZEn=V Indicates that the nth partition will be resized according to the following rules:
Rule 1: If the destination disk is larger than the original source disk, then the
partitions will be expanded to have the maximum amount of space subject to the free
space available and the partition type. For instance, FAT16 partitions will have a
maximum size of 2048 MB
Rule 2: If the destination disk is smaller than the original source disk, (but still large
enough to accommodate the data from the source disk), the free space left over after
the data space has been satisfied will be distributed between the destination
partitions in proportion to the data usage in the source partitions.

Example 1
Copy drive one to drive two on a computer without the final prompt:
ghost.exe -clone,mode=copy,src=1,dst=2 -sure

Example 2
Connect through NetBIOS to another computer that is running Ghost in slave mode, and dump a disk image of the second
local drive to the remote file c:\drive2.gho:
ghost.exe -clone,mode=dump,src=2,dst=C:\drive2.gho -nbm
** Note that Ghost at the slave computer can be started with ghost -nbs.

Example 3
Copy the second partition on drive one to the first partition on drive two on the same computer without the final prompt:
ghost.exe -clone,mode=pcopy,src=1:2,dst=2:1 -sure

Example 4
Load the disk image file savedsk.gho on the server drive mapped locally to drive E onto drive 1 of the local computer. Do not
prompt if OK to proceed:
ghost.exe -clone,mode=load,src=E:\savedsk.gho,dst=1 -sure
** This example is typical what would be in a batch file that automates workstation installations from a network server.

Example 5
Dump the second partition of drive one to an image file on the G: drive:
ghost.exe -clone,mode=pdump,src=1:2,dst=g:\part2.gho

Example 6
Load partition 2 from a two-partition image file on a mapped drive G: onto the second partition of the local disk:
ghost -clone,mode=pload,src=g:\part2.gho:2,dst=1:2
Example 7
Load drive 2 from an image file, and resize the destination partitions into a 60:40 allocation:
ghost.exe -clone,mode=load,src=g:\2prtdisk.gho,dst=2,sze1=60P,sze2=40P

Example 8
Clone a three partition disk and keep the first partition on the destination drive the same size as on the source disk, but
divide up the remaining space between the other partitions leaving no unallocated space:
ghost.exe -clone,mode=copy,src=1,dst=2,sze1=F,sze2=V,sze3=V

Example 9
Load drive one from an image file and resize the first partition to 450 MB, the second to 1599 MB and the third to 2047 MB:
ghost.exe -clone,mode=load,src=g:\3prtdisk.gho,dst=1,sze1=450M,sze2=1599M,sze3=2047M

Example 10
Load a disk from an image file and resize the last partition to its capacity. The first partition utilizes the remaining space:
ghost.exe -clone,mode=load,src=g:\2prtdisk.gho,dst=1,szeL

Example 11
Load drive one from an image file being sent from the multicast server with the session name SESSIONNAME without final
prompt:
ghost.exe -clone,src=@mcSESSIONNAME,dst=1 -sure

Example 12
Create an image file of drive one to an image file being created by the multicast server with the session name SESSIONNAME
without final prompt:
ghost.exe -clone,src=1,dst=@mcSESSIONNAME -sure

Example 13
Create an image file of drive two's partitions to an image file being created by the multicast server with the session name
SESSIONNAME:
ghost.exe -clone,src=2,dst=@mcSESSIONNAME

Example 14
Write an image that has three partitions to drive one. Use an image file that is sent by the Multicast Server or GhostCast
Server using the session name SESSIONNAME. Also resize the first partition to 450 MB, the second partition to 1599 MB and
the third partition to 2047 MB.
Because this task requires one imaging operation for each partition that you will resize, the task requires that you use a batch
file. Using a batch file with error checking prevents the need for user intervention if a problem occurs.
In the following batch file, the first line executes the -CLONE command three times. The first instance uses the word -CLONE,
and the other two instances (which are ,sze1=450M and ,sze3=2047M), use the comma to instruct Ghost to use default
commands.
The following batch file is incomplete and is intended only as an example of typical commands that a batch file for Ghost
might use.
ghost.exe -clone,src=@mcSESSIONNAME,dst=1,sze1=450M,sze2=1599M,sze3=2047M -batch
IF ERRORLEVEL 1 GOTO PROBLEM
ECHO Ghost exited with value of 0 which indicates success.
REM **Add any extra commands that are required here if Ghost succeeds**
GOTO FINISH
:PROBLEM
ECHO GHOST returned with an Error value of 1 or greater.
ECHO Ghosting was not completed successfully
REM **Add any extra commands that are required here if Ghost fails**
:FINISH
ECHO Batch File Finished.

Example 15
In this example, under Symantec Ghost 8.0, there is one hard drive with two partitions. One or both partitions could be an
NTFS partition. The following command writes the image of the first partition to the second partition under the image.gho file
name.
ghost.exe -clone,mode=pdump,src=1:1,dst=1:2\image.gho