Ghost

Norton Ghost v15 home screen
Original author(s)	Murray Haszard
Developer(s)	Symantec
Initial release	1995 (1995)
Stable release(s)
Consumer 15.0.1.36526 / April 1, 2010; 14 years ago (2010-04-01)[1] Enterprise 12.0.0.10695 / June 3, 2020; 4 years ago (2020-06-03)[2]
Operating system	Windows XP SP3 and later Windows Server 2008 and later[3]
Type	Disk cloning
License	Trialware
Website	ghost.com

GHOST (an acronym for general hardware-oriented system transfer^[4]), now called Symantec™ GHOST Solution Suite (GSS)^[5] for enterprise, is a disk cloning and backup tool originally developed by Murray Haszard in 1995 for Binary Research. The technology was bought in 1998 by Symantec.

The backup and recovery feature was replaced by Symantec System Recovery (SSR).

Broadcom bought Symantec's Enterprise Security business in 2019.

GHOST is marketed as an OS (Operating System) deployment solution. Its capture and deployment environment requires booting to a Windows PE environment. This can be accomplished by creating an ISO (to burn to a DVD) or a USB bootable disk, installed to a client as an automation folder or delivered by a PXE server. This provides an environment to perform offline system recovery or image creation. GHOST can mount a backup volume to recover individual files.

GHOST can copy the contents of one volume to another or copy a volume's contents to a virtual disk in VMDK or VHD format.

Initially, GHOST supported only the FAT file system, but could only copy (not resize) other file systems by performing a sector-by-sector transfer. GHOST added support for NTFS later in 1996, and also provided a program, Ghostwalker, to change the Security ID (SID) that made Windows NT systems distinguishable from each other. Ghostwalker is capable of modifying the name of the Windows NT computer from its own interface. GHOST added support for the EXT2 file system in 1999 and for EXT3 subsequently. Support for EXT4 was added in September 2017 (Enterprise only).

Binary Research developed GHOST in Auckland, New Zealand. After the Symantec acquisition, a few functions (such as translation into other languages) were moved elsewhere, but the main development remained in Auckland until October 2009 at which time much was moved to India.^{[citation needed]}

Technologies developed by 20/20 Software were integrated into GHOST after their acquisition by Symantec in April 2000.^[6]

GHOST 1.0 and 1.1 were released in 1996, followed by 2.0 (2.07) in the same year. These versions supported only the cloning of entire disks. They could run on an IBM XT and without extended memory. They also worked with OS/2.^[7]

Version 3.1, released in 1997 supports cloning individual partitions. GHOST could clone a disk or partition to another disk or partition or to an image file. GHOST allows for writing a clone or image to a second disk in the same machine, another machine linked by a parallel or network cable, a network drive, or to a tape drive. 3.1 uses 286 with XMS and could still run on OS/2.^[7]

Version 4.0 of GHOST added multicast technology, following the lead of a competitor, ImageCast. Multicasting supports sending a single backup image simultaneously to other machines without putting greater stress on the network than by sending an image to a single machine. This version also introduced GHOST Explorer, a Windows program which supports browsing the contents of a disk image file and extracting individual files from it. Explorer was subsequently enhanced to support adding and deleting files in a FAT-formatted image, and later with EXT2, EXT3 and NTFS file systems. Until 2007, GHOST Explorer could not edit NTFS images. GHOST Explorer could work with images from older versions but only slowly; version 4 images contain indexes to find files rapidly.

Version 4.0 also moved from real-mode DOS to 286 protected mode via Pharlap Extender.^[7] The additional memory available allows GHOST to provide several levels of compression for images, and to provide the file browser. In 1998, GHOST 4.1 supports password-protected images. This version dropped OS/2 support.^[7]

Version 5.0 moved to 386 protected mode. Unlike the text-based user interface of earlier versions, 5.0 uses a graphical user interface (GUI). The Binary Research logo, two stars revolving around each other, plays on the main screen when the program is idle.^[7] In 1998, Gdisk, a script-based partition manager, was integrated in Ghost. Gdisk serves a role similar to Fdisk, but has greater capabilities.

A Norton GHOST version for Novell NetWare (called 2.0), released around 1999, supports NSS partitions (although it runs in DOS, like the others).

GHOST 6.0, released in 2000, includes a management console for managing large numbers of machines. The console communicates with client software on managed computers and allows a system administrator to refresh the disk of a machine remotely. As a DOS-based program, GHOST requires machines running Windows to reboot to DOS to run it. GHOST 6.0 requires a separate DOS partition when used with the console.^[8]

Released March 31, 2001, Norton GHOST version 7.0 (retail) was marketed as Norton GHOST 2002 Personal Edition.

Released December 14, 2001, GHOST 7.5 creates a virtual partition, a DOS partition which actually exists as a file within a normal Windows file system. This significantly eased systems management because the user no longer had to set up their own partition tables. GHOST 7.5 can write images to CD-R discs. Later versions can write DVDs.

GHOST 8.0 can run directly from Windows. It is well-suited for placement on bootable media, such as BartPE′s bootable CD. The corporate edition supports unicast, multicast and peer-to-peer transfers via TCP/IP. GHOST 8.0 supports NTFS file system, although NTFS is not accessible from a DOS program.

The off-line version of Ghost, which runs from bootable media in place of the installed operating system, originally faced a number of driver support difficulties due to limitations of the increasingly obsolete 16-bit DOS environment. Driver selection and configuration within DOS was non-trivial from the beginning, and the limited space available on floppy disks made disk cloning of several different disk controllers a difficult task, where different SCSI, USB, and CD-ROM drives were involved. Mouse support was possible but often left out due to the limited space for drivers on a floppy disk. Some devices such as USB often did not work using newer features such as USB 2.0, instead only operating at 1.0 speeds and taking hours to do what should have taken only a few minutes. As widespread support for DOS went into decline, it became increasingly difficult to get hardware drivers for DOS for the newer hardware.

Disk imaging competitors to GHOST have dealt with the decline of DOS by moving to other recovery environments such as FreeBSD, Linux or Windows PE, where they can draw on current driver development to be able to image newer models of disk controllers. Nevertheless, the DOS version of GHOST on compatible hardware configurations works much faster than most of the *nix based image and backup tools^{[citation needed]}.

GHOST 8 and later are Windows programs; as such, they can run on Windows PE, BartPE or Hiren's BootCD and use the same plug and play hardware drivers as a standard desktop computer, making hardware support for GHOST much simpler.

Norton GHOST 2003, a consumer edition of Ghost, was released on September 6, 2002. Available as an independent product, Norton GHOST 2003 was also included as a component of Norton SystemWorks 2003 Professional. A simpler, non-corporate version of Ghost, Norton GHOST 2003 does not include the console but has a Windows front-end to script GHOST operations and create a bootable GHOST diskette. The machine still needs to reboot to the virtual partition, but the user does not need to interact with DOS. Symantec deprecated LiveUpdate support for Norton GHOST 2003 in early 2006.

At the end of 2003, Symantec acquired its largest competitor in the disk-cloning field,^{[citation needed]} PowerQuest. On August 2, 2004, Norton GHOST 9.0 was released as a new consumer version of Ghost, which is based on PowerQuest's Drive Image version 7, and provides Live imaging of a Windows system. GHOST 9 continues to leverage the PowerQuest (v2i) file format, meaning it is not backward compatible with previous versions of Ghost. However, a version of GHOST 8.0 is included on the GHOST 9 recovery disk to support existing GHOST customers.

GHOST split into two code bases following the acquisition of PowerQuest. The consumer line uses PowerQuest's V2I technology, while the enterprise line builds upon the original GHO format.

GHOST 9.0 was released August 2, 2004. It represents a significant shift in the consumer product line from GHOST 2003, in several ways:

• It uses a totally different code base, based on the DriveImage/V2i Protector product via Symantec's acquisition of PowerQuest.
• It is a Windows program that must be installed on the target system.
• Images can be made while Windows is running, rather than only when booted directly into DOS mode.
• Incremental images (containing only changes since the last image) are supported.
• Requires Product Activation in order to function fully.
• The bootable environment on the GHOST 9 CD is only useful for recovery of existing backups. It cannot be used to create new images.

Since GHOST 9 does not support the older .gho format disk images, a separate CD containing GHOST 2003 is included in the retail packaging for users needing to access those older images.

The limitations of GHOST 9 compared to GHOST 2003 were not well-communicated by Symantec, and resulted in many dissatisfied customers who purchased GHOST 9 expecting the previous version's features (like making images from the bootable GHOST environment, no installation required, and no product activation).

Released circa 2005. Supports creating images on CDs, DVDs, Iomega Zip and Jaz disks as well as IEEE 1394 (FireWire) and USB mass storage devices. Supports encrypting images and Maxtor external hard disk drives with Maxtor OneTouch buttons. GHOST 10.0 is compatible with previous versions, but not with future versions.

Norton Save And Restore 1.0, released in February 2006, was the renamed consumer version of Ghost. It used GHOST 10.0's engine, with the addition of features to allow backup and restoration of individual files.

GHOST 12.0 (April 2007) includes Windows Vista support with an updated and more thorough user interface. It supports both full system backup and individual files or folders backup.

This version provides a "LightsOut Restore" feature, which restores a system from an on-disk software recovery environment similar to Windows RE, thereby allowing recovery without a bootable CD. Upon system startup, a menu asks whether start the operating system or the LightsOut recovery environment. LightsOut restore would augment the ISO image, which comes with Ghost. The latter contains a recovery environment that can recover a system without a working operating system.

NSR 2.0 has fewer features in comparison to Norton GHOST 12. NSR 2.0 offers one-time backups, file and folder backup, simplified schedule editor, Maxtor OneTouch integration and modifiable Symantec recovery disc. This version supports 32-bit and 64-bit versions of Windows XP and Vista.

Version 14.0 (November 2007) uses Volume Snapshot Service (VSS) to make backups and can store backups to an FTP site. GHOST can connect to ThreatCon, a Symantec service that monitors malware activity around the world, and performs incremental backups when a specific threat level is reached. Other features include the ability to back up to network-attached storage devices and support for NTFS partitions up to 16TB. GHOST can manage other installations of version 12.0 or later across a network.

This version no longer supports opening .gho image files. It stores images in .v2i format. Incremental backup images created with Norton GHOST are saved with .iv2i filename extensions alone the original full backup (with .v2i filename extension) on a regular basis. Older .gho image files can be restored using GHOST Explorer, a separate utility.

According to the Norton community on Symantec's site,^[9] the following features are available in Norton GHOST 15 of April 2010:

Norton GHOST was discontinued on April 30, 2013.^[10] Support via chat and knowledge base was available until June 30, 2014. Until it was removed,^[10] the Symantec GHOST Web page invited GHOST customers to try Symantec System Recovery,^[11] described as software for backup and disaster recovery.

Released November 15, 2004, Symantec renamed the Enterprise version of GHOST to Symantec GHOST Solution Suite 1.0. This helped clarify the difference between the consumer and business editions of the product. According to Symantec, Symantec GHOST and Norton GHOST are two separate product lines based around different technologies developed by different teams.^[12] This was further defined in February 2006, with the release of Norton Save And Restore (also known as Norton Backup And Restore), a standalone backup application based on GHOST 10.0.

GHOST Solution Suite 1.1 was released in December 2005. GHOST Solution Suite 1.1 is a bundle of an updated version of Ghost, Symantec Client Migration (a user data and settings migration tool) and the former PowerQuest equivalent, DeployCenter (using PQI images). It can create an image file that is larger than 2 GB. (In GHOST 8.2 or earlier, such image files are automatically split into two or more segments, so that each segment has a maximum size of 2 GB.) Other new features include more comprehensive manufacturing tools, and the ability to create a "universal boot disk".^{[further explanation needed]}

GHOST Solution Suite 2.0 was released in November 2006. This version provides significant improvements in performance, as well as the ability to edit NTFS images. This version also adds support for Windows Vista, x64 versions of Windows, and GUID Partition Table (GPT) disks. However, the software does not fully support systems with Extensible Firmware Interface (EFI) firmware.

GHOST 11.0 supports saving and restoring from native GHOST image format (.gho, .ghs) and raw images (.img, .raw).

The GHOST software for enterprise, including GHOST 11.5, was released in May 2008.^[13] New features include:^[14]

As of January 6, 2010, the latest build from Live Update is 11.5.1.2266 (Live Update 5 (LU5)).^[15] This updates GHOST Solution Suite to 2.5.1 and provides support for Windows 7 and Windows Server 2008 R2. Furthermore, GHOST 11.5 is compatible with BartPE's bootable CD using a PE Builder plug-in for Symantec GHOST 11

GSS 3.0, including GHOST 12.0 and Deployment Solution 6.9, was announced in March 2015.^[16]

GSS 3.1, including GHOST 12.0 and Deployment Solution 6.9, was released on 7 March 2016.

GSS 3.2, including GHOST 12.0 and Deployment Solution 6.9, was released on 18 May 2017. Release Update 3, which was released 22 September 2017, added support for the ext4 filesystem.^[17]

GSS 3.3, including GHOST 12.0 and Deployment Solution 6.9, was released on 31 October 2018. This release added support for GHOST Solution Suite Web Console, iPXE, Windows Server 2016, Smart raw imaging, and 4K native drive support.

• Comparison of disk cloning software

• Symantec GHOST – Solution suite (previously Norton GHOST Enterprise Edition) product page
• Symantec News