Ghost (software)

From Wikipedia, the free encyclopedia - View original article

Norton Ghost icon.png
Norton Ghost v15 Home Screen.jpg
Norton Ghost v15 home screen
Original author(s)Murray Haszard
Initial releasebefore 1997
Discontinued15.0.1.36526 / April 1, 2010; 4 years ago (2010-04-01)[1]
Development statusDiscontinued on April 30, 2013[2]
Operating systemWindows XP and later
Available inEnglish
TypeBackup software
Jump to: navigation, search
This article is about the backup software. For the blogging platform, see Ghost (blogging platform).
Norton Ghost icon.png
Norton Ghost v15 Home Screen.jpg
Norton Ghost v15 home screen
Original author(s)Murray Haszard
Initial releasebefore 1997
Discontinued15.0.1.36526 / April 1, 2010; 4 years ago (2010-04-01)[1]
Development statusDiscontinued on April 30, 2013[2]
Operating systemWindows XP and later
Available inEnglish
TypeBackup software

Ghost (an acronym for general hardware-oriented system transfer[3]) is a disk cloning and backup tool originally developed by Murray Haszard in 1995 for Binary Research. The technology was acquired in 1998 by Symantec.


Binary Research developed Ghost in Auckland, New Zealand. After the Symantec acquisition, a few functions (such as translation into other languages) were moved elsewhere, but the main development remained in Auckland until October 2009 at which time much was moved to India.[citation needed]

Technologies developed by 20/20 Software were integrated into Ghost after their acquisition by Symantec in April 2000.[4]


At the end of 2003, Symantec acquired its largest competitor in the disk-cloning field,[citation needed] PowerQuest. On August 2, 2004, Norton Ghost 9.0 was released as a new consumer version of Ghost, which was based on PowerQuest′s Drive Image version 7, and provided Live imaging of a Windows system. Ghost 9 continued to leverage the PowerQuest file format, meaning it wasn′t backward compatible with previous versions of Ghost. However, a version of Ghost 8.0 was included on the Ghost 9 recovery disk to support existing Ghost customers.

Ghost 3.1[edit]

The first versions of Ghost supported only the cloning of entire disks, however version 3.1 in 1997 allowed the cloning of individual partitions. Ghost could clone a disk or partition to another disk or partition or to an image file. Ghost allowed for writing a clone or image to a second disk in the same machine, another machine linked by a parallel or network cable, a network drive, or to a tape drive.

Ghost 4.0 and 4.1[edit]

Version 4.0 of Ghost added multicast technology, following the lead of a competitor, ImageCast. Multicasting allows sending a single backup image simultaneously to other machines without putting greater stress on the network than by sending an image to a single machine. This version also introduced Ghost Explorer, a Windows program which allowed a user to browse the contents of an image file and extract individual files from it. Explorer was subsequently enhanced to allow users to add and delete files on FAT, later on ext2, ext3 and NTFS filesystems in an image. Until 2007, Ghost Explorer could extract files from NTFS images but not edit NTFS images. Ghost Explorer could work with images from older versions but only slowly; version 4 images contained indexes to find files rapidly. Version 4.0 also moved from real-mode DOS to 286 protected-mode. The additional memory available allowed Ghost to provide several levels of compression for images, and to provide the file browser. In 1998, Ghost 4.1 allowed for password-protected images.

Ghost 5.0[edit]

Version 5.0 moved to 386 protected mode. Unlike the character-based user interface of earlier versions, 5.0 used a GUI. The Binary Research logo, two stars revolving around each other, played on the main screen while the program idled. In 1998 Gdisk, a script based partition manager, was integrated in Ghost. Gdisk serves a role similar to Fdisk, but has greater capabilities.

Ghost for NetWare[edit]

There was also a Norton Ghost version (called 2.0) for Novell NetWare around 1999, with supported NSS partitions (although it ran in DOS, like the others).

Ghost 6.0 (Ghost 2001)[edit]

Ghost 6.0 included a Console application in 2000 to simplify the management of large numbers of machines. The Console communicates with client software on managed computers to allow a system administrator to refresh the disk of a machine remotely.

As a DOS-based program, Ghost required machines running Windows to reboot to a DOS environment to run it. Ghost 6.0 required a separate DOS partition when used with the Console.

Ghost 7.0 / Ghost 2002[edit]

Released March 31, 2001 Norton Ghost version 7.0 (retail) was marketed as Norton Ghost 2002 Personal Edition. Help|About reveals version 7.00.

Ghost 7.5[edit]

Released December 14, 2001

Ghost 7.5 in 2002 created a ‘Virtual Partition’ instead – a DOS partition which actually exists as a file within a normal Windows filesystem. This significantly eased systems management because the user no longer had to set up their own partition tables. Ghost 7.5 could also write images to CD-R drives, and later versions can also write DVDs.

Symantec Ghost 8.0[edit]

Ghost 8.0 includes a standalone executable (filename: ghost32.exe) that runs directly from Windows, without the need to reboot. It is very well-suited for placement on bootable media, such as BartPE′s bootable CD. The Corporate edition supports Unicast, Multicast and peer-to-peer transfers via TCP/IP. Ghost 8.0 also allows an image to be saved on, or read from, an NTFS filesystem, although NTFS is not normally accessible from a DOS program.

Norton Ghost 2003[edit]

Norton Ghost 2003, a consumer edition of Ghost, was released on September 6, 2002. Available as an independent product, Norton Ghost 2003 was also included as a component of Norton SystemWorks 2003 Professional. A simpler, non-corporate version of Ghost, Norton Ghost 2003 does not include the Console but has a Windows front-end to script Ghost operations and create a bootable Ghost diskette (third-party CD burning software can be used to create a bootable Ghost CD based on a bootable Ghost diskette). The machine still needs to reboot to the Virtual Partition, but the user doesn′t need to interact with DOS. Symantec deprecated LiveUpdate support for Norton Ghost 2003 in early 2006.

Symantec Ghost Solution Suite 1.0 (Ghost 8.2)[edit]

Symantec Ghost 8.2

In 2004, Symantec renamed the Enterprise version of Ghost to Symantec Ghost Solution Suite 1.0. This helped to clarify the difference between the consumer and business lines of the product. This was further defined in February 2006, with the Release of Norton Save And Restore (some packages are labelled Norton Backup And Restore), a standalone backup application based on Ghost 10.0.

Released November 15, 2004

Symantec Ghost Solution Suite 1.1 (Ghost 8.3)[edit]

Ghost Solution Suite 1.1 was released December 2005. Some of the new features include the ability to create an image file that is larger than 2 GB (in Ghost 8.2 or earlier versions, such image files are automatically split into two or more segments, so that each segment has a maximum size of 2 GB), more comprehensive manufacturing tools, and the ability to create a universal boot disk. Ghost Solution Suite is a bundle of an updated version of Ghost, Symantec Client Migration (a user data and settings migration tool) and the former PowerQuest equivalent, DeployCenter (using PQI images).

Norton Ghost 9.0 (includes Ghost 2003)[edit]

Ghost 9.0 was released August 2, 2004. It represents a significant shift in the consumer product line from Ghost 2003, in several ways:

Since the DriveImage-based Ghost 9 did not support the older .gho format disk images, a separate CD containing Ghost 2003 was included in the retail packaging for users needing to access those older images.

The limitations of Ghost 9 compared to Ghost 2003 were not well communicated by Symantec, and resulted in many dissatisfied customers who purchased Ghost 9 expecting the previous version′s features (like making images from the bootable Ghost environment, no installation required, and no product activation).

Norton Ghost 10.0[edit]

Supported media CDR/RW and DVD+-R/RW drives, USB and FireWire (IEEE 1394) devices, and Iomega Zip and Jaz drives. Enables the encryption of backups and support for Maxtor external drives with Maxtor OneTouch buttons. The Ghost version 10.0 are compatible with previous revisions, but not with future revisions.

Norton Save And Restore 1.0 (Ghost 10.0)[edit]

Norton Save And Restore 1.0, released February 2006, was the renamed consumer version of Ghost. The system utilized Ghost 10.0′s engine, with the addition of features to allow backup and restoration of individual files.

Symantec Ghost Solution Suite 2.0 (Ghost 11.0)[edit]

Ghost Solution Suite 2.0 was released in November 2006. This version provides significant improvements in performance, as well as the ability to edit NTFS images. This version also adds support for Windows Vista, x64 versions of Windows, and GUID Partition Table (GPT)-based disks (although the software does not yet fully support systems with Extensible Firmware Interface (EFI)-compliant firmware). Running Live Update from Ghost Explorer will update Ghost to

Ghost 11.0 supports saving and restoring from native Ghost image format (.GHO, .GHS) and raw images (.IMG, .RAW).

Norton Ghost 12.0[edit]

Ghost 12.0 includes Windows Vista support with an updated and more thorough user interface. It allowed for a full system backup & one where individual files or folders can be selected & backed up.

This version also provided a “LightsOut Restore” feature. This restored a system with an on-disk software recovery environment, thereby allowing a recovery without a bootable CD. Upon computer boot-up, a screen will ask which drive to boot from, the regular drive, or the LightsOut restore virtual drive.

LightsOut restore would augment the ISO disk, which came with the Ghost program, that had to be burned to a CD. That contained a recovery environment that allowed one to recover files even if Windows didn′t start up, but the computer could turn on. The latest update to that program was

Norton Save & Restore 2.0 (Ghost 13.0)[edit]

NSR 2.0 has fewer features when compared to Norton Ghost 12. NSR 2.0 offers one-time backups, file and folder backup, simplified schedule editor, Maxtor OneTouch integration and modifiable Symantec recovery disc.

This version also supports 32-bit and 64-bit versions of Windows XP and Vista.

Norton Ghost 14.0[edit]

Version 14.0 preserves the features of version 12.0, with the ability to make full Volume Snapshot Service (VSS) backups and the option to make remote backups to an FTP site as another storage option. Ghost also leverages data from ThreatCon, which monitors malware activity around the world, and performs incremental backups when a specific threat level is reached. However, this functions only when connected to the Internet, so it will not resist any local attack.

Other features include the ability to back up to network-attached storage devices and support of NTFS partitions up to 16TB. Ghost can manage other installations of version 12.0 or later across a network. Version 14 supports XP and Vista. The latest version is This version no longer supports opening of older version .gho image files. Rather, it stores images in .v2i format. Incremental backup images created with Norton Ghost saved with the file extension .IV2I on a regular basis after the initial volume backup (.V2I). The .iv2i file must be saved along with the initial .v2i backup file in order to function correctly. Older .gho image files can be restored using Ghost Explorer, a separate utility.

Symantec Ghost Solution Suite 2.5 (Ghost 11.5)[edit]

This is the current version of the enterprise software, and includes Ghost 11.5. It was released in May 2008.[5] New features include DeployAnywhere, Hot Imaging, logical volume support, additional image formats, and new PreOS (boot disk) operating systems.[6] As of January 6, 2010, the latest build from Live Update is (Live Update 5 (LU5)).[7] This updates to Ghost Solution Suite 2.5.1 and provides support for Windows 7 and 2008 R2. Furthermore Ghost 11.5 is compatible with BartPE's bootable CD using a PE Builder plug-in for Symantec Ghost 11.

Ghost 11.5 supported saving to and restoring from native Ghost image format (.GHO and .GHS) and VMDK format. It also supports restoring from .V2I, .IV2I, .PQI formats.

DeployAnywhereAllows drivers to be injected during image deployment to lessen the need for hardware dependent images.
Hot ImagingAllows live machines to be used as the source to keep images from becoming stale and out of date.
Image Formats
PreOS (boot disk) operating systems

Norton Ghost 15.0[edit]

According to the Norton community web site [1] on Symantec′s site, the following features are available in Ghost 15:

Improved support for virtual formats[clarification needed]
Improved platform supportIncludes support for Windows 7, Windows Vista with SP2 and BitLocker-encrypted volumes
Create recovery points from within Symantec Recovery DiskCreates independent recovery points (known as a cold backup or offline backup) without the need to install Norton Ghost or its agent
Convert recovery points to virtual disks using a scheduleScheduled-based automatic conversion of recovery points to VMDK or VHD files, or to a VMware ESX or Microsoft Hyper-V server
Support for Microsoft Hyper-V and Blu-ray DiscsRecovery points may now be created on restored from either

On April 1, 2010 an updated version of Norton Ghost 15 was released. The current version is

Transition away from DOS[edit]

The off-line version of Ghost, which runs from bootable media in place of the installed operating system, originally faced a number of driver support difficulties due to limitations of the increasingly obsolete 16-bit DOS environment.

Driver selection and configuration within DOS was non-trivial from the beginning, and the limited space available on floppy disks made disk cloning of several different disk controllers a difficult task, where different SCSI, USB, and CD-ROM drives were involved. Mouse support was possible but often left out due to the limited space for drivers on a floppy disk..

Some devices such as USB often did not work using newer features such as USB 2.0, instead only operating at 1.0 speeds and taking hours to do what should have taken only a few minutes. As widespread support for DOS went into decline, it became increasingly difficult to get hardware drivers for DOS for the newer hardware.

Disk imaging competitors to Ghost have dealt with the decline of DOS by moving to FreeBSD or Linux based preboot environments, where they can draw on current driver development to be able to image newer models of disk controllers. Nevertheless the DOS version of Ghost on compatible hardware configurations works much faster than most of the *nix based image and backup tools.

Eventually Ghost was rewritten as Ghost32.exe, a 32-bit version capable of running with the Windows Preinstallation Environment (WinPE), which is a stripped down version of Windows originally used by product manufacturers to set up new computers. Because WinPE was based on the modern 32-bit Windows, it could use the same plug and play hardware drivers as a standard desktop computer, making hardware support for Ghost much simpler.

Ghost32.exe is also compatible with BartPE (Bart's Preinstalled Environment) a Windows XP based Live CD created using the PE Builder. To integrate Ghost32.exe into BartPE a PE Builder plug-in for Ghost is available.

Hiren's BootCD supports Ghost32.exe from within the GUI of its Mini Windows XP component. The HBCDCustomizer allows to incorporate it into the programs menu structure. It can also be run directly from the XP Windows Explorer.


Ghost is marketed as a backup program. Its recovery environment comes in an ISO image file that needs to be written to a CD. This provides an environment to perform offline system recovery or backup. Ghost can mount a backup volume to recover individual files.

Ghost can copy the contents of one volume to another or convert a volume contents to a virtual disk in VMDK or VHD format.

Initially, Ghost supported only FAT filesystems directly, but it could also copy (although not resize) other filesystems by performing a sector-by-sector copy. Ghost added support for NTFS later in 1996, and also provided a program, Ghostwalker (DOS name: ghstwalk.exe), to change the Security ID (SID) that made Windows NT systems distinguishable from each other. Ghostwalker is also capable of modifying the name of the Windows NT-based computer from its own interface. Ghost added support for the ext2 filesystem in 1999 and for ext3 subsequently.


Norton Ghost was discontinued on April 30, 2013.[2] Support via chat and knowledge base was available until June 30, 2014. Until it was removed,[2] the Symantec Ghost Web page invited Ghost customers to try Symantec System Recovery,[8] described as software for backup and disaster recovery.

The current version of the enterprise software, the Symantec Ghost Solution Suite 2.5, which includes Ghost 11.5, is still available[9] as is the Symantec Protection Suite for Small Businesses.[10]

See also[edit]


  1. ^ "Norton Ghost". Softpedia. SoftNews. 18 November 2013. Retrieved 1 December 2013. 
  2. ^ a b c "An important update regarding Norton Ghost". Retrieved 8 March 2014. 
  3. ^ "Radified Guide to Norton Ghost". Retrieved 2008-06-11. 
  4. ^ "Acquisitions". Symantec. Retrieved 2008-04-14. 
  5. ^ "Brief overview of Symantec Ghost and Norton Ghost versions". 5 May 2008. 
  6. ^ "Ghost Solution Suite". Symantec. Retrieved 2008-10-16. 
  7. ^ "LiveUpdate for GSS 2.5.1". 
  8. ^ "Symantec System Recovery Server Edition". Retrieved 23 June 2014. 
  9. ^ "Ghost Solution Suite 2.5.1 support matrix for Windows 8". Retrieved 23 June 2014. 
  10. ^ "Symantec Protection Suite Small Business Edition". Retrieved 23 June 2014. 

External links[edit]