Hacker News Reader

Comment by smusamashah | Hacker News Reader

This reminds of the Ghost (was it Norton Ghost?) tool. I use to experiment with the file system and try out many many all kinds of softwares from Internet and software CDs. Those CDs use to come with 100s of softwares of all kind. I use to buy them and then try out every single one of them. I use to maintain an index, using IYF, to find a software in any of those CDs.

Anyway these softwares use to have there crack/patch tools with them (with music and effects and whatnot). These cracks often had virus or trojen in them. I have bored my windows many many times. Ghost helped with that immensely. I had 1 or 2 fresh install with basic setup ghost backup always available. After every bork, it only took a minute to restore my windows to fresh clean state. Kaspersky was the best anti virus back then, no other tool repaired my corrupted softwares like it. Norton anti virus use to scream only after getting infected itself.

We have it lot easy now.

View on HN

Ghost was descended from my absolute favorite late-90s / early 00s tool, https://en.wikipedia.org/wiki/GoBack which, as you say, let you undo absolutely anything you did to your machine.

I wish I had something like it on Mac.

Superduper is a useful Mac utility, as is CCC (Carbon Copy Cloner)

Those are backup tools, which have little to nothing to do with what I'm talking about.

GoBack was great. I gotta believe there's a way to manually instrument this using `tmutil` to create incremental APFS snapshots and some middleware code that knows when to wait for for the FS to be idle, but that's handwaving a ton of details.

> GoBack was designed by Wild File, Inc., a company located in Plymouth, Minnesota. The software was shown at COMDEX in November 1998 and released in December 1998.

> GHOST (an acronym for general hardware-oriented system transfer), now called Symantec™ GHOST Solution Suite (GSS) for enterprise, is a disk cloning and backup tool originally developed by Murray Haszard in 1995 for Binary Research.

^^ GHOST was not descended from GoBack

As for something like GoBack on Mac, if you're using a recent macOS and have an APFS filesystem you can take/restore whole-disk snapshots with Time Machine, tmutil from the CLI, or a third-party tool like Carbon Copy Cloner.

You're right, the article said "replaced by" and I assumed it had some lineage, but no.

Time Machine is file-based, whereas GoBack was block-based. GoBack could revert absolutely anything - even changes a program made to the OS or even to the boot sector! If you did something that made the machine not bootable, it was still a matter of seconds to boot into the GoBack supervisor and ask it to revert to a previous state.

APFS is quite powerful but its functionality hasn't been really exposed very well to the user.

Since Catalina the OS itself is in a read-only volume and everything else is separate - by default, respectively "Macintosh HD" and "Data" as exposed in Disk Utility. Strictly speaking, I think programs cannot change the OS or boot sector. The only thing I know of that can is a macOS upgrade itself, and it does automatically take a pre-upgrade snapshot for the ability to restore.

Sure, but suppose I run something that spews all over, say, my homebrew install. That's not "part of the OS", but it might as well be.

Can apfs snapshots roll that back? Probably? But that functionality isn't exposed to mere mortals (and certainly not on the startup volume).

If there's a way to do this:

1. make-some-kind-of-snapshot abc123

2. make some changes all over the place (I don't know where!) that i then want to revert

3. restore-to abc123

and at this point, the entire system is exactly, precisely, bit for bit how it was after step 1 -- and where step 3 takes just a few seconds -- well, I'd love to know about it.

Time Machine can do that. Whether they're automatic or manual backups, you can boot your system in recovery mode and restore from a backup to fully revert to a previous snapshot. It will require a reboot and the speed of execution will depend on the size of the changeset from the current state.

Reminded of DiskFreeze (or something ismilar, Freeze was for sure in the name), that i installed in my PC after seeing it as some cyber cafes. Basically, one partition with all the software was under this DiskFreeze, and another partition / disk where I stored documents and files. DiskFreeze restored the disk/partition with OS+software on every restart, meaning that I was infected or corrupted or anything, a simple restart would fix the machine.

The trick to install a software was to disable it, restart, install it, enable it again and restart again. I only did that after installing a software and test it for a few hours or days, which of course didn't mean anything, but at least I didn't see any visible problem.

Deep Freeze

This: https://www.faronics.com/products/deep-freeze

XP had a good snapshot/restore tool: https://en.wikipedia.org/wiki/Windows_SteadyState

You can install a write filter on later embedded versions of Windows but this was available for home or café use as well.

The early ~2008 Linux-supplied dirt cheap Acer Aspire One A110L netbooks came with small (8GB?) and horrifically slow SSDs.

Back in the days of such things, we'd upgrade the RAM and use Windows XP with the write filter to make them great little machines. There was an SD card slot in the side that would happily store files.

The SSDs were very limited in read-write cycles from what I remember. More noticeable they brutally slow at writing. By shoving all the writes into RAM instead of direct the SSD, everything ran more smoothly.

If you wanted to keep any changes (usually due to OS or software updates) then you ran a batch file that wrote out the changes to the SSD before shutdown. Otherwise you shut the machine down and all your changes were immediately forgotten.

RAM Upgrade: https://www.youtube.com/watch?v=n3WVb1dL--o Enhanced Write Filter: https://www.prime-expert.com/articles/a04/speeding-up-ssd-ba...

It was simply "Ghost" before Norton bought it and made it more terrible and bloated over time. We (at a computer shop I worked at) used Ghost to build a pre-OOBE image for several common Windows configurations and then just image them to new PCs in a few minutes, then apply the license key afterward.

Symantec left our team - which was basically identical before and after acquisition - pretty much alone beyond adding in some (badly needed) release process and i18n requirements.

Almost the entirety of the growth in the size of the imaging executable, which did get hugely bigger, came from a constant drive to add capability to the NTFS support to match the FAT support, most crucially to allow the images to be edited in Ghost Explorer. The initial NTFS support that Ghost had prior to the Symantec releases was really crude, basically the content in the .GHO file wasn't files, but a raw-ish dump of used disk extents that it tried to always put back in the same place to avoid having to fix up attribute runs, whereas the FAT16/FAT32 content was basically a file archive where all the filesystem allocation metadata got recreated on the fly.

Customers wanted and pushed hard to have NTFS images editable, and that made life really hard - the approach that was ultimately taken meant creating a full read/write NTFS implementation, and those aren't small. And the design of that code interacted really badly with the C++ exception implementation in DJGPP (which before that work had begun, I had warned them about), so that eventually exception frame information was taking up ~25% of the on-disk size of the UPX-compressed binary!

Kaspersky was the very best, it could handle any bad case better than any of the others.

I used to use the cataloging software WhereIsIt. It was really genious.

I also reinstalled windows one too many times and used norton backup.

I am not clever enough to understand that I could just do it with linux by disk dumping into an image, but hey, old times

Reply on news.ycombinator.com