Norton Ghost discontinued

Laplink. Now there's some memories right there. :)

OP here, Thanks for mentioning :) corrected the article

Couldn't agree more... the one product that wasn't inherently horrible...

Supporting newer OSes (UEFI secure boot, Win8, etc.) requires more than a small amount of development, hence the move to Symantec's product.

It tells me that SYMANTEC is no longer making a decent enough profit margin to justify the operational and support systems expenses for the product.

Google's support by peer group plays towards online tools and web services. If you've every done ANY large client-side, windows based software development while trying to support aging versions of OS and application distributions it is no SMALL task.

Clonezilla - http://clonezilla.org/

DriveImage XML (for Windows cloning) - http://www.runtime.org/driveimage-xml.htm

Not entirely sure what Ghost does, but... dd?

True Image is a good commercial alternative (now it's a full fledged suite of products)

G4L - http://sourceforge.net/projects/g4l/

Macrium Reflect: http://macrium.com/ I haven't had occasion to use its recovery features yet, but works great as a disk backup solution.

I've used Drive Snapshot for years with great success. XP, Win 7, 2003, 2010, etc. It is my go-to tool when migrating disk images. It handles live snapshots and differential images very well when working with Exchange, etc...

http://www.drivesnapshot.de/en/

Open-source utilities running from livecd.

   dd if=/dev/sda bs=16777216 | gzip -c9 > /path/to/sda.img.gz

If you have the pv utility installed, you can get progress bars:

   dd if=/dev/sda bs=16777216 | pv -c -W | gzip -c9 | pv -c -W > /path/to/sda.img.gz

To restore (WARNING: THE FOLLOWING COMMAND IS EXTREMELY DANGEROUS, USE IT ONLY IF YOU KNOW EXACTLY WHAT YOU'RE DOING):

   pv -c -W /path/to/sda.img.gz | gzip -cd | pv -c -W | dd bs=16777216 of=/dev/sdx

Of course, you can use your favorite compression program instead of gzip; on Debian-like systems, bzip2 or xz should be drop-in replacements available by default.

If you want a compressed image which you can mount read-only without uncompressing (e.g. if you want to be able to reach into the backup and pull out a single file or directory), you can pipe the dump to a FIFO and then use the pseudo-file feature of mksquashfs [1]. E.g. something like this (commands not tested, there may be typos):

    mkfifo sda.fifo
    echo 'sda.img f 444 root root cat sda.fifo' > sda.pf
    dd if=/dev/sda bs=16777216 > sda.fifo &
    mkdir empty
    mksquashfs empty sda.squashfs -pf sda.pf
    mount -o ro,loop sda.squashfs /mnt

You then have an uncompressed image visible. If it's a whole-disk image (/dev/sda instead of /dev/sda1), you need to use a program called kpartx to make device nodes for each partition.

I recommend reading the man pages and playing around with these utilities in a Virtualbox VM with a small disk.

Of course, this approach doesn't pay any attention to filesystems. Which means it works with Windows partitions (unlike LVM or btrfs snapshots). But there are limitations; it reads and stores "empty" space not occupied by files (I recommend making a large file full of zeroes beforehand to make the empty space compress better), restoring to a smaller disk is difficult if not impossible, restoring to a larger disk requires you to resize manually afterwards if you want to use the extra space.

[1] It's a little easier conceptually to make a squashfs directly from an image file, but that approach requires you to store the image file, which requires temp space equal to the size of the disk you're backing up. The pseudo-file approach has a benefit of not needing temporary space equal to the size of the disk being backed up, you just need enough space for the compressed result.

I've had good results with Casper (the "Friendly Ghost"?) from Future Systems. Does what it says on the proverbial box.

If using NTFS, you can't beat imagex.exe.

dump(8)/restore(8)

Windows Image Backup and also disk2vhd ( http://technet.microsoft.com/en-us/sysinternals/ee656415 )

I love the VHD format!

Also wim is a nice choice (created by the imagex.exe in the Windows Preinstall Environment based AIK toolkit, also used by Vista and Win7 setup): Not block level based, but contains all ACLs etc. needed to deploy an image

For making frequent backups without shutting down Windows, nothing I've tried compares to ShadowProtect Desktop [1]. It makes a complete incremental backup of my C: drive every 15 minutes. Those backups often take only a few seconds, and they don't interrupt my work at all.

I used Acronis before that and it worked fine, but the incremental backups took many minutes with a lot of disk activity - even if I'd only touched a few files. Running a backup every 15 minutes wouldn't be in the cards. So I'd run an incremental manually when I felt worried enough to do so - if I remembered to do it!

It's a real stress-reducer to know that everything is backed up every 15 minutes and I can read files or restore the system from any of those 15-minute checkpoints.

ShadowProtect does this by making sector-by-sector backups with a limited amount of filesystem knowledge: it skips free space and pagefile.sys/hiberfil.sys, and that's about it. It has a driver that keeps track of disk writes while Windows is running, so it doesn't have to scan the disk or filesystem for changes.

If that tracking data becomes invalid (e.g. because of a bluescreen or forced power-off) it falls back to a full disk scan for the next incremental backup. It still makes the same small incremental that it would have made otherwise, it just takes longer - about as long as a full backup.

Because the backup is sector-by-sector, if you change just part of a large file, only the changed sectors need to be backed up. If you move or rename a large file, it takes hardly any time at all to back it up, because it only has to back up the filesystem metadata and not the file data itself.

You can mount a backup volume and open the files in any Windows app, or you can use their restore CD to do a bare metal restore, including a hardware independent restore. Of course other backup programs have those features too, they just don't have the crazy fast incrementals.

I've used the full restore many times and only had a problem once, when I migrated a Windows 8 installation from a ThinkPad X220 Tablet to a ThinkPad W520. It wouldn't boot at first, but I ran the automatic repair from the Windows 8 DVD and that fixed it right up.

One limitation with ShadowProtect is that you can't do a restore onto a hard drive smaller than the original one, only the same or larger. This is a consequence of the backup image being a full disk image and not a set of files. (You can of course mount a backup image on a running system and copy files from it regardless of disk or partition size.)

Also, it doesn't provide disk cloning, only image backup and restore. Here there are more good options; my favorite right now is Drive Copy 12 Professional from Paragon Software [2]. (After you make their CD and boot it, it launches a simplified wizard environment; check the bottom of the screen for the "advanced launcher" where all the good options are.)

[1] http://www.shadowprotect.com/

[2] http://www.paragon-software.com/home/dc-professional/

http://dar.linux.free.fr/ can help, with some scripting.

>Nitpick: I distinctly remember Ghost having mentioned specific files while it was backing up or recovering, hence it's not (entirely) a block-level backup. Also it could detect free space on the filesystem and not put that in the image.

Block level backups are optional in Ghost, they take a longer time to do, and are less efficient, the option isn't enabled by default.

Genuine Ghost - aka "Symantec Ghost Solution Suite" was indeed file-level, built on its own filesystem code, although the NTFS support was initially fairly rough and the image file format use for NTFS in .GHO containers wasn't a pure file archive as it was for FAT32. That original Ghost was developed in the mid-90's and purchased from Binary Research; development on that continued in Auckland until 2009 when everyone but myself and another engineer was laid off (he and I maintained the product and helped transition it to mothballed state, and then we were laid off mid-2010).

PowerQuest's Drive Image product was block-level, and that's the product sold as "Norton Ghost" and which has been cancelled (although like Symantec Ghost, everyone who worked on it has long been laid off; both ended up in maintenance-only mode looked after by separate teams in Symantec's facility in Pune).

Later on, "Norton 360" ended up with another separately acquired file-level backup product not related to either genuine Ghost or PowerQuest's product line (or any of the Veritas products either).

Neither the corporate Symantec Ghost - genuine Ghost, ex Binary Research - nor the consumer Norton Ghost - ex-PQ evolved out of Drive Image - shared any code at all, except for a small DLL used to allow the Symantec Ghost product to read from V2i images created by the consumer product and treat them the same as VHD or VMDK files when we added support for using those.

The branding confusion stems from when PowerQuest failed and was acquired by Symantec. One of the ex-PowerQuest managers was put in charge of not just the rump of PQ, but also PCAnywhere and genuine Ghost, and this resulted almost immediately in genuine Ghost (which made more net profit than PowerQuest had revenue) being cancelled in 2004, and most of the staff assigned to supporting PowerQuest's legacy Drive Image product or writing plug-ins for another acqusition done at the same time as PQ (On iCommand, later eventually withdrawn since it was unfit for sale). PowerQuest's V2i windows product, which included a volume snapshot driver for Windows 2000 source from StorageCraft (founded by ex-PowerQuest people), was rebranded and released as a consumer product called "Norton Ghost" version 9.

The genuine Ghost product was at the time sold to consumers as Norton Ghost 2003, and to businesses as Symantec Ghost Enterprise Edition 8. The choice of "Norton Ghost 9" as the branding for the ex-PowerQuest product was done to position it as not just consumer but also as the successor to the genuine business product (despite it having none of the capabilities of that) to leverage off our brand, although what it mostly accomplished was to poison our brand and confuse our customers.

[ Symantec Ghost 8 was rebranded with a minor update issued as "Symantec Ghost Solution Suite v1" when development was cancelled and it went to maintenance-only; we put out an update by borrowing ahead on our maintenance budget to get out a 1.1 update to that, and then after the Veritas merger genuine Ghost was uncancelled. When the new Veritas managers took over supervising both our team and the ex-PQ one and saw that we still made substantially more money than they did, they unwound some of the changes made to kill out line of business - but not all, and from then on our funding was kept too low for us to advance the product rapidly and we were unable to replace staff. As a result although Symantec Ghost Solution Suite v2 and 2.5 eventually followed, in April 2009 we were just about to enter beta for 3.0 when the team was disbanded and the site closed.]

Using the ex-PQ product as a consumer backup product was reasonable, as it was a dumb block-based product, but thanks to the storage driver they installed combined with VSS it had differentials, which genuine Ghost didn't. However, branding the consumer PQ product as Ghost was a disaster for the genuine Ghost product, both in terms of causing massive brand confusion, and thanks to the politics ensuring we never got properly funded from 2004 onwards.

An interesting experiment came from later, post-Veritas attempts to reduce the costly damage to the Ghost brand that "Norton Ghost" was causing; the exact same consumer product was released as "Norton Save and Restore 1.0", with a decent marketing push. Exact same product, it sold about 1/10 as much without the "Ghost" brand. Although the business Symantec Ghost did many times the revenue of the PQ consumer "Norton Ghost", this was enough to ensure that the (deliberately created) branding confusion was never properly fixed.

Elaborate on "better"?