中国DOS联盟

Generally, we usually install DOS/Windows 98 first and then Windows 2000/XP, which can "naturally" form a multi-system boot menu. But if we install Windows 2000/XP first and then DOS/Windows 98, how to form the multi-system menu? It's also easy. We can save the partition boot sector of Windows 2000/XP in advance, then use the sys command to generate the boot sector of DOS and transfer the DOS system, then save the boot sector of DOS, and then restore the content of the partition boot sector of Windows 2000/XP. (I'll ignore some details here.)

But if there is ghost involved in this process, a strange problem will be encountered. For example, I install Win98 (in C:) normally, use ghost to back up Win98, install Windows 2000/XP (in D:), form the boot startup menu, and back up the content of the boot sector of Windows 2000/XP in C: and several necessary startup files such as ntldr, ntdetect.com, boot.ini. Now, Win98 is broken, I use ghost to restore the backed-up Win98 to C:, naturally, the boot menu of NTLDR is gone, and the boot sector also becomes the content of Win98/DOS. (After restoration, Win98 can start normally.) I use the previously backed-up content of the boot sector of Windows 2000/XP to restore it to the boot sector of C:, copy the backed-up files such as ntldr, ntdetect.com, boot.ini to the root directory of C:, and restart. As a result, the screen is completely black, and there is only a cursor flashing in the upper left corner. I tried several times and it's the same. In fact, these files like ntldr don't need to be copied over, because the problem occurs at the partition boot sector step.

I know that ghost will change some values when dealing with the boot sector. I wonder if this is the cause? I compared the content of C: PBR when Win98 was just installed and after ghost restoration, and found that three values were changed. So I used the PBR after ghost (I think mainly the BPB in it) as the basis, and restored the PBR of Windows 2000/XP again under the recovery console of Windows 2000/XP, and then backed up this new PBR. Considering that the FAT32 PBR occupies 3 sectors, this new PBR was also backed up for 3 sectors, while originally only one sector was backed up. I thought, this should be okay now. So I used ghost to restore Win98 in C: again, and then restored the newly saved PBR. But after restarting, it still didn't work! Still black screen.

So I was really confused. Which place is going wrong?! Ghost will inexplicably change a few bytes when dealing with the boot sector. I don't know if it's tampered with during backup or restoration. I don't know which parts must be changed. But one thing I'm sure of is that after ghost restoration, the parameter of the number of sectors occupied by this partition in the BPB will be a few sectors less than the original, but this should not affect the startup of this partition.

Now, every time I use ghost to restore Win98, I have to use the own way of Windows 2000/XP to restore their PBR. In fact, I don't need to enter the recovery console. When installing to the point where you can choose whether to enter the recovery console, the PBR of C: has been rewritten.

I'm just curious, why can't the originally backed-up PBR be used?!

For the FAT32 system, the boot sector of Win98 occupies the 1st and 3rd sectors, and the boot sector of Windows 2000/XP occupies the 1st and 13th sectors. Therefore, it is not enough to only restore the first 3 sectors.

"After ghost restoration, the content of the C: PBR is found that three values have been changed", can you tell which three are they?

Ghost does not read and store data sector by sector and restore it to the original sector. Instead, it reads all disk data, reorganizes it, and stores it as a *.gho file according to its own set of defined schemes, which includes the file system and the boot system (if it exists). When restoring to a new disk partition, it will be in the most compact file storage mode considered by Ghost. You can verify this by running disk defragmentation on the just-restored partition.

I also want to figure out the working principle of Ghost, and I still need to learn from you all.

Originally posted by yaya at 2009-9-2 04:47:
For the FAT32 system, the boot sector of Win98 occupies sectors 1 and 3, and the boot sector of Windows 2000/XP occupies sectors 1 and 13. Therefore, it is not enough to only restore the first 3 sectors.

'After restoring with Ghost, the content of C: PBR was found, and it was noticed that three values have been changed', can you tell me which three places they are?

Hmm! What you said makes sense. It's very likely due to the reason you mentioned. I didn't notice the difference between the boot sectors of Win9x and WinNTs that both use FAT32 before. I thought all FAT32 ones were the same. I'll try it if I get a chance in the future.

As for which three places have been changed, I didn't write them down. And after I tried on different machines, I found that the places (offsets) that were changed each time were different, and the different places were also different. Some only had two places, and some seemed to have four or five places, just as I said in the main post "Certainly need to change which ones? Not clear." In short, the changes are not fixed.

GHOST does not indeed read and store in units of sectors. GHOST is neither a completely sector-by-sector image copy nor a simple copy one by one in units of files. It seems to be a combination of both, somewhat similar to the way HD-COPY handles disks with the /F- parameter. From the fact that GHOST can restore the backup to an unformatted partition and the change in the boot sector after I compared GHOST, it can be seen that GHOST can/does handle the boot sector. I haven't fully understood the operation mechanism of GHOST yet.

Even if it is not read and stored in sector units, this is only defined in the file data method, and the sectors are seen to be stored separately.

### Recommended Reading Symantec Ghost Imaging Foundation

The book points out: Ghost is a package of the valid data on the disk. Inside this package, there is its own data organization method, as well as compression levels, check codes, passwords, etc.

The book also says: Ghost does not copy sector by sector, but is file-based. But not all files will be packaged. Some files limited by timeliness will be skipped, such as hibernation files, memory swap files, etc.

Unfortunately, I haven't found any direct description related to the boot sector. But based on some paragraphs in the book and my own thinking, I conjecture:
Ghost does not directly save the data of any special sectors, but analyzes the logical structure of the data on the source disk, and stores these parameters (including MBR, VBR, GPT, dynamic disk database, etc.) in the image file in its own format. When writing to the target disk, Ghost reconstructs the logical structure of the disk, that is, MBR and VBR of each partition/volume, and other data (such as volume information of dynamic disks, etc.) with the help of the GDisk tool according to these parameters.

There are two other points to note: On the one hand, Ghost has two major working modes,
source disk -> (image ->) target disk,
source area -> (image ->) target area;
On the other hand, Ghost is very lenient in terms of capacity, only requiring that the target capacity be slightly larger than the actual data size.
These two points show that when Ghost reconstructs the disk structure, it will adjust the parameters according to the situation of the target disk. As the book says: By default, Ghost always tries to maintain the size ratio between partitions.
So, Ghost has to adjust the parameters, which necessarily means that there are changes in MBR, VBR or other important sectors. Otherwise, the partition table and partitions will not match, or the VBR will not find the OS bootloader, etc....

Conjectures not verified, welcome to correct
Ghost Explorer can directly view the image. I haven't used it.不妨 see if this tool can display partition/volume related information?

Last edited by azziporah on 2010-9-6 at 10:50 ]