What is the GHO file format?
Files with the .gho extension store backup copies of full disks or disk partitions created by Norton Ghost. Each .gho file begins with a proprietary 512-byte header marked by the FE EF magic bytes, followed by a compressed stream of 32 KB data blocks that capture raw sectors of the imaged drive. Compression is selectable - None, Fast, or High - using a custom LZ77-variant algorithm. Optional password protection is available in later Ghost versions.
.gho images can cover a wide range of storage devices, including:
- Hard drives and solid-state drives,
- USB flash drives and pendrives,
- Memory cards,
- External disks,
- Smartphone internal storage.
Large disk clones are automatically split across a main .gho file and one or more .ghs span files to work around FAT32 file-size limits or to fit across removable media. The image is a sector-level clone, not a file archive - Ghost Explorer (GhostExp.exe) can browse its contents file by file and extract individual items without performing a full restore.
.gho is the native format of Norton Ghost, whose name is an acronym: General Hardware-Oriented System Transfer. The software was developed in 1995 by Binary Research (New Zealand) and acquired by Symantec in 1998. Norton Ghost was discontinued for consumers in April 2013 and replaced by Symantec System Recovery.
.gho files used different internal structures across Ghost builds - Norton Ghost 9.0, released in 2004, could not open images created by earlier versions of the software. Starting with Norton Ghost 9, the consumer product line began using the .v2i format instead, while .gho remained in use in the enterprise Ghost Solution Suite (now under Broadcom). Ghost Explorer (GhostExp.exe) remains the primary tool for browsing and verifying .gho image integrity.
Security & safety
RISK: MEDIUMA .gho is passive data, but restoring one overwrites the target disk entirely - restoring to the wrong drive destroys data, so verify the target carefully. Old images may contain an out-of-date, unpatched OS full of vulnerabilities; patch immediately after restore. Because the format is proprietary and the consumer product is dead, only download GhostExp/Ghost from Broadcom or your own licensed media - 'free Ghost image viewer' searches often lead to bundled adware/PUP. Browsing with GhostExp (read-only) is the safe way to inspect contents.
Format details
in a nutshell- Mathcad / Mathsoft 'Ghost' object file - An older, unrelated minor use of .gho; vastly less common than the disk image.
Programs that open GHO files
Windows3 apps
Norton Ghost
Paid Use Ghost.exe/Ghost32 to restore the image to a disk, or 'Ghost -clone' from boot media. Discontinued for consumers (2013) - only useful if you still have a licensed copy. 
Ghost Explorer (GhostExp.exe)
Free Open the .gho in GhostExp to browse the image like a file tree and extract individual files/folders without restoring the whole disk. Shipped with Ghost; the best way to read a .gho.
Symantec Ghost Solution Suite
Paid Current enterprise successor - creates and restores Ghost images for fleet deployment. Technical details
deep spec| Format type | Proprietary compressed disk and partition image; binary, not a file archive |
| Magic bytes | FE EF at offset 0; marks both the 512-byte file header and each per-partition header block |
| Byte order | Little-endian |
| Compression | Selectable: None, Fast, or High; uses a custom LZ77-variant algorithm with 32 KB decompressed block size |
| Encryption | Optional password protection in later Ghost versions; not strong encryption (no AES) |
| MIME type | application/octet-stream |
| Internal structure | 512-byte file header → Track 0 / MBR record → partition descriptors → per-partition FE EF header → compressed 32 KB data blocks |
| Large image spanning | Images exceeding a single file-size limit are split into a main .gho plus one or more .ghs segment files |
| Image scope | Whole-disk or whole-partition sector-level clone; file-level browsing and extraction available via Ghost Explorer without a full restore |
| Version compatibility | Format structure differs between Ghost builds; Ghost 9.0 (2004) cannot open images from earlier versions - cross-version restore is not guaranteed |
| Integrity verification | Internal integrity flags verified by Ghost on restore; testable with GhostExp.exe without restoring data |
| Developer | Binary Research (New Zealand, 1995); acquired by Symantec in 1998; product line now under Broadcom |
| Associated platforms | DOS (Ghost.exe bootable), Windows 32-bit (Ghost32.exe, GhostExp.exe), WinPE |
| Consumer end-of-life | April 2013; Norton Ghost consumer product discontinued; enterprise imaging engine continues in Broadcom Ghost Solution Suite |
| Successor formats | .v2i and .sv2i introduced in Norton Ghost 9.0 (2004) for consumer editions; .gho remains in use in enterprise Ghost Solution Suite |
| Released | 1995 (Ghost by Binary Research; acquired by Symantec 1998) |
| Latest version | Norton Ghost 15 (2009); engine continues in Symantec/Broadcom Ghost Solution Suite |
GHO conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about GHO files.
