gho: Best Disk Image Tools for Go Developers in 2026

What Is gho?

gho is a pure Go library and CLI from Nyarime, the maintainer behind the Nyarc firmware analysis toolkit, and it is one of the best Disk Image Tools for Go developers, reverse engineers, and DFIR engineers. It parses, creates, and fixes Norton Ghost GHO images with no C dependencies, no CGo, and a single binary that can stream 32KB decompression blocks from Ghost 11.x–12.x images.

The practical value is simple: gho lets you inspect old Ghost archives, extract partitions, and rewrite header flags from code instead of relying on legacy Windows-only utilities. If you need deterministic disk-image handling in Go, gho gives you a small, auditable surface area and a CLI that fits scripting, forensics, and build pipelines.

Quick Overview

Who Should Use gho?

• Go engineers building forensic utilities who need to read or rewrite Norton Ghost images without shelling out to Python, C, or Windows-only executables.
• DFIR analysts and malware researchers who want to inspect partition tables, Track 0 data, and compressed blocks from old Ghost archives with source-level control.
• Firmware and recovery-tool authors who need a small CLI for extracting images, reconstructing partition data, or embedding GHO support into a larger workflow.
• Indie hackers automating archive conversion who prefer a single Go binary they can ship in containers, CI jobs, or offline rescue environments.

Not ideal for:

• Teams that need full-disk imaging across many vendor formats. gho is focused on Norton Ghost GHO files, not a broad multi-format imaging suite.
• Users who want a GUI-first recovery app. gho is built for terminal workflows and Go integration, not point-and-click analysis.
• People who need multi-file span writing today. The repo explicitly calls out span file writing as a missing area.

Key Features of gho

• Pure Go implementation — gho avoids CGo entirely, which keeps builds portable and makes go build and go install predictable on Linux, macOS, and Windows. That also reduces native dependency risk in CI and in recovery environments.
• Streaming decompression — gho decompresses partitions with constant memory behavior, so large images do not require loading the entire archive into RAM. This matters when you are processing multi-gigabyte images on constrained machines.
• Fast LZ support for Ghost Z1 — gho handles the custom Fast LZ format used by Ghost 11.5.1-era images. The decompressor is built around 16-bit control words and a 4096-entry hash table, which is the kind of detail you need when your source material is a reverse-engineered legacy format.
• Read and write GHO images — gho can open existing images, create new ones from raw partition data, and emit output that follows the record structure used by Norton Ghost. That makes it useful both for extraction and for image generation pipelines.
• Header fixup support — gho includes ModifyHeader behavior that mirrors ghofixup.exe for CD and span flag changes. If you have images that need header edits before another tool accepts them, this saves a manual hex-edit pass.
• MBR and Track 0 extraction — gho exposes partition tables and boot-sector data, which is useful when a Ghost image stores a boot chain alongside the partition payload. That is a common requirement in recovery and forensic review.
• Supports multiple Ghost compression modes — the repo reports support for uncompressed Z0, Fast LZ Z1, and zlib-based Z3–Z9 images, plus encrypted images using the CRC-16 cipher. That is a broad slice of the Ghost 11.x–12.x ecosystem.

gho vs Alternatives

Pick Ghost Explorer if you are on Windows and only need a familiar GUI to inspect an old image. It is still useful when you do not care about embedding the logic into Go code.

Pick 7-Zip when you need a fast sanity check on a file and you are not doing record-level analysis. It is a general-purpose extractor, while gho is format-aware and can expose Ghost-specific structure.

Pick OSFMount when the goal is mounting or browsing a recovered image as a drive letter. For automation, batch extraction, or header rewriting, gho is a better fit, and it pairs well with pipelines that also use OpenTrace for byte-level inspection or DataHaven for downstream archival of extracted partitions.

How gho Works

gho models a Norton Ghost archive as a sequence of typed records with fixed-format headers, then layers partition metadata and compressed block streams on top. The repo documents a 512-byte file header, 10-byte record headers, and a FEEF partition header that precedes compressed data, which is the right level of abstraction if you need to parse or generate images without guessing at offsets.

The important design choice is that gho treats decompression as a streaming operation over 32KB blocks. That means the library can read, write, and extract data with a small memory footprint, and it can handle arbitrary image sizes without turning the process into an all-or-nothing buffer copy. The Fast LZ path is especially interesting because it mirrors a reverse-engineered LZ77 variant rather than calling into a system codec.

# getting started example
go install github.com/nyarime/gho/cmd/gho@latest

# inspect an image
gho info disk.gho

# extract partitions
gho extract disk.gho output/

# create a new image from raw partition data
gho create output.gho partition.img mbr.bin

The CLI flow above shows the main operating model: inspect first, extract second, and create or fix headers only when you know the archive layout. In practice, gho is best treated as a format-aware Unix-style utility, not as a monolithic imaging suite.

At the library layer, the API exposes Open, Create, DecompressPartition, and ModifyHeader, which are the primitives you want in an automation script or recovery service. That makes gho a good fit for a pipeline where one stage validates the image, another stage extracts data, and a final stage archives the results or rebuilds a replacement image.

Pros and Cons of gho

Pros:

• No CGo and no native shim means easier cross-compilation and fewer deployment surprises.
• Single-binary CLI is practical for rescue media, CI jobs, and container images.
• Streamed block decompression keeps memory usage predictable during large extractions.
• Library plus CLI gives you both scriptability and embedability in one repo.
• Ghost-specific format awareness covers record headers, partition metadata, MBR data, and fixup behavior.
• MIT license is permissive enough for internal tools and commercial integrations.

Cons:

• Narrow scope means it is not a general disk imaging platform.
• Span file writing is missing, so multi-file .ghs authoring is still incomplete.
• Whole-disk images are not fully supported yet, according to the repo notes.
• Legacy format focus limits its value if you only work with modern imaging tools.
• No GUI means non-technical operators will need a wrapper or a separate front end.

Getting Started with gho

# install the CLI
go install github.com/nyarime/gho/cmd/gho@latest

# or add the library to an existing module
go get github.com/nyarime/gho

# inspect the image structure
gho info disk.gho

# extract partitions into a directory
gho extract disk.gho output/

After installation, gho runs without extra runtime dependencies because it is compiled into a single Go binary. The first thing you should do is inspect an existing image with gho info so you can confirm the compression mode, partition count, and record layout before extraction or creation.

If you are using the library, start by opening the image, printing a summary, and reading the MBR partition table before you call DecompressPartition. That sequence keeps your code honest when dealing with corrupted archives, odd span layouts, or legacy images that need header correction before they can be processed further.

Verdict

gho is the strongest option for Go-native parsing of Norton Ghost images when you need single-binary deployment and source-level control over extraction and header fixups. Its biggest strength is the pure Go design with stream-based decompression, while the main caveat is incomplete span-file writing and a narrow focus on Ghost formats. Use it when you need deterministic automation, not a general-purpose imaging GUI.