Review: Acronis True Image vs Symantec Ghost


 A regular Ghost user tries out True Image V9 and concludes that Ghost V10 has met its match

Foreword from Gizmo

A drive imaging program is a utility that creates a backup snapshot or image of your disk drives, most commonly your system drive.

Imaging programs differ from data backup programs in that they can backup the Windows Operating system itself.

You can use that backup image to recover from system failures, spyware infections, installations gone wrong or any of the dozens of other things that can seriously mess up your PC.

Imaging programs can be used to backup data as well as your operating system but  are not ideal for that task. Recent versions of imaging programs have improved in this area but many folks, myself included, prefer to use imaging programs to back up Windows and data backup programs like Genie, to backup regularly changing data.

Every PC I own has a drive imaging utility installed and I use these regularly to make image backups of the C: drives. I simply can't tell you just how many times I've been able to use these backup images to restore a non-working PC to perfect health. Restoring from an image only takes me minutes while a full Windows re-install can take many hours or even days when you take into account re-installing application programs. That's why I recommend the system drive of every PC should be imaged regularly using a reliable imaging program.

Now let me tell you the harsh truth: when it comes to the best imaging program it's a two horse race between the commercial products Acronis True Image and Norton Ghost with the freeware contenders trailing by a couple of miles.  Not that there aren't some usable freeware products; it's just they aren't in the same league when it comes to function, features and reliability.

Choosing between True Image and Ghost is tough because they are both quality programs. That's why I asked regular Support Alert contributor J.W. to review the latest versions of these products.

Acronis True Image vs. Norton Ghost

When Gizmo asked me to review Acronis True Image V9, I was delighted. I had been using Norton Ghost V9 and wasn't happy with the product due to on-going problems with corrupted images.  Additionally I had never used True Image so the review provided me with an opportunity to look at the how Ghost compared to its main competitor in a live system, doing real work.

Installation Woes

Life was not meant to be easy.

Right from the start I had problems with both Norton Ghost and Acronis True Image on my PC. The problems as it turned out were partly caused by Process Guard, a security application that runs on my PC.  However this problem proved to be a blessing in disguise as it allowed me to test out the support provided by Symantec and Acronis.

Symantec support for Ghost was abysmal; an odyssey of condescending replies, canned responses and the apparent inability of the Indian support staff to understand the English language. Eventually, I  wrote a personal letter to the Chairman & CEO of Symantec, John W. Thompson, asking for his help and assistance.

My plea worked and I was put in contact with an “Executive Support” group. They seemed much more anxious to help and started off well by sending me the latest version of  Ghost 10.

I was optimistic that with the receipt this new version that the problems I had been experiencing with corrupted Ghost image backups  would disappear.  Sadly, that was not to be. Even with the latest V10 release  I had more invalid backup’s, completely baffling the “Executive Support” group.

After a number of emails back and forth, they adamantly pronounce that not one but BOTH of my U320 SCSI hard drives were broken and needed to be immediately replaced!  After expressing my incredulity with this diagnosis, they decided to try blaming the problem on my CPU processor. Anything it seemed other than their product. Their last email to me was pure bathos:

“Do not bother responding to this email as there is nothing else I can help you with and it will not be responded to.” 

So much for Symantec "executive" level support.  I was clearly on my own.

The experience with Acronis support was much better. Their support team was also baffled, but at least they maintained their composure, didn’t make any nonsensical recommendations such as replacing my hard drives and were civil. 

Eventually I solved the problem myself; another application, Process Guard, was interfering with the operation of the programs.   Once Process Guard was uninstalled, the immediate difficulties were resolved allowing me to move forward with my comparative review.

But a vital lesson about support was learned and not to be forgotten. Furthermore some serious problems with Ghost remained.

Corrupted Images

Even after removing Process Guard from my PC,  I continued to have on-going problems with Ghost V10 with corrupted image files.

Not all images had the problem, only some. I only discovered this when I attempted to recover from an image file only to find the image was unusable.  Subsequently I started studying the image creation log files only to find that corrupt images were not uncommon. Worse still you get no warning or notification of the problem other than entries in the log files. Here's a typical entry.

EVENT # : 5108
EVENT LOG : Application
SOURCE : Norton Ghost
CATEGORY : High Priority
EVENT ID : 100
TIME : 2/10/2006 7:40:33 AM
MESSAGE : Description: Error EC8F17B7: Cannot create recovery points for job: Recovery point of I:\. Error EA39070A: The internal structure of the image file is invalid or unsupported.
Details: 0xEA39070A
Source: Norton Ghost

This problem may be unique to my PC but I suspect not.  I suggest all Ghost users start monitoring their log files and test the integrity of existing, high value backups.

And of you are experiencing problems, don't expect too much help from Symantec.

Ghost and True Image Product Features

1)    True Image will run on any Windows version from Windows 98 forward.  Ghost 9/10 requires Win2000 SP4 minimum and Microsoft .Net Framework 1.1.  True Image does not require .Net Framework.

 2)    Both products offer the ability to do full or incremental backups.  Since I have plenty of free hard drive storage, I always do a full backup for all drives.  I feel more comfortable with full backups abstractly rather than having to deal with partial backups if I should need to do a restore.

 3)    Ghost has changed the nomenclature for their backups in Ghost 10 to “Recovery Points”.  Additionally, it appears that Ghost 9 backups are not compatible with Ghost 10.  At least, I was unable to find a way to access my old Ghost 9 backups using Ghost 10.  Furthermore, Ghost 9 & Ghost 10 cannot exist on the same machine.  If accurate, this would be a serious deficiency in Ghost.  Perhaps I could access the Ghost 9 backups using Ghost 2003 from DOS but I haven’t had time to try this.  Why is this important?  The Ghost backups I have kept are early stage Windows backups with the basic OS build and about 50% of my regular software installed.  If I have to or choose to rebuild my OS, then starting from one of these backups significantly shortens the time to get a fully configured system up and running.

 4)    True Image can backup individual files or folders.  Ghost does not offer this level of granularity and can only backup full drives or partitions.

5)    Both products offer the ability to list and restore individual files or folders from an image backup.  From the user viewpoint, Ghost is a bit more straightforward on this process.  You just find the image archive you want and click the Explore button.  Ghost mounts the image on a spare drive letter.  True Image does the same but uses separate Wizards labeled PLUG & UNPLUG (mount & unmount a virtual drive).

6)    Ghost has a useful feature that allows you to run a backup when one of these events occurs:

a)      Any application is installed

b)      Any user logs on to the computer

c)       Any user logs off from the computer

d)      The data added to a drive exceeds an amount (in megabytes) you specify

e)      The Maxtor OneTouch (an external hard drive) button has been pushed.

 7)    While True Image does not offer the ability to start a backup on the pre-configured events like Ghost does, it does offer a feature called Pre/Post Commands that allows you to do just about any task before and/or after a particular backup runs.  Ghost does not offer a similar feature.  I’d like to see the functionality in point #5 implemented in True Image.

 8)    Examining the UI’s for both applications, they are reasonably similar Windows driven interfaces both designed to show pretty “eye candy”.

 9)    There was a significant change in the UI from Ghost 9 to Ghost 10.  Ghost 10 seems to me to have “dumbed” down the interface, which I did not appreciate.  While all the functionality that was previously in Ghost 9 appears to be in Ghost 10, individual functions are spread out across multiple screens and are harder to get to.  To me, True Image’s UI is clearer, more robust and I like it better.

 10)   This is the main UI for Norton Ghost 10:

This is the main UI for Acronis True Image:

 11)   True Image has extra functions such as being able to turn off Windows System Restore and preparing and adding a new hard disk to your system, which Norton Ghost 10 does not offer.

 12)   True Image allows you to setup a secure and private partition called the Acronis Secure Zone to store backups in.  Norton Ghost does not offer similar functionality.  Used in conjunction with the Acronis Startup Recovery Manager, you can boot into a Linux version of True Image directly without using a boot CD.  This functionality is useful where you might have totally hosed your boot partition.  Note that when the Startup Recovery Manager is activated, the normal MBR record will be overwritten.

 13)   Norton Ghost 10’s help file is more robust and easier to locate information in than the True Image implementation:

a)      Clicking on the help button in True Image always takes you to the main help window, not to the section applicable to the area that you were in and are looking for help with.  So you then have to waste time wandering through help file looking for the right item.  The help file is non-standard and there aren’t any functions for searching or printing.

b)      Norton Ghost 10’s help file is standard Windows fare and includes index and search functionality.  It is easy to use.

 14)   Unlike Ghost, True Image doesn’t include a menu drop down link to check for new updates (Live Update).

a)      Both products require activation/registration of the product first.

b)      The True Image update check is a manual process.  You have to click Help-Web Support, which takes you to  Then you have to click the "Get a product update" link.  This takes you to a page with a list of the latest builds for ALL Acronis products.  Then go back to the Help menu and check the About entry for what build you have.  Return to the product update page and check your build against what is the latest build.  This is a waste of clicks and user time.

 15)   True Image does not have the ability to limit the number of backups for a specific drive/partition as Ghost does.

a)      With Ghost, you can set a limit of say two backups for whatever backup job you have defined.  Ghost appends a sequential number to each backup so that the file name is different from the previous backup.  When the number of backups (for a particular job) is exceeded, Ghost automatically deletes the oldest one.

b)      True Image cannot do this and you would have to create a script or manually rename the backups if you want to maintain more than one version.  Be aware that if you do not rename the previous backup that you want to save, True Image will overwrite it without issuing a confirmation message or warning.  I have been told that duplicating this Ghost functionality to let the user set a backup job limit and adding a sequential number to the file name is near the top of the to-do list for True Image and will be implemented soon.  I hope so!

 16)   I run a freeware program called Spy-The-Spy, which lets me monitor changes to files in certain folders on my C: drive in real time.  Unlike Ghost 9, at periodic points throughout the day, Ghost 10 regularly updates a file called SYMLCRST.DLL (below).  There are as many as 10 updates daily and they come at odd and varying intervals.  I was unable to determine what triggers an update.  Symantec Executive Support was also unable to provide an explanation as to WHY this file was bring regularly updated.  Mr. Levi Smith claimed this was “proprietary” information!

 17)   Doing a comparison of the backups of Ghost vs. True Image, I found that on equal backups, True Image had an 8-10% smaller backup footprint size.  Performance wise, both products took nearly the same amount of time to backup selected logical hard drives.

 18)   Looking at the image restore capabilities of both products

a)      The Ghost DOS interface is driven by the original install CD.  Just insert the product CD and reboot.  You do not have to create a separate boot CD, as you must do with True Image if you are not using their Startup Recovery Manager.  True Image’s primary restore environment is Linux but there is also a more limited DOS environment if the Linux version doesn’t work.

b)      The Ghost 9 & 10 DOS interfaces are much slower to boot up than the True Image version and all Ghost operations were slower than with True Image on my system.

 19)   Both programs can backup to a hard disk. 

a)      True Image also installs their own ASPI layer, allowing them to backup an image directly to a CD (or DVD if you have packet-writing software installed). 

b)      Ghost can backup to a hard drive and other device types. But note that backing up to removable media is a manual operation and cannot be scheduled, as additional media may have to be inserted to contain the full backup.

 20)   Ghost 9 & 10 provides the user the ability to select destinations for error messages from the system event log, the Ghost internal log or SMTP email.  I prefer the event log option since I run a program called Event Sentry that emails event errors to my POP3 email account.  This eliminates me having to remember to look at the event log or the programs internal log to see if everything ran successfully. 

21)   True Image only provides a Windows log with an option to export this log to a file.  Support for True Image has informed me that writing to the Windows Event Log is on their list of future enhancements for TI 9.x.

 22)   The Ghost log viewer for a completed backup provides only minimal information that the backup succeeded or failed.  No information is provided on the start time in the viewer.  You’d have to go look up the scheduled start time to determine that information, making computing the total time for a backup a manual and annoying two-step process.

  23)   The True Image log provides more information but gets a bit messy because of including distracting prep messages related to analyzing all drives before getting started on the backup job.  TI support was not able to explain why they need to analyze other drives during a backup for a specific drive.  Furthermore, in the message column of the viewer, even though the column is “stretchable”, they end those “Analyzing partition” messages with a “...” which usually means that there is too much information to fit in the space provided.  However, according to support - not in this case.  They could not explain WHY they use the “...” or what this was supposed to represent.

 24)   True Image can export status to a text log file, which Ghost can’t do.  However, even though the export is in text format with a default “.log” extension, for some reason, it is littered with HTML tags (like below) making it very difficult to read.  Acronis support did not know why this was occurring.  Additionally, it is impossible to easily interpret the time stamps. Editor's note: This report is actually in XML and can be easily read in an XML viewer or editor.

 a)      <?xml version="1.0" encoding="UTF-8" ?>

<log build="2337" product="Acronis True Image" uuid="C23BC3C1-D098-4828-8C6F-37DE1B2813CB" version="9.0">

i)         <event code="2" id="1" message="The &quot;I_Backup&quot; operation started" module="100" time="1140241688" type="2" />

ii)       <event code="503" id="2" message="Analyzing partition 0-0..." module="1" time="1140241688" type="2" />


xix) <event code="504" id="19" message="Pending operation 116 started: &quot;Creating partition image&quot;" module="1" time="1140241692" type="2" />

xx)   <event code="504" id="20" message="Pending operation 3 started: &quot;Verifying backup archive&quot;" module="1" time="1140241983" type="2" />

xxi) <event code="6" id="21" message="Operation has succeeded." module="100" time="1140242176" type="2" />


b)      However, True Image’s log detail is substantially better than Ghost.  You see all the detail from start to finish of the operation and at least in the standard display window, it is easy to see the total amount of time consumed for the backup operation.

 Finally, it has been my experience over the years that few people verify their image backups or experimentally try to boot up the image restore DOS program before they need it.  This is a serious mistake!

 I cannot stress strongly enough that it is CRITICAL that you VERIFY image backups.  Being caught with a backup that you think is good but really isn’t, is a recipe for disaster.

 Second, you MUST test that you can boot into the DOS recovery program BEFORE you actually need it.

Third, if you want to go the full mile, then you should also create a copy of your hard drive (or a logical disk) first using a process that you have confidence in and know works.  Then try to do a test restore from an image backup outside of Windows, checking that everything works and becoming familiar with the process before a real error occurs (and rest assured, one eventually will occur).  It’s far too easy to make serious mistakes while frustrated and under the stress of trying to restore a bad drive from DOS/Linux if you haven’t had any prior experience doing so or working with the driving program.


While each program has certain unique features, the core functionality of both programs is essentially equal.  However, True Image’s overall functionality, reliability and UI are more robust and more understandable than Symantec Norton Ghost versions 9 or 10.  Most importantly, in my experience, Symantec’s Ghost versions 9 & 10 have proven to be unreliable and my experience with Ghost (really, all of Symantec) technical support has consistently been dreadful.  I would still choose Acronis True Image over Ghost on functionality and presentation alone; however, on quality of support alone, I cannot and will not recommend any Symantec program. 

Furthermore, Symantec has a long & sordid history of acquiring products or complete companies and then discontinuing the products.  I would not be surprised if Ghost were treated similarly in the not-distant future.  Partition Magic, which they also acquired from PowerQuest a couple of years back in release 8 has yet to be updated by Symantec.  The fact that Symantec tech support/development has been unable to isolate the regular random corruption problems I have been experiencing across two releases of the product does not bode well for the future of the Ghost product, in my mind.

I have removed Symantec Ghost from my system.  My recommendation and personal choice going forward for a disk-imaging program is Acronis True Image.

Product Details

(1) Norton Ghost V10, $69.99

No trial available, Windows XP Home Edition/Professional, Windows 2000 Professional ONLY
Includes Norton Ghost 2003 for Windows Me & 98 users

(2) Acronis True Image V11, $49.99

14 day trial, Windows XP/Vista, 87MB

Download Trial Version True Image Home V11

Support this site:  If you buy from either of the sites listed above then this site will receive a small contribution from the vendor as a result of your purchase.  This doesn't add to your cost but it helps with the running expenses of our site. If you don't feel comfortable with this then go directly to the vendor's site.


Please rate this article: 

Your rating: None
Average: 4.7 (364 votes)