{"success":true,"data":{"ext":"gho","name":"Symantex Ghost image file","description":"Symantec Ghost image file is a disk imaging format created and maintained by Symantec for Norton Ghost. It is used to capture, store, and deploy complete system or partition backups during operating system installation, migration, and recovery. The format is associated with legacy Ghost utilities and is generally safe to open, although image contents should be treated as untrusted data when restoring from unknown sources.","mime":[],"risk_level":"Safe","signatures":[{"hex":"FE EF","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":["ghs"],"usage":{"python":"def is_gho(file_path: str) -> bool:\n    \"\"\"Check if file is a valid GHO by magic bytes.\"\"\"\n    signature = bytes([0xFE, 0xEF])\n    with open(file_path, \"rb\") as f:\n        return f.read(2) == signature","node":"function isGHO(buffer: Buffer): boolean {\n  const signature = Buffer.from([0xFE, 0xEF]);\n  return buffer.subarray(0, 2).equals(signature);\n}","go":"func IsGHO(data []byte) bool {\n    signature := []byte{0xFE, 0xEF}\n    if len(data) < 2 {\n        return false\n    }\n    return bytes.Equal(data[:2], signature)\n}"}}}