Imaging process results in Error: 25002 - An internal inconsistency has been detected

Products

• Ghost Solution Suite
• Deployment Solution
• IT Management Suite
• Client Management Suite

Issue/Introduction

When deploying a Sysprep or backup image of Windows 11, Ghost64.exe may fail in the middle of the transfer.

The Ghost UI may display the following error:
25002 'An internal inconsistency has been detected. If this problem persists, contact Broadcom Technical Support'

Ghost error logs (GHOSTERR.TXT) may show the following:

Error Number: 25002
Message: Unhandled condition encountered: Attr translation will result in corruption of MFT table
Version: 12.0.0.11611(Jun 14 2024, Build=11611

NOTE: v11611 ships with GSS 3.3 RU12

Environment

Ghost Solution Suite 3.3 RU11 and 3.3.12

Deployment Solution 8.7.2

Imaging Windows 11 23H2, possibly 24H2

Cause

The issue has been determined to be caused when the NTFS Extended Attributes (EA) occupies too much space in the MFT record. A small change in cluster relocation may lead to MFT record overflow

Resolution

This issue has been addressed with our GSS 3.3.13 release.

Workaround:
For now, 2 Ghost executables (build 11623) have been released to prevent the issue from happening

Ghost64.exe and Ghost32.exe build 11623 are attached to this KB should be used in replacement of default executables until a permanent fix is available

For Ghost Solution Suite (GSS Console)

• Log in to the GSS server and open the following directory:
  <Install Directory>\Program Files (x86)\Altiris\eXpress\Deployment Server\Ghost
• Remove or rename the default Ghost64.exe and Ghost32.exe
• Paste in replacement Ghost exe's provided in the attachments of this KB

For Ghost Solution Suite (Standard Tools)

• Log in to the Server which installed GSS Standard Tools and open the following directory:
  <Install Directory>C:\Program Files (x86)\Symantec\Ghost\bootwiz\OEM\GSS\winpe\x64\Base\ghost
• Remove or rename the default Ghost64.exe and Ghost32.exe
• Paste in replacement Ghost exe's provided in the attachments of this KB

For Deployment Solution 8.7.2

• Log in to the Notification Server computer and open the following directory:
  <Install Directory>\Program Files\Altiris\Deployment\Imaging\ghost\x64
• Delete or rename Ghost64.exe and paste in the replacement Ghost64.exe attached to this KB
• Then navigate to the following folder:
  <Install Directory>\Program Files\Altiris\Deployment\Imaging\ghost\x86
• Delete or rename Ghost32.exe and paste in the replacement Ghost32.exe attached to this KB
• In the Symantec Management Console, navigate to Settings > All Settings > expand 'Deployment' > expand 'Packages' > select 'Imaging'
• On the right pane at the bottom of the page, click 'Update Distribution Points' to update the replacement Ghost exe's on all package servers.