1 '\" te 2 .\" Portions Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved 3 .\" Copyright (c) 2002-2006 Szabolcs Szakacsits 4 .\" Copyright (c) 2002-2005 Anton Altaparmakov 5 .\" Copyright (c) 2002-2003 Richard Russon 6 .\" Copyright (c) 2007 Yura Pakhuchiy 7 .\" This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation ; either version 2 of the License, or (at your option) any later version. This program is distributed 8 .\" in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program 9 .\" (in the main directory of the Linux-NTFS distribution in the file COPYING); if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 11-1307 USA 10 .TH NTFSCLONE 1M "May 14, 2009" 11 .SH NAME 12 ntfsclone \- clone, image, restore, or rescue an NTFS 13 .SH SYNOPSIS 14 .LP 15 .nf 16 \fBntfsclone\fR [\fIoptions\fR] \fIsource\fR 17 .fi 18 19 .LP 20 .nf 21 \fBntfsclone\fR \fB--save-image\fR [\fIoptions\fR] \fIsource\fR 22 .fi 23 24 .LP 25 .nf 26 \fBntfsclone\fR \fB--resotore-image\fR [\fIoptions\fR] \fIsource\fR 27 .fi 28 29 .LP 30 .nf 31 \fBntfsclone\fR \fB--metadata\fR [\fIoptions\fR] \fIsource\fR 32 .fi 33 34 .SH DESCRIPTION 35 .sp 36 .LP 37 The \fBntfsclone\fR utility efficiently clones (which includes copy, save, 38 backup, and restore operations) or rescues an NTFS filesystem to a sparse file, 39 an image, a device (partition), or to standard output. It works at disk sector 40 level and copies only the written data (that is, not empty space). Unused disk 41 space becomes zero (cloning to sparse file), encoded with control codes (saving 42 in special image format), left unchanged (cloning to a disk/partition) or 43 filled with zeros (cloning to standard output). 44 .sp 45 .LP 46 \fBntfsclone\fR can be useful in making backups\(emtaking an exact snapshot of 47 an NTFS filesystem\(emand restoring it later on. It also can be used to test 48 NTFS read/write functionality and allows you to troubleshoot users' issues 49 using the clone, without the risk of destroying the original file system. 50 .sp 51 .LP 52 If not using the special image format (see section of the same name below), the 53 clone is an exact copy of the original NTFS file system, from sector to sector. 54 Thus, it can also be mounted just like the original NTFS filesystem. For 55 example, if you clone to a file and the kernel has a loopback device and NTFS 56 support, then the file can be mounted using: 57 .sp 58 .in +2 59 .nf 60 # \fBmount -t ntfs -o loop ntfsclone.img\fR 61 .fi 62 .in -2 63 .sp 64 65 .SS "Windows Cloning" 66 .sp 67 .LP 68 You must exercise great care to copy, move or restore a system or boot 69 partition to another computer, or to a different disk or partition (for 70 example, \fB/dev/dsk/c0d0p1\fR to \fB/dev/dsk/c0d0p2\fR, \fB/dev/dsk/c0d0p1\fR 71 to \fB/dev/dsk/c0d1p1\fR or to a different disk sector offset). 72 .sp 73 .LP 74 Under most circumstances, to enable Windows to boot you must copy, move, or 75 restore NTFS to the same partition that has the following characteristics as 76 the original partition and disk: 77 .RS +4 78 .TP 79 .ie t \(bu 80 .el o 81 starts at the same sector 82 .RE 83 .RS +4 84 .TP 85 .ie t \(bu 86 .el o 87 on the same type of disk 88 .RE 89 .RS +4 90 .TP 91 .ie t \(bu 92 .el o 93 having the same BIOS legacy cylinder setting 94 .RE 95 .sp 96 .LP 97 The \fBntfsclone\fR utility guarantees an exact copy of NTFS but does not deal 98 with booting issues. This is by design: \fBntfsclone\fR is a file system, not a 99 system, utility. Its goal is only NTFS cloning, not Windows cloning. Because of 100 this, \fBntfsclone\fR can be used as a very fast and reliable building block 101 for Windows cloning, but is not a complete answer. You can find useful tips on 102 NTFS cloning at the NTFS web site, http://wiki.linux-ntfs.org\&. 103 .SS "Sparse Files" 104 .sp 105 .LP 106 A file containing unallocated blocks (holes) is referred to as a "sparse file". 107 The reported size of such files is always higher than the disk space consumed 108 by them. The \fBdu\fR(1) command reports the real disk space used by a sparse 109 file. The holes are always read as zeros. All major Linux file systems, such 110 as, \fBext2\fR, \fBext3\fR, \fBreiserfs\fR, \fBReiser4\fR, JFS, and XFS support 111 sparse files. However, the ISO 9600 CD-ROM file system, as one example, does 112 not. 113 .SS "Special Image Format" 114 .sp 115 .LP 116 It is recommended that you save an NTFS filesystem to a special image format. 117 Instead of representing unallocated blocks as holes, they are encoded using 118 control codes. Thus, the image saves space without requiring sparse file 119 support. The image format is ideal for streaming file system images over the 120 network. The disadvantage of the special image format is that you cannot mount 121 the image directly; you must first restore it. 122 .sp 123 .LP 124 To save an image using the special image format, use the \fB-s\fR or the 125 \fB--save-image\fR option. To restore an image, use the \fB-r\fR or the 126 \fB--restore-image\fR option. Note that you can restore images from standard 127 input by using a hyphen (\fB-\fR) as the source file. 128 .SS "Metadata-only Cloning" 129 .sp 130 .LP 131 Using the \fB-m\fR or \fB--metadata\fR option, \fBntfsclone\fR can save only 132 the NTFS metadata and the clone still will be mountable. In this usage, all 133 non-metadata file content is lost; reading back the data results in all zeros. 134 .sp 135 .LP 136 The metadata-only image can be compressed very well, usually to a size in the 137 range of 1 to 8 MB. It is convenient to transfer such an image for 138 investigation and troubleshooting. 139 .sp 140 .LP 141 In metadata-only mode, \fBntfsclone\fR saves none of the user's data, which 142 includes the resident user's data embedded into metadata. All is filled with 143 zeros. Moreover, all the file timestamps, and deleted and unused spaces inside 144 the metadata are filled with zeros. Thus, this mode is inappropriate, for 145 example, for forensic analyses. 146 .sp 147 .LP 148 Note that filenames are not removed. Because a filename might contain sensitive 149 information, consider the possibities for breaches of security or privacy 150 before sending out a metadata-only image. 151 .SH OPTIONS 152 .sp 153 .LP 154 Supported options are listed below. Most options have both single-letter and 155 full-name forms. Multiple single-letter options that do not take an argument 156 can be combined. For example, \fB-fv\fR is the equivalent of \fB-f\fR \fB-v\fR. 157 A full-name option can be abbreviated to a unique prefix of its name. 158 .sp 159 .ne 2 160 .na 161 \fB\fB-f\fR, \fB--force\fR\fR 162 .ad 163 .sp .6 164 .RS 4n 165 Forces \fBntfsclone\fR to proceed, even if the filesystem is marked "dirty" 166 following a consistency check. 167 .RE 168 169 .sp 170 .ne 2 171 .na 172 \fB\fB-h\fR, \fB--help\fR\fR 173 .ad 174 .sp .6 175 .RS 4n 176 Show a list of options with a brief description of each one. 177 .RE 178 179 .sp 180 .ne 2 181 .na 182 \fB\fB-i\fR, \fB--ignore-fs-check\fR\fR 183 .ad 184 .sp .6 185 .RS 4n 186 Ignore the result of the file system consistency check. This option can be used 187 only with the \fB--meta-data\fR option. Any clusters that cause an 188 inconsistency are saved. 189 .RE 190 191 .sp 192 .ne 2 193 .na 194 \fB\fB-m\fR, \fB--metadata\fR\fR 195 .ad 196 .sp .6 197 .RS 4n 198 Clone only metadata. With this option, you must clone only to a file. 199 .RE 200 201 .sp 202 .ne 2 203 .na 204 \fB\fB-o\fR, \fB--output\fR \fIfile\fR\fR 205 .ad 206 .sp .6 207 .RS 4n 208 Clone NTFS to the non-existent \fIfile\fR. If \fIfile\fR is a hyphen (\fB-\fR), 209 clone to the standard output. 210 .RE 211 212 .sp 213 .ne 2 214 .na 215 \fB\fB-O\fR, \fB--overwrite\fR \fIfile\fR\fR 216 .ad 217 .sp .6 218 .RS 4n 219 Clone NTFS to \fIfile\fR, overwriting \fIfile\fR if it already exists. 220 .RE 221 222 .sp 223 .ne 2 224 .na 225 \fB\fB--rescue\fR\fR 226 .ad 227 .sp .6 228 .RS 4n 229 Ignore disk read errors so that a disk having bad sectors, for example, a 230 failing disk, can be rescued with minimal impact on the disk. \fBntfsclone\fR 231 works at the lowest, sector level in this mode, enabling more data to be 232 rescued. The contents of the unreadable sectors are filled with the question 233 mark (\fB?\fR) character; the beginning of such sectors are marked by the 234 string: \fBBadSector\fR. 235 .RE 236 237 .sp 238 .ne 2 239 .na 240 \fB\fB-r\fR, \fB--restore-image\fR \fIsource\fR\fR 241 .ad 242 .sp .6 243 .RS 4n 244 Restore from the special image format specified by \fIsource\fR. If 245 \fIsource\fR is a hyphen (\fB-\fR), the image is read from the standard input. 246 .RE 247 248 .sp 249 .ne 2 250 .na 251 \fB\fB-s\fR, \fB--save-image\fR\fR 252 .ad 253 .sp .6 254 .RS 4n 255 Save to the special image format. In terms of space usage and speed, this is 256 the most efficient option if imaging is done to the standard output. This 257 option is useful for image compression, encryption, or streaming through a 258 network. 259 .RE 260 261 .SH EXAMPLES 262 .LP 263 \fBExample 1 \fRCloning with Overwrite Option 264 .sp 265 .LP 266 The following command clones with the \fB--overwrite\fR option. 267 268 .sp 269 .in +2 270 .nf 271 # \fBntfsclone --overwrite /dev/dsk/c0d2p1 /dev/dsk/c0d0p1\fR 272 .fi 273 .in -2 274 .sp 275 276 .LP 277 \fBExample 2 \fRSaving to Special Image Format 278 .sp 279 .LP 280 The following command clones to the special image format to its original 281 partition. 282 283 .sp 284 .in +2 285 .nf 286 # \fBntfsclone --save-image --output backup.img /dev/dsk/c0d0p1\fR 287 .fi 288 .in -2 289 .sp 290 291 .LP 292 \fBExample 3 \fRRestoring from a Special Image File 293 .sp 294 .LP 295 The following command restores an NTFS from a special image file. 296 297 .sp 298 .in +2 299 .nf 300 # \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 backup.img\fR 301 .fi 302 .in -2 303 .sp 304 305 .LP 306 \fBExample 4 \fRSaving to a Compressed Image 307 .sp 308 .LP 309 The following command saves an NTFS to a compressed image file. 310 311 .sp 312 .in +2 313 .nf 314 # \fBntfsclone --save-image -o - /dev/dsk/c0d0p1\fR 315 .fi 316 .in -2 317 .sp 318 319 .LP 320 \fBExample 5 \fRRestoring from a Compressed Image 321 .sp 322 .LP 323 The following command restores an NTFS volume from a compressed image file. 324 325 .sp 326 .in +2 327 .nf 328 # \fBgunzip -c backup.img.gz | \e\fR 329 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR 330 .fi 331 .in -2 332 .sp 333 334 .LP 335 \fBExample 6 \fRBacking up to a Remote Host Using \fBssh\fR 336 .sp 337 .LP 338 The following command backs up to a remote host, using \fBssh\fR(1). Note that 339 \fBssh\fR will probably require a password. 340 341 .sp 342 .in +2 343 .nf 344 # \fBntfsclone --save-image --output - /dev/dsk/c0d0p1 | \e\fR 345 \fBgzip -c | ssh host `cat > backup.img.gz`\fR 346 .fi 347 .in -2 348 .sp 349 350 .LP 351 \fBExample 7 \fRRestoring from a Remote Host Using \fBssh\fR 352 .sp 353 .LP 354 The following command backs up to a remote host, using \fBssh\fR(1). Note that 355 \fBssh\fR will probably require a password. 356 357 .sp 358 .in +2 359 .nf 360 # \fBssh host `cat backup.img.gz` | gunzip -c | \e\fR 361 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR 362 .fi 363 .in -2 364 .sp 365 366 .LP 367 \fBExample 8 \fRStreaming an Image File from a Web Server 368 .sp 369 .LP 370 The following command streams an image file from a web server and restore it to 371 a partition. 372 373 .sp 374 .in +2 375 .nf 376 # \fBwget -qO - http://server/backup.img | \e\fR 377 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR 378 .fi 379 .in -2 380 .sp 381 382 .LP 383 \fBExample 9 \fRCloning to a New File 384 .sp 385 .LP 386 The following command clones an NTFS volume to a non-existent file. 387 388 .sp 389 .in +2 390 .nf 391 # \fBntfsclone --output ntfs-clone.img /dev/dsk/c0d0p1\fR 392 .fi 393 .in -2 394 .sp 395 396 .LP 397 \fBExample 10 \fRPacking NTFS Metadata 398 .sp 399 .LP 400 The following command packs NTFS metadata into an image file. Note that 401 \fBbzip2\fR takes a much longer time than \fBgzip\fR, but produces an archive 402 that is up to ten times smaller than the latter produces. 403 404 .sp 405 .in +2 406 .nf 407 # \fBntfsclone --metadata --output ntfsmeta.img /dev/dsk/c0d0p1\fR 408 \fBbzip2 ntfsmeta.img\fR 409 .fi 410 .in -2 411 .sp 412 413 .LP 414 \fBExample 11 \fRUnpacking NTFS Metadata 415 .sp 416 .LP 417 The following command unpacks NTFS metadata into a sparse file. 418 419 .sp 420 .in +2 421 .nf 422 # \fBbunzip2 -c ntfsmeta.img.bz2 | \e\fR 423 \fBcp --sparse=always /proc/self/fd/0 ntfsmeta.img\fR 424 .fi 425 .in -2 426 .sp 427 428 .SH EXIT STATUS 429 .sp 430 .LP 431 The return code is zero on success, non-zero otherwise. 432 .SH ATTRIBUTES 433 .sp 434 .LP 435 See \fBattributes\fR(5) for descriptions of the following attributes: 436 .sp 437 438 .sp 439 .TS 440 box; 441 c | c 442 l | l . 443 ATTRIBUTE TYPE ATTRIBUTE VALUE 444 _ 445 Interface Stability Uncommitted 446 .TE 447 448 .SH SEE ALSO 449 .sp 450 .LP 451 \fBdu\fR(1), \fBssh\fR(1), \fBntfsresize\fR(1M), \fBntfsundelete\fR(1M), 452 \fBparted\fR(1M), \fBattributes\fR(5) 453 .sp 454 .LP 455 http://wiki.linux-ntfs.org 456 .SH AUTHORS 457 .sp 458 .LP 459 \fBntfsclone\fR was written by Szabolcs Szakacsits with contributions from Per 460 Olofsson (special image format support) and Anton Altaparmakov.