1 '\" te
   2 .\" Portions Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
   3 .\" Copyright (c) 2002-2006 Szabolcs Szakacsits
   4 .\" Copyright (c) 2002-2005 Anton Altaparmakov
   5 .\" Copyright (c) 2002-2003 Richard Russon
   6 .\" Copyright (c) 2007 Yura Pakhuchiy
   7 .\" This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation ; either version 2 of the License, or (at your option) any later version.  This program is distributed
   8 .\" in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.  You should have received a copy of the GNU General Public License along with this program
   9 .\" (in the main directory of the Linux-NTFS distribution in the file COPYING);  if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 11-1307 USA
  10 .TH NTFSCLONE 1M "May 14, 2009"
  11 .SH NAME
  12 ntfsclone \- clone, image, restore, or rescue an NTFS
  13 .SH SYNOPSIS
  14 .LP
  15 .nf
  16 \fBntfsclone\fR [\fIoptions\fR] \fIsource\fR
  17 .fi
  18 
  19 .LP
  20 .nf
  21 \fBntfsclone\fR \fB--save-image\fR [\fIoptions\fR] \fIsource\fR
  22 .fi
  23 
  24 .LP
  25 .nf
  26 \fBntfsclone\fR \fB--resotore-image\fR [\fIoptions\fR] \fIsource\fR
  27 .fi
  28 
  29 .LP
  30 .nf
  31 \fBntfsclone\fR \fB--metadata\fR [\fIoptions\fR] \fIsource\fR
  32 .fi
  33 
  34 .SH DESCRIPTION
  35 .sp
  36 .LP
  37 The \fBntfsclone\fR utility efficiently clones (which includes copy, save,
  38 backup, and restore operations) or rescues an NTFS filesystem to a sparse file,
  39 an image, a device (partition), or to standard output. It works at disk sector
  40 level and copies only the written data (that is, not empty space). Unused disk
  41 space becomes zero (cloning to sparse file), encoded with control codes (saving
  42 in special image format), left unchanged (cloning to a disk/partition) or
  43 filled with zeros (cloning to standard output).
  44 .sp
  45 .LP
  46 \fBntfsclone\fR can be useful in making backups\(emtaking an exact snapshot of
  47 an NTFS filesystem\(emand restoring it later on. It also can be used to test
  48 NTFS read/write functionality and allows you to troubleshoot users' issues
  49 using the clone, without the risk of destroying the original file system.
  50 .sp
  51 .LP
  52 If not using the special image format (see section of the same name below), the
  53 clone is an exact copy of the original NTFS file system, from sector to sector.
  54 Thus, it can also be mounted just like the original NTFS filesystem. For
  55 example, if you clone to a file and the kernel has a loopback device and NTFS
  56 support, then the file can be mounted using:
  57 .sp
  58 .in +2
  59 .nf
  60 # \fBmount -t ntfs -o loop ntfsclone.img\fR
  61 .fi
  62 .in -2
  63 .sp
  64 
  65 .SS "Windows Cloning"
  66 .sp
  67 .LP
  68 You must exercise great care to copy, move or restore a system or boot
  69 partition  to  another computer, or to a different disk or partition (for
  70 example, \fB/dev/dsk/c0d0p1\fR to \fB/dev/dsk/c0d0p2\fR, \fB/dev/dsk/c0d0p1\fR
  71 to \fB/dev/dsk/c0d1p1\fR or to a different disk sector offset).
  72 .sp
  73 .LP
  74 Under most circumstances, to enable Windows to boot you must copy, move, or
  75 restore NTFS to the same partition that has the following characteristics as
  76 the original partition and disk:
  77 .RS +4
  78 .TP
  79 .ie t \(bu
  80 .el o
  81 starts at the same sector
  82 .RE
  83 .RS +4
  84 .TP
  85 .ie t \(bu
  86 .el o
  87 on the same type of disk
  88 .RE
  89 .RS +4
  90 .TP
  91 .ie t \(bu
  92 .el o
  93 having the same BIOS legacy cylinder setting
  94 .RE
  95 .sp
  96 .LP
  97 The \fBntfsclone\fR utility guarantees an exact copy of NTFS but does not deal
  98 with booting issues. This is by design: \fBntfsclone\fR is a file system, not a
  99 system, utility. Its goal is only NTFS cloning, not Windows cloning. Because of
 100 this, \fBntfsclone\fR can be used as a very fast and reliable building block
 101 for Windows cloning, but is not a complete answer. You can find useful tips on
 102 NTFS cloning at the NTFS web site, http://wiki.linux-ntfs.org\&.
 103 .SS "Sparse Files"
 104 .sp
 105 .LP
 106 A file containing unallocated blocks (holes) is referred to as a "sparse file".
 107 The reported size of such files is always higher than the disk space consumed
 108 by them. The \fBdu\fR(1) command reports the real disk space used by a sparse
 109 file. The holes are always read as zeros. All major Linux file systems, such
 110 as, \fBext2\fR, \fBext3\fR, \fBreiserfs\fR, \fBReiser4\fR, JFS, and XFS support
 111 sparse files. However, the ISO 9600 CD-ROM file system, as one example, does
 112 not.
 113 .SS "Special Image Format"
 114 .sp
 115 .LP
 116 It is recommended that you save an NTFS filesystem to a special image format.
 117 Instead of representing unallocated blocks as holes, they are encoded using
 118 control codes. Thus, the image saves space without requiring sparse file
 119 support. The image format is ideal for streaming file system images over the
 120 network. The disadvantage of the special image format is that you cannot mount
 121 the image directly; you must first restore it.
 122 .sp
 123 .LP
 124 To save an image using the special image format, use the  \fB-s\fR or  the
 125 \fB--save-image\fR option. To restore an image, use the \fB-r\fR or the
 126 \fB--restore-image\fR option. Note that you can restore images from  standard
 127 input by using a hyphen (\fB-\fR) as the source file.
 128 .SS "Metadata-only Cloning"
 129 .sp
 130 .LP
 131 Using the \fB-m\fR or \fB--metadata\fR option, \fBntfsclone\fR can save only
 132 the NTFS metadata and the clone still will be mountable. In this usage, all
 133 non-metadata file content is lost; reading back the data results in all zeros.
 134 .sp
 135 .LP
 136 The metadata-only image can be compressed very well, usually to a size in the
 137 range of 1 to 8 MB. It is convenient to transfer such an image for
 138 investigation and troubleshooting.
 139 .sp
 140 .LP
 141 In metadata-only mode, \fBntfsclone\fR saves none of the user's data, which
 142 includes the resident user's data embedded into metadata. All is filled with
 143 zeros. Moreover, all the file timestamps, and deleted and unused spaces inside
 144 the metadata are filled with zeros. Thus, this mode is inappropriate, for
 145 example, for forensic analyses.
 146 .sp
 147 .LP
 148 Note that filenames are not removed. Because a filename might contain sensitive
 149 information, consider the possibities for breaches of security or privacy
 150 before sending out a metadata-only image.
 151 .SH OPTIONS
 152 .sp
 153 .LP
 154 Supported options are listed below. Most options have both single-letter and
 155 full-name forms. Multiple single-letter options that do not take an argument
 156 can be combined. For example, \fB-fv\fR is the equivalent of \fB-f\fR \fB-v\fR.
 157 A full-name option can be abbreviated to a unique prefix of its name.
 158 .sp
 159 .ne 2
 160 .na
 161 \fB\fB-f\fR, \fB--force\fR\fR
 162 .ad
 163 .sp .6
 164 .RS 4n
 165 Forces \fBntfsclone\fR to proceed, even if the filesystem is marked "dirty"
 166 following a consistency check.
 167 .RE
 168 
 169 .sp
 170 .ne 2
 171 .na
 172 \fB\fB-h\fR, \fB--help\fR\fR
 173 .ad
 174 .sp .6
 175 .RS 4n
 176 Show a list of options with a brief description of each one.
 177 .RE
 178 
 179 .sp
 180 .ne 2
 181 .na
 182 \fB\fB-i\fR, \fB--ignore-fs-check\fR\fR
 183 .ad
 184 .sp .6
 185 .RS 4n
 186 Ignore the result of the file system consistency check. This option can be used
 187 only with the \fB--meta-data\fR option. Any clusters that cause an
 188 inconsistency are saved.
 189 .RE
 190 
 191 .sp
 192 .ne 2
 193 .na
 194 \fB\fB-m\fR, \fB--metadata\fR\fR
 195 .ad
 196 .sp .6
 197 .RS 4n
 198 Clone only metadata. With this option, you must clone only to a file.
 199 .RE
 200 
 201 .sp
 202 .ne 2
 203 .na
 204 \fB\fB-o\fR, \fB--output\fR \fIfile\fR\fR
 205 .ad
 206 .sp .6
 207 .RS 4n
 208 Clone NTFS to the non-existent \fIfile\fR. If \fIfile\fR is a hyphen (\fB-\fR),
 209 clone to the standard output.
 210 .RE
 211 
 212 .sp
 213 .ne 2
 214 .na
 215 \fB\fB-O\fR, \fB--overwrite\fR \fIfile\fR\fR
 216 .ad
 217 .sp .6
 218 .RS 4n
 219 Clone NTFS to \fIfile\fR, overwriting \fIfile\fR if it already exists.
 220 .RE
 221 
 222 .sp
 223 .ne 2
 224 .na
 225 \fB\fB--rescue\fR\fR
 226 .ad
 227 .sp .6
 228 .RS 4n
 229 Ignore disk read errors so that a disk having bad sectors, for example, a
 230 failing disk, can be rescued with minimal impact on the disk. \fBntfsclone\fR
 231 works at the lowest, sector level in this mode, enabling more data to be
 232 rescued. The contents of the unreadable sectors are filled with the question
 233 mark (\fB?\fR) character; the beginning of such sectors are marked by the
 234 string: \fBBadSector\fR.
 235 .RE
 236 
 237 .sp
 238 .ne 2
 239 .na
 240 \fB\fB-r\fR, \fB--restore-image\fR \fIsource\fR\fR
 241 .ad
 242 .sp .6
 243 .RS 4n
 244 Restore from the special image format specified by \fIsource\fR. If
 245 \fIsource\fR is a hyphen (\fB-\fR), the image is read from the standard input.
 246 .RE
 247 
 248 .sp
 249 .ne 2
 250 .na
 251 \fB\fB-s\fR, \fB--save-image\fR\fR
 252 .ad
 253 .sp .6
 254 .RS 4n
 255 Save to the special image format. In terms of space usage and speed, this is
 256 the most efficient option if imaging is done to the standard output. This
 257 option is useful for image compression, encryption, or streaming through a
 258 network.
 259 .RE
 260 
 261 .SH EXAMPLES
 262 .LP
 263 \fBExample 1 \fRCloning with Overwrite Option
 264 .sp
 265 .LP
 266 The following command clones with the \fB--overwrite\fR option.
 267 
 268 .sp
 269 .in +2
 270 .nf
 271 # \fBntfsclone --overwrite /dev/dsk/c0d2p1 /dev/dsk/c0d0p1\fR
 272 .fi
 273 .in -2
 274 .sp
 275 
 276 .LP
 277 \fBExample 2 \fRSaving to Special Image Format
 278 .sp
 279 .LP
 280 The following command clones to the special image format to its original
 281 partition.
 282 
 283 .sp
 284 .in +2
 285 .nf
 286 # \fBntfsclone --save-image --output backup.img /dev/dsk/c0d0p1\fR
 287 .fi
 288 .in -2
 289 .sp
 290 
 291 .LP
 292 \fBExample 3 \fRRestoring from a Special Image File
 293 .sp
 294 .LP
 295 The following command restores an NTFS from a special image file.
 296 
 297 .sp
 298 .in +2
 299 .nf
 300 # \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 backup.img\fR
 301 .fi
 302 .in -2
 303 .sp
 304 
 305 .LP
 306 \fBExample 4 \fRSaving to a Compressed Image
 307 .sp
 308 .LP
 309 The following command saves an NTFS to a compressed image file.
 310 
 311 .sp
 312 .in +2
 313 .nf
 314 # \fBntfsclone --save-image -o - /dev/dsk/c0d0p1\fR
 315 .fi
 316 .in -2
 317 .sp
 318 
 319 .LP
 320 \fBExample 5 \fRRestoring from a Compressed Image
 321 .sp
 322 .LP
 323 The following command restores an NTFS volume from a compressed image file.
 324 
 325 .sp
 326 .in +2
 327 .nf
 328 # \fBgunzip -c backup.img.gz | \e\fR
 329 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR
 330 .fi
 331 .in -2
 332 .sp
 333 
 334 .LP
 335 \fBExample 6 \fRBacking up to a Remote Host Using \fBssh\fR
 336 .sp
 337 .LP
 338 The following command backs up to a remote host, using \fBssh\fR(1). Note that
 339 \fBssh\fR will probably require a password.
 340 
 341 .sp
 342 .in +2
 343 .nf
 344 # \fBntfsclone --save-image --output - /dev/dsk/c0d0p1 | \e\fR
 345 \fBgzip -c | ssh host `cat > backup.img.gz`\fR
 346 .fi
 347 .in -2
 348 .sp
 349 
 350 .LP
 351 \fBExample 7 \fRRestoring from a Remote Host Using \fBssh\fR
 352 .sp
 353 .LP
 354 The following command backs up to a remote host, using \fBssh\fR(1). Note that
 355 \fBssh\fR will probably require a password.
 356 
 357 .sp
 358 .in +2
 359 .nf
 360 # \fBssh host `cat backup.img.gz` | gunzip -c  | \e\fR
 361 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR
 362 .fi
 363 .in -2
 364 .sp
 365 
 366 .LP
 367 \fBExample 8 \fRStreaming an Image File from a Web Server
 368 .sp
 369 .LP
 370 The following command streams an image file from a web server and restore it to
 371 a partition.
 372 
 373 .sp
 374 .in +2
 375 .nf
 376 # \fBwget -qO - http://server/backup.img | \e\fR
 377 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR
 378 .fi
 379 .in -2
 380 .sp
 381 
 382 .LP
 383 \fBExample 9 \fRCloning to a New File
 384 .sp
 385 .LP
 386 The following command clones an NTFS volume to a non-existent file.
 387 
 388 .sp
 389 .in +2
 390 .nf
 391 # \fBntfsclone --output ntfs-clone.img /dev/dsk/c0d0p1\fR
 392 .fi
 393 .in -2
 394 .sp
 395 
 396 .LP
 397 \fBExample 10 \fRPacking NTFS Metadata
 398 .sp
 399 .LP
 400 The following command packs NTFS metadata into an image file. Note that
 401 \fBbzip2\fR takes a much longer time than \fBgzip\fR, but produces an archive
 402 that is up to ten times smaller than the latter produces.
 403 
 404 .sp
 405 .in +2
 406 .nf
 407 # \fBntfsclone --metadata --output ntfsmeta.img /dev/dsk/c0d0p1\fR
 408 \fBbzip2 ntfsmeta.img\fR
 409 .fi
 410 .in -2
 411 .sp
 412 
 413 .LP
 414 \fBExample 11 \fRUnpacking NTFS Metadata
 415 .sp
 416 .LP
 417 The following command unpacks NTFS metadata into a sparse file.
 418 
 419 .sp
 420 .in +2
 421 .nf
 422 # \fBbunzip2 -c ntfsmeta.img.bz2 | \e\fR
 423 \fBcp --sparse=always /proc/self/fd/0 ntfsmeta.img\fR
 424 .fi
 425 .in -2
 426 .sp
 427 
 428 .SH EXIT STATUS
 429 .sp
 430 .LP
 431 The return code is zero on success, non-zero otherwise.
 432 .SH ATTRIBUTES
 433 .sp
 434 .LP
 435 See \fBattributes\fR(5) for descriptions of the following attributes:
 436 .sp
 437 
 438 .sp
 439 .TS
 440 box;
 441 c | c
 442 l | l .
 443 ATTRIBUTE TYPE  ATTRIBUTE VALUE
 444 _
 445 Interface Stability     Uncommitted
 446 .TE
 447 
 448 .SH SEE ALSO
 449 .sp
 450 .LP
 451 \fBdu\fR(1), \fBssh\fR(1), \fBntfsresize\fR(1M), \fBntfsundelete\fR(1M),
 452 \fBparted\fR(1M), \fBattributes\fR(5)
 453 .sp
 454 .LP
 455 http://wiki.linux-ntfs.org
 456 .SH AUTHORS
 457 .sp
 458 .LP
 459 \fBntfsclone\fR was written by Szabolcs Szakacsits with contributions from Per
 460 Olofsson (special image format support) and Anton Altaparmakov.