1E2IMAGE(8)                  System Manager's Manual                 E2IMAGE(8)
2
3
4

NAME

6       e2image - Save critical ext2/ext3/ext4 file system metadata to a file
7
8

SYNOPSIS

10       e2image [-r|-Q [-af]] [ -b superblock ] [ -B blocksize ] [ -cnps ] [ -o
11       src_offset ] [ -O dest_offset ] device image-file
12       e2image -I device image-file
13
14

DESCRIPTION

16       The e2image program will save critical ext2, ext3, or ext4 file  system
17       metadata  located on device to a file specified by image-file.  The im‐
18       age file may be examined by dumpe2fs and debugfs, by using the  -i  op‐
19       tion  to those programs.  This can assist an expert in recovering cata‐
20       strophically corrupted file systems.
21
22       It is a very good idea to create image files for all file systems on  a
23       system  and save the partition layout (which can be generated using the
24       fdisk -l command) at regular intervals --- at boot time,  and/or  every
25       week  or so.  The image file should be stored on some file system other
26       than the file system whose data it contains, to ensure that  this  data
27       is accessible in the case where the file system has been badly damaged.
28
29       To save disk space, e2image creates the image file as a sparse file, or
30       in QCOW2 format.  Hence, if the sparse image file needs to be copied to
31       another  location, it should either be compressed first or copied using
32       the --sparse=always option to the GNU version of cp(1).  This does  not
33       apply to the QCOW2 image, which is not sparse.
34
35       The  size  of  an  ext2 image file depends primarily on the size of the
36       file systems and how many inodes are in use.  For a typical 10 Gigabyte
37       file  system, with 200,000 inodes in use out of 1.2 million inodes, the
38       image file will be approximately 35 Megabytes; a 4 Gigabyte file system
39       with  15,000  inodes  in  use  out of 550,000 inodes will result in a 3
40       Megabyte image file.  Image files tend to be quite compressible; an im‐
41       age  file  taking  up 32 Megabytes of space on disk will generally com‐
42       press down to 3 or 4 Megabytes.
43
44       If image-file is -, then the output of e2image will be sent to standard
45       output,  so  that  the  output can be piped to another program, such as
46       gzip(1).  (Note that this is currently only supported when  creating  a
47       raw  image  file  using  the -r option, since the process of creating a
48       normal image file, or QCOW2 image currently requires random  access  to
49       the file, which cannot be done using a pipe.
50
51

OPTIONS

53       -a     Include  file data in the image file.  Normally e2image only in‐
54              cludes fs metadata, not regular file  data.   This  option  will
55              produce  an image that is suitable to use to clone the entire FS
56              or for backup purposes.  Note that this option only  works  with
57              the  raw (-r) or QCOW2 (-Q) formats.  In conjunction with the -r
58              option it is possible to clone all and only the used  blocks  of
59              one file system to another device/image file.
60
61       -b superblock
62              Get image from partition with broken primary superblock by using
63              the superblock located at file system block  number  superblock.
64              The  partition  is  copied  as-is  including  broken primary su‐
65              perblock.
66
67       -B blocksize
68              Set the file system blocksize in bytes.  Normally, e2image  will
69              search for the superblock at various different block sizes in an
70              attempt to find the appropriate blocksize. This  search  can  be
71              fooled in some cases.  This option forces e2fsck to only try lo‐
72              cating the superblock with a particular blocksize.  If  the  su‐
73              perblock  is  not found, e2image will terminate with a fatal er‐
74              ror.
75
76       -c     Compare each block to be copied from the source  device  to  the
77              corresponding  block  in the target image-file.  If both are al‐
78              ready the same, the write will be skipped.  This  is  useful  if
79              the  file system is being cloned to a flash-based storage device
80              (where reads are very fast and where it is  desirable  to  avoid
81              unnecessary writes to reduce write wear on the device).
82
83       -f     Override  the  read-only  requirement for the source file system
84              when saving the image file using the -r and  -Q  options.   Nor‐
85              mally,  if the source file system is in use, the resulting image
86              file is very likely not going to be useful. In some cases  where
87              the  source  file  system  is in constant use this may be better
88              than no image at all.
89
90       -I     install the metadata stored in the image file back  to  the  de‐
91              vice.   It  can be used to restore the file system metadata back
92              to the device in emergency situations.
93
94       WARNING!!!!  The -I option should only be used as a desperation measure
95       when  other  alternatives  have failed.  If the file system has changed
96       since the image file was created, data will be lost.  In  general,  you
97       should make another full image backup of the file system first, in case
98       you wish to try other recovery strategies afterward.
99
100       -n     Cause all image writes to be skipped, and instead only print the
101              block numbers that would have been written.
102
103       -o src_offset
104              Specify  offset  of  the  image to be read from the start of the
105              source device in bytes.  See OFFSETS for more details.
106
107       -O tgt_offset
108              Specify offset of the image to be written from the start of  the
109              target image-file in bytes.  See OFFSETS for more details.
110
111       -p     Show progress of image-file creation.
112
113       -Q     Create a QCOW2-format image file instead of a normal image file,
114              suitable for use by virtual machine images, and other tools that
115              can  use the .qcow image format. See QCOW2 IMAGE FILES below for
116              details.
117
118       -r     Create a raw image file instead of a normal image file.  See RAW
119              IMAGE FILES below for details.
120
121       -s     Scramble  directory  entries and zero out unused portions of the
122              directory blocks in the written image file  to  avoid  revealing
123              information  about  the  contents  of the file system.  However,
124              this will prevent analysis of problems related to hash-tree  in‐
125              dexed directories.
126
127

RAW IMAGE FILES

129       The -r option will create a raw image file, which differs from a normal
130       image file in two ways.  First, the file system metadata is  placed  in
131       the  same  relative  offset within image-file as it is in the device so
132       that debugfs(8), dumpe2fs(8), e2fsck(8), losetup(8), etc.  and  can  be
133       run directly on the raw image file.  In order to minimize the amount of
134       disk space consumed by the raw image file, it is created  as  a  sparse
135       file.   (Beware  of copying or compressing/decompressing this file with
136       utilities that don't understand how to create sparse  files;  the  file
137       will become as large as the file system itself!)  Secondly, the raw im‐
138       age file also includes indirect blocks and directory blocks, which  the
139       standard image file does not have.
140
141       Raw  image  files  are  sometimes used when sending file systems to the
142       maintainer as part of bug reports to e2fsprogs.  When used in this  ca‐
143       pacity,  the  recommended  command is as follows (replace hda1 with the
144       appropriate device for your system):
145
146            e2image -r /dev/hda1 - | bzip2 > hda1.e2i.bz2
147
148       This will only send the metadata information, without any data  blocks.
149       However,  the filenames in the directory blocks can still reveal infor‐
150       mation about the contents of the file system that the bug reporter  may
151       wish  to keep confidential.  To address this concern, the -s option can
152       be specified to scramble the filenames in the image.
153
154       Note that this will work even if you substitute /dev/hda1  for  another
155       raw disk image, or QCOW2 image previously created by e2image.
156
157

QCOW2 IMAGE FILES

159       The  -Q  option  will create a QCOW2 image file instead of a normal, or
160       raw image file.  A QCOW2 image contains all the information the raw im‐
161       age  does, however unlike the raw image it is not sparse. The QCOW2 im‐
162       age minimize the amount of space used by the image  by  storing  it  in
163       special  format which packs data closely together, hence avoiding holes
164       while still minimizing size.
165
166       In order to send file system to the maintainer as a part of bug  report
167       to e2fsprogs, use following commands (replace hda1 with the appropriate
168       device for your system):
169
170            e2image -Q /dev/hda1 hda1.qcow2
171            bzip2 -z hda1.qcow2
172
173       This will only send the metadata information, without any data  blocks.
174       As  described  for  RAW  IMAGE  FILES the -s option can be specified to
175       scramble the file system names in the image.
176
177       Note that the QCOW2 image created by e2image is a regular  QCOW2  image
178       and can be processed by tools aware of QCOW2 format such as for example
179       qemu-img.
180
181       You can convert a .qcow2 image into a raw image with:
182
183            e2image -r hda1.qcow2 hda1.raw
184
185       This can be useful to write a QCOW2 image  containing  all  data  to  a
186       sparse image file where it can be loop mounted, or to a disk partition.
187       Note that this may not work with QCOW2 images not generated by e2image.
188
189

OFFSETS

191       Normally a file system starts at the  beginning  of  a  partition,  and
192       e2image  is  run  on the partition.  When working with image files, you
193       don't have the option of using the partition device, so you can specify
194       the  offset  where  the file system starts directly with the -o option.
195       Similarly the -O option specifies the offset that should be  seeked  to
196       in the destination before writing the file system.
197
198       For example, if you have a dd image of a whole hard drive that contains
199       an ext2 fs in a partition starting at 1 MiB, you can clone  that  image
200       to a block device with:
201
202            e2image -aro 1048576 img /dev/sda1
203
204       Or  you can clone a file system from a block device into an image file,
205       leaving room in the first MiB for a partition table with:
206
207            e2image -arO 1048576 /dev/sda1 img
208
209       If you specify at least one offset, and only one file, an in-place move
210       will be performed, allowing you to safely move the file system from one
211       offset to another.
212
213

AUTHOR

215       e2image was written by Theodore Ts'o (tytso@mit.edu).
216
217

AVAILABILITY

219       e2image is  part  of  the  e2fsprogs  package  and  is  available  from
220       http://e2fsprogs.sourceforge.net.
221
222

SEE ALSO

224       dumpe2fs(8), debugfs(8) e2fsck(8)
225
226
227
228E2fsprogs version 1.47.0         February 2023                      E2IMAGE(8)
Impressum