1NTFSCLONE(8)                System Manager's Manual               NTFSCLONE(8)
2
3
4

NAME

6       ntfsclone - Efficiently clone, image, restore or rescue an NTFS
7

SYNOPSIS

9       ntfsclone [OPTIONS] SOURCE
10       ntfsclone --save-image [OPTIONS] SOURCE
11       ntfsclone --restore-image [OPTIONS] SOURCE
12       ntfsclone --metadata [OPTIONS] SOURCE
13

DESCRIPTION

15       ntfsclone  will efficiently clone (copy, save, backup, restore) or res‐
16       cue an NTFS filesystem to a sparse file, image, device  (partition)  or
17       standard  output.   It  works  at disk sector level and copies only the
18       used data. Unused disk space becomes zero (cloning to sparse file), en‐
19       coded  with  control  codes  (saving in special image format), left un‐
20       changed (cloning to a disk/partition) or filled with zeros (cloning  to
21       standard output).
22
23       ntfsclone  can  be useful to make backups, an exact snapshot of an NTFS
24       filesystem and restore it later on, or  for  developers  to  test  NTFS
25       read/write  functionality, troubleshoot/investigate users' issues using
26       the clone without the risk of destroying the original filesystem.
27
28       The clone, if not using the special image format, is an exact  copy  of
29       the  original NTFS filesystem from sector to sector thus it can be also
30       mounted just like the original NTFS filesystem.   For  example  if  you
31       clone  to  a  file  and the kernel has loopback device and NTFS support
32       then the file can be mounted as
33
34              mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone
35
36
37   Windows Cloning
38       If you want to copy, move or restore a system or boot partition to  an‐
39       other  computer,  or to a different disk or partition (e.g. hda1->hda2,
40       hda1->hdb1 or to a different disk sector offset) then you will need  to
41       take extra care.
42
43       Usually, Windows will not be able to boot, unless you copy, move or re‐
44       store NTFS to the same partition which starts at the same sector on the
45       same  type  of disk having the same BIOS legacy cylinder setting as the
46       original partition and disk had.
47
48       The ntfsclone utility guarantees to make an exact copy of NTFS  but  it
49       won't  deal  with  booting  issues.  This  is by design: ntfsclone is a
50       filesystem, not system utility. Its aim is only NTFS cloning, not  Win‐
51       dows  cloning. Hereby ntfsclone can be used as a very fast and reliable
52       build block for Windows cloning but itself it's not enough.
53
54   Sparse Files
55       A file is sparse if it has unallocated  blocks  (holes).  The  reported
56       size  of  such  files are always higher than the disk space consumed by
57       them.  The du command can tell the real disk space  used  by  a  sparse
58       file.   The  holes are always read as zeros. All major Linux filesystem
59       like, ext2, ext3, reiserfs, Reiser4, JFS and XFS, supports sparse files
60       but for example the ISO 9600 CD-ROM filesystem doesn't.
61
62   Handling Large Sparse Files
63       As  of  today  Linux provides inadequate support for managing (tar, cp,
64       gzip, gunzip, bzip2, bunzip2, cat, etc) large sparse files.   The  only
65       main Linux filesystem having support for efficient sparse file handling
66       is XFS by the XFS_IOC_GETBMAPX ioctl(2).  However none  of  the  common
67       utilities supports it.  This means when you tar, cp, gzip, bzip2, etc a
68       large sparse file they will always read the entire file,  even  if  you
69       use the "sparse support" options.
70
71       bzip2(1)  compresses large sparse files much better than gzip(1) but it
72       does so also much slower. Moreover neither of them handles large sparse
73       files  efficiently  during uncompression from disk space usage point of
74       view.
75
76       At present the most efficient way, both speed and space-wise,  to  com‐
77       press  and uncompress large sparse files by common tools would be using
78       tar(1) with the options -S (handle sparse files "efficiently")  and  -j
79       (filter the archive through bzip2). Although tar still reads and analy‐
80       ses the entire file, it doesn't pass on the large  data  blocks  having
81       only  zeros to filters and it also avoids writing large amount of zeros
82       to the disk needlessly. But since tar can't create an archive from  the
83       standard  input,  you  can't do this in-place by just reading ntfsclone
84       standard output. Even more sadly, using the -S option  results  serious
85       data  loss since the end of 2004 and the GNU tar maintainers didn't re‐
86       lease fixed versions until the present day.
87
88   The Special Image Format
89       It's also possible, actually it's recommended, to save an NTFS filesys‐
90       tem  to  a  special  image format.  Instead of representing unallocated
91       blocks as holes, they are encoded using control codes. Thus, the  image
92       saves  space without requiring sparse file support. The image format is
93       ideal for streaming filesystem images over the network and similar, and
94       can be used as a replacement for Ghost or Partition Image if it is com‐
95       bined with other tools. The downside is that you can't mount the  image
96       directly, you need to restore it first.
97
98       To  save  an  image  using  the special image format, use the -s or the
99       --save-image option. To restore an image,  use  the  -r  or  the  --re‐
100       store-image  option. Note that you can restore images from standard in‐
101       put by using '-' as the SOURCE file.
102
103   Metadata-only Cloning
104       One of the features of ntfsclone is that, it can  also  save  only  the
105       NTFS  metadata  using  the  option -m or --metadata and the clone still
106       will be mountable. In this case all non-metadata file content  will  be
107       lost and reading them back will result always zeros.
108
109       The  metadata-only  image  can  be compressed very well, usually to not
110       more than 1-8 MB thus it's easy to transfer  for  investigation,  trou‐
111       bleshooting.
112
113       In  this mode of ntfsclone, NONE of the user's data is saved, including
114       the resident user's data embedded into metadata. All is filled with ze‐
115       ros.   Moreover  all the file timestamps, deleted and unused spaces in‐
116       side the metadata are filled with zeros. Thus this mode is  inappropri‐
117       ate  for example for forensic analyses.  This mode may be combined with
118       --save-image to create a special image format file instead of a  sparse
119       file.
120
121       Please  note, filenames are not wiped out. They might contain sensitive
122       information, so think twice before sending such an image to anybody.
123

OPTIONS

125       Below is a summary of all the options that ntfsclone  accepts.   Nearly
126       all options have two equivalent names.  The short name is preceded by -
127       and the long name is preceded by -- .  Any single letter options,  that
128       don't  take  an  argument,  can be combined into a single command, e.g.
129       -fv is equivalent to -f -v .  Long named options can be abbreviated  to
130       any unique prefix of their name.
131
132       -o, --output FILE
133              Clone  NTFS to the non-existent FILE.  If FILE is '-' then clone
134              to the standard output. This option cannot be used for  creating
135              a partition, use --overwrite for an existing partition.
136
137       -O, --overwrite FILE
138              Clone NTFS to FILE, which can be an existing partition or a reg‐
139              ular file which will be overwritten if it exists.
140
141       -s, --save-image
142              Save to the special image format. This is the most efficient way
143              space  and speed-wise if imaging is done to the standard output,
144              e.g. for image compression, encryption or  streaming  through  a
145              network.
146
147       -r, --restore-image
148              Restore  from the special image format specified by SOURCE argu‐
149              ment. If the SOURCE is '-' then the image is read from the stan‐
150              dard input.
151
152       -n, --no-action
153              Test  the consistency of a saved image by simulating its restor‐
154              ing without writing anything. The NTFS data contained in the im‐
155              age  is  not  tested.   The  option --restore-image must also be
156              present, and the options --output and --overwrite must be  omit‐
157              ted.
158
159       --rescue
160              Ignore  disk read errors so disks having bad sectors, e.g. dying
161              disks, can be rescued the most  efficiently  way,  with  minimal
162              stress  on  them. Ntfsclone works at the lowest, sector level in
163              this mode too thus more data can be rescued.   The  contents  of
164              the  unreadable  sectors are filled by character '?' and the be‐
165              ginning of such sectors are marked by "BadSectoR\0".
166
167       -m, --metadata
168              Clone ONLY METADATA  (for  NTFS  experts).  Only  cloning  to  a
169              (sparse) file is allowed, unless used the option --save-image is
170              also used.  You can't metadata-only clone to a device.
171
172       --ignore-fs-check
173              Ignore the result of the filesystem consistency check. This  op‐
174              tion  is allowed to be used only with the --metadata option, for
175              the safety of user's data. The clusters which cause  the  incon‐
176              sistency are saved too.
177
178       -t, --preserve-timestamps
179              Do  not wipe the timestamps, to be used only with the --metadata
180              option.
181
182       --full-logfile
183              Include the Windows log file in the copy. This  is  only  useful
184              for  extracting  metadata, saving or cloning a file system which
185              was not properly unmounted from Windows.
186
187       --new-serial, or
188
189       --new-half-serial
190              Set a new random serial number to the clone. The  serial  number
191              is a 64 bit number used to identify the device during the mount‐
192              ing process, so it has to be changed to enable the original file
193              system  and the clone to be mounted at the same time on the same
194              computer.
195
196              The option --new-half-serial only changes the upper part of  the
197              serial  number,  keeping the lower part which is used by Windows
198              unchanged.
199
200              The options --new-serial and --new-half-serial can only be  used
201              when cloning a file system of restoring from an image.
202
203              The  serial number is not the volume UUID used by Windows to lo‐
204              cate files which have been moved to another volume.
205
206
207       -f, --force
208              Forces ntfsclone to proceed if the filesystem is marked  "dirty"
209              for consistency check.
210
211       -q, --quiet
212              Do not display any progress-bars during operation.
213
214       -h, --help
215              Show a list of options with a brief description of each one.
216

EXIT CODES

218       The exit code is 0 on success, non-zero otherwise.
219

EXAMPLES

221       Clone NTFS on /dev/hda1 to /dev/hdc1:
222
223              ntfsclone --overwrite /dev/hdc1 /dev/hda1
224
225       Save an NTFS to a file in the special image format:
226
227              ntfsclone --save-image --output backup.img /dev/hda1
228
229       Restore an NTFS from a special image file to its original partition:
230
231              ntfsclone --restore-image --overwrite /dev/hda1 backup.img
232
233       Save an NTFS into a compressed image file:
234
235              ntfsclone --save-image -o - /dev/hda1 | gzip -c > backup.img.gz
236
237       Restore an NTFS volume from a compressed image file:
238
239              gunzip -c backup.img.gz | \
240              ntfsclone --restore-image --overwrite /dev/hda1 -
241
242       Backup  an  NTFS  volume to a remote host, using ssh. Please note, that
243       ssh may ask for a password!
244
245              ntfsclone --save-image --output - /dev/hda1 | \
246              gzip -c | ssh host 'cat > backup.img.gz'
247
248       Restore an NTFS volume from a remote host via ssh.  Please  note,  that
249       ssh may ask for a password!
250
251              ssh host 'cat backup.img.gz' | gunzip -c | \
252              ntfsclone --restore-image --overwrite /dev/hda1 -
253
254       Stream an image file from a web server and restore it to a partition:
255
256              wget -qO - http://server/backup.img | \
257              ntfsclone --restore-image --overwrite /dev/hda1 -
258
259       Clone an NTFS volume to a non-existent file:
260
261              ntfsclone --output ntfs-clone.img /dev/hda1
262
263       Pack  NTFS  metadata for NTFS experts. Please note that bzip2 runs very
264       long but results usually at least 10 times smaller archives  than  gzip
265       on a sparse file.
266
267              ntfsclone --metadata --output ntfsmeta.img /dev/hda1
268              bzip2 ntfsmeta.img
269
270              Or, outputting to a compressed image :
271              ntfsclone -mst --output - /dev/hda1 | bzip2 > ntfsmeta.bz2
272
273       Unpacking NTFS metadata into a sparse file:
274
275              bunzip2 -c ntfsmeta.img.bz2 | \
276              cp --sparse=always /proc/self/fd/0 ntfsmeta.img
277
278

KNOWN ISSUES

280       There  are  no  known  problems  with ntfsclone.  If you think you have
281       found a problem then please send an email describing it to the develop‐
282       ment team: ntfs-3g-devel@lists.sf.net
283
284       Sometimes  it  might appear ntfsclone froze if the clone is on ReiserFS
285       and even CTRL-C won't stop it. This is not a bug in ntfsclone,  however
286       it's  due to ReiserFS being extremely inefficient creating large sparse
287       files and not handling signals during  this  operation.  This  ReiserFS
288       problem  was  improved  in kernel 2.4.22.  XFS, JFS and ext3 don't have
289       this problem.
290

AUTHORS

292       ntfsclone was written by Szabolcs Szakacsits  with  contributions  from
293       Per Olofsson (special image format support) and Anton Altaparmakov.  It
294       was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.
295

AVAILABILITY

297       ntfsclone is part of the ntfs-3g package and is available at:
298       https://github.com/tuxera/ntfs-3g/wiki/
299

SEE ALSO

301       ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)
302
303
304
305ntfs-3g 2022.10.3                February 2013                    NTFSCLONE(8)
Impressum