1NTFSCLONE(8) System Manager's Manual NTFSCLONE(8)
2
6 ntfsclone - Efficiently clone, image, restore or rescue an NTFS
7
9 ntfsclone [OPTIONS] SOURCE
10 ntfsclone --save-image [OPTIONS] SOURCE
11 ntfsclone --restore-image [OPTIONS] SOURCE
12 ntfsclone --metadata [OPTIONS] SOURCE
13
15 ntfsclone will efficiently clone (copy, save, backup, restore) or res‐
16 cue an NTFS filesystem to a sparse file, image, device (partition) or
17 standard output. It works at disk sector level and copies only the
18 used data. Unused disk space becomes zero (cloning to sparse file), en‐
19 coded with control codes (saving in special image format), left un‐
20 changed (cloning to a disk/partition) or filled with zeros (cloning to
21 standard output).
22 ntfsclone can be useful to make backups, an exact snapshot of an NTFS
24 filesystem and restore it later on, or for developers to test NTFS
25 read/write functionality, troubleshoot/investigate users' issues using
26 the clone without the risk of destroying the original filesystem.
27 The clone, if not using the special image format, is an exact copy of
29 the original NTFS filesystem from sector to sector thus it can be also
30 mounted just like the original NTFS filesystem. For example if you
31 clone to a file and the kernel has loopback device and NTFS support
32 then the file can be mounted as
33 mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone
35 Windows Cloning
38 If you want to copy, move or restore a system or boot partition to an‐
39 other computer, or to a different disk or partition (e.g. hda1->hda2,
40 hda1->hdb1 or to a different disk sector offset) then you will need to
41 take extra care.
42 Usually, Windows will not be able to boot, unless you copy, move or re‐
44 store NTFS to the same partition which starts at the same sector on the
45 same type of disk having the same BIOS legacy cylinder setting as the
46 original partition and disk had.
47 The ntfsclone utility guarantees to make an exact copy of NTFS but it
49 won't deal with booting issues. This is by design: ntfsclone is a
50 filesystem, not system utility. Its aim is only NTFS cloning, not Win‐
51 dows cloning. Hereby ntfsclone can be used as a very fast and reliable
52 build block for Windows cloning but itself it's not enough.
53 Sparse Files
55 A file is sparse if it has unallocated blocks (holes). The reported
56 size of such files are always higher than the disk space consumed by
57 them. The du command can tell the real disk space used by a sparse
58 file. The holes are always read as zeros. All major Linux filesystem
59 like, ext2, ext3, reiserfs, Reiser4, JFS and XFS, supports sparse files
60 but for example the ISO 9600 CD-ROM filesystem doesn't.
61 Handling Large Sparse Files
63 As of today Linux provides inadequate support for managing (tar, cp,
64 gzip, gunzip, bzip2, bunzip2, cat, etc) large sparse files. The only
65 main Linux filesystem having support for efficient sparse file handling
66 is XFS by the XFS_IOC_GETBMAPX ioctl(2). However none of the common
67 utilities supports it. This means when you tar, cp, gzip, bzip2, etc a
68 large sparse file they will always read the entire file, even if you
69 use the "sparse support" options.
70 bzip2(1) compresses large sparse files much better than gzip(1) but it
72 does so also much slower. Moreover neither of them handles large sparse
73 files efficiently during uncompression from disk space usage point of
74 view.
75 At present the most efficient way, both speed and space-wise, to com‐
77 press and uncompress large sparse files by common tools would be using
78 tar(1) with the options -S (handle sparse files "efficiently") and -j
79 (filter the archive through bzip2). Although tar still reads and analy‐
80 ses the entire file, it doesn't pass on the large data blocks having
81 only zeros to filters and it also avoids writing large amount of zeros
82 to the disk needlessly. But since tar can't create an archive from the
83 standard input, you can't do this in-place by just reading ntfsclone
84 standard output. Even more sadly, using the -S option results serious
85 data loss since the end of 2004 and the GNU tar maintainers didn't re‐
86 lease fixed versions until the present day.
87 The Special Image Format
89 It's also possible, actually it's recommended, to save an NTFS filesys‐
90 tem to a special image format. Instead of representing unallocated
91 blocks as holes, they are encoded using control codes. Thus, the image
92 saves space without requiring sparse file support. The image format is
93 ideal for streaming filesystem images over the network and similar, and
94 can be used as a replacement for Ghost or Partition Image if it is com‐
95 bined with other tools. The downside is that you can't mount the image
96 directly, you need to restore it first.
97 To save an image using the special image format, use the -s or the
99 --save-image option. To restore an image, use the -r or the --re‐
100 store-image option. Note that you can restore images from standard in‐
101 put by using '-' as the SOURCE file.
102 Metadata-only Cloning
104 One of the features of ntfsclone is that, it can also save only the
105 NTFS metadata using the option -m or --metadata and the clone still
106 will be mountable. In this case all non-metadata file content will be
107 lost and reading them back will result always zeros.
108 The metadata-only image can be compressed very well, usually to not
110 more than 1-8 MB thus it's easy to transfer for investigation, trou‐
111 bleshooting.
112 In this mode of ntfsclone, NONE of the user's data is saved, including
114 the resident user's data embedded into metadata. All is filled with ze‐
115 ros. Moreover all the file timestamps, deleted and unused spaces in‐
116 side the metadata are filled with zeros. Thus this mode is inappropri‐
117 ate for example for forensic analyses. This mode may be combined with
118 --save-image to create a special image format file instead of a sparse
119 file.
120 Please note, filenames are not wiped out. They might contain sensitive
122 information, so think twice before sending such an image to anybody.
123
125 Below is a summary of all the options that ntfsclone accepts. Nearly
126 all options have two equivalent names. The short name is preceded by -
127 and the long name is preceded by -- . Any single letter options, that
128 don't take an argument, can be combined into a single command, e.g.
129 -fv is equivalent to -f -v . Long named options can be abbreviated to
130 any unique prefix of their name.
131 -o, --output FILE
133 Clone NTFS to the non-existent FILE. If FILE is '-' then clone
134 to the standard output. This option cannot be used for creating
135 a partition, use --overwrite for an existing partition.
136 -O, --overwrite FILE
138 Clone NTFS to FILE, which can be an existing partition or a reg‐
139 ular file which will be overwritten if it exists.
140 -s, --save-image
142 Save to the special image format. This is the most efficient way
143 space and speed-wise if imaging is done to the standard output,
144 e.g. for image compression, encryption or streaming through a
145 network.
146 -r, --restore-image
148 Restore from the special image format specified by SOURCE argu‐
149 ment. If the SOURCE is '-' then the image is read from the stan‐
150 dard input.
151 -n, --no-action
153 Test the consistency of a saved image by simulating its restor‐
154 ing without writing anything. The NTFS data contained in the im‐
155 age is not tested. The option --restore-image must also be
156 present, and the options --output and --overwrite must be omit‐
157 ted.
158 --rescue
160 Ignore disk read errors so disks having bad sectors, e.g. dying
161 disks, can be rescued the most efficiently way, with minimal
162 stress on them. Ntfsclone works at the lowest, sector level in
163 this mode too thus more data can be rescued. The contents of
164 the unreadable sectors are filled by character '?' and the be‐
165 ginning of such sectors are marked by "BadSectoR\0".
166 -m, --metadata
168 Clone ONLY METADATA (for NTFS experts). Only cloning to a
169 (sparse) file is allowed, unless used the option --save-image is
170 also used. You can't metadata-only clone to a device.
171 --ignore-fs-check
173 Ignore the result of the filesystem consistency check. This op‐
174 tion is allowed to be used only with the --metadata option, for
175 the safety of user's data. The clusters which cause the incon‐
176 sistency are saved too.
177 -t, --preserve-timestamps
179 Do not wipe the timestamps, to be used only with the --metadata
180 option.
181 --full-logfile
183 Include the Windows log file in the copy. This is only useful
184 for extracting metadata, saving or cloning a file system which
185 was not properly unmounted from Windows.
186 --new-serial, or
188 --new-half-serial
190 Set a new random serial number to the clone. The serial number
191 is a 64 bit number used to identify the device during the mount‐
192 ing process, so it has to be changed to enable the original file
193 system and the clone to be mounted at the same time on the same
194 computer.
195 The option --new-half-serial only changes the upper part of the
197 serial number, keeping the lower part which is used by Windows
198 unchanged.
199 The options --new-serial and --new-half-serial can only be used
201 when cloning a file system of restoring from an image.
202 The serial number is not the volume UUID used by Windows to lo‐
204 cate files which have been moved to another volume.
205 -f, --force
208 Forces ntfsclone to proceed if the filesystem is marked "dirty"
209 for consistency check.
210 -q, --quiet
212 Do not display any progress-bars during operation.
213 -h, --help
215 Show a list of options with a brief description of each one.
216
218 The exit code is 0 on success, non-zero otherwise.
219
221 Clone NTFS on /dev/hda1 to /dev/hdc1:
222 ntfsclone --overwrite /dev/hdc1 /dev/hda1
224 Save an NTFS to a file in the special image format:
226 ntfsclone --save-image --output backup.img /dev/hda1
228 Restore an NTFS from a special image file to its original partition:
230 ntfsclone --restore-image --overwrite /dev/hda1 backup.img
232 Save an NTFS into a compressed image file:
234 ntfsclone --save-image -o - /dev/hda1 | gzip -c > backup.img.gz
236 Restore an NTFS volume from a compressed image file:
238 gunzip -c backup.img.gz | \
240 ntfsclone --restore-image --overwrite /dev/hda1 -
241 Backup an NTFS volume to a remote host, using ssh. Please note, that
243 ssh may ask for a password!
244 ntfsclone --save-image --output - /dev/hda1 | \
246 gzip -c | ssh host 'cat > backup.img.gz'
247 Restore an NTFS volume from a remote host via ssh. Please note, that
249 ssh may ask for a password!
250 ssh host 'cat backup.img.gz' | gunzip -c | \
252 ntfsclone --restore-image --overwrite /dev/hda1 -
253 Stream an image file from a web server and restore it to a partition:
255 wget -qO - http://server/backup.img | \
257 ntfsclone --restore-image --overwrite /dev/hda1 -
258 Clone an NTFS volume to a non-existent file:
260 ntfsclone --output ntfs-clone.img /dev/hda1
262 Pack NTFS metadata for NTFS experts. Please note that bzip2 runs very
264 long but results usually at least 10 times smaller archives than gzip
265 on a sparse file.
266 ntfsclone --metadata --output ntfsmeta.img /dev/hda1
268 bzip2 ntfsmeta.img
269 Or, outputting to a compressed image :
271 ntfsclone -mst --output - /dev/hda1 | bzip2 > ntfsmeta.bz2
272 Unpacking NTFS metadata into a sparse file:
274 bunzip2 -c ntfsmeta.img.bz2 | \
276 cp --sparse=always /proc/self/fd/0 ntfsmeta.img
277
280 There are no known problems with ntfsclone. If you think you have
281 found a problem then please send an email describing it to the develop‐
282 ment team: ntfs-3g-devel@lists.sf.net
283 Sometimes it might appear ntfsclone froze if the clone is on ReiserFS
285 and even CTRL-C won't stop it. This is not a bug in ntfsclone, however
286 it's due to ReiserFS being extremely inefficient creating large sparse
287 files and not handling signals during this operation. This ReiserFS
288 problem was improved in kernel 2.4.22. XFS, JFS and ext3 don't have
289 this problem.
290
292 ntfsclone was written by Szabolcs Szakacsits with contributions from
293 Per Olofsson (special image format support) and Anton Altaparmakov. It
294 was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.
295
297 ntfsclone is part of the ntfs-3g package and is available at:
298 https://github.com/tuxera/ntfs-3g/wiki/
299
301 ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)
302ntfs-3g 2022.10.3 February 2013 NTFSCLONE(8)