1ntfsclone(1M) System Administration Commands ntfsclone(1M)
2
3
4
6 ntfsclone - clone, image, restore, or rescue an NTFS
7
9 ntfsclone [options] source
10
11
12 ntfsclone --save-image [options] source
13
14
15 ntfsclone --resotore-image [options] source
16
17
18 ntfsclone --metadata [options] source
19
20
22 The ntfsclone utility efficiently clones (which includes copy, save,
23 backup, and restore operations) or rescues an NTFS filesystem to a
24 sparse file, an image, a device (partition), or to standard output. It
25 works at disk sector level and copies only the written data (that is,
26 not empty space). Unused disk space becomes zero (cloning to sparse
27 file), encoded with control codes (saving in special image format),
28 left unchanged (cloning to a disk/partition) or filled with zeros
29 (cloning to standard output).
30
31
32 ntfsclone can be useful in making backups—taking an exact snapshot of
33 an NTFS filesystem—and restoring it later on. It also can be used to
34 test NTFS read/write functionality and allows you to troubleshoot
35 users' issues using the clone, without the risk of destroying the orig‐
36 inal file system.
37
38
39 If not using the special image format (see section of the same name
40 below), the clone is an exact copy of the original NTFS file system,
41 from sector to sector. Thus, it can also be mounted just like the orig‐
42 inal NTFS filesystem. For example, if you clone to a file and the ker‐
43 nel has a loopback device and NTFS support, then the file can be
44 mounted using:
45
46 # mount -t ntfs -o loop ntfsclone.img
47
48
49
50 Windows Cloning
51 You must exercise great care to copy, move or restore a system or boot
52 partition to another computer, or to a different disk or partition
53 (for example, /dev/dsk/c0d0p1 to /dev/dsk/c0d0p2, /dev/dsk/c0d0p1 to
54 /dev/dsk/c0d1p1 or to a different disk sector offset).
55
56
57 Under most circumstances, to enable Windows to boot you must copy,
58 move, or restore NTFS to the same partition that has the following
59 characteristics as the original partition and disk:
60
61 o starts at the same sector
62
63 o on the same type of disk
64
65 o having the same BIOS legacy cylinder setting
66
67
68 The ntfsclone utility guarantees an exact copy of NTFS but does not
69 deal with booting issues. This is by design: ntfsclone is a file sys‐
70 tem, not a system, utility. Its goal is only NTFS cloning, not Windows
71 cloning. Because of this, ntfsclone can be used as a very fast and
72 reliable building block for Windows cloning, but is not a complete
73 answer. You can find useful tips on NTFS cloning at the NTFS web site,
74 http://wiki.linux-ntfs.org.
75
76 Sparse Files
77 A file containing unallocated blocks (holes) is referred to as a
78 "sparse file". The reported size of such files is always higher than
79 the disk space consumed by them. The du(1) command reports the real
80 disk space used by a sparse file. The holes are always read as zeros.
81 All major Linux file systems, such as, ext2, ext3, reiserfs, Reiser4,
82 JFS, and XFS support sparse files. However, the ISO 9600 CD-ROM file
83 system, as one example, does not.
84
85 Special Image Format
86 It is recommended that you save an NTFS filesystem to a special image
87 format. Instead of representing unallocated blocks as holes, they are
88 encoded using control codes. Thus, the image saves space without
89 requiring sparse file support. The image format is ideal for streaming
90 file system images over the network. The disadvantage of the special
91 image format is that you cannot mount the image directly; you must
92 first restore it.
93
94
95 To save an image using the special image format, use the -s or the
96 --save-image option. To restore an image, use the -r or the --restore-
97 image option. Note that you can restore images from standard input by
98 using a hyphen (-) as the source file.
99
100 Metadata-only Cloning
101 Using the -m or --metadata option, ntfsclone can save only the NTFS
102 metadata and the clone still will be mountable. In this usage, all non-
103 metadata file content is lost; reading back the data results in all
104 zeros.
105
106
107 The metadata-only image can be compressed very well, usually to a size
108 in the range of 1 to 8 MB. It is convenient to transfer such an image
109 for investigation and troubleshooting.
110
111
112 In metadata-only mode, ntfsclone saves none of the user's data, which
113 includes the resident user's data embedded into metadata. All is filled
114 with zeros. Moreover, all the file timestamps, and deleted and unused
115 spaces inside the metadata are filled with zeros. Thus, this mode is
116 inappropriate, for example, for forensic analyses.
117
118
119 Note that filenames are not removed. Because a filename might contain
120 sensitive information, consider the possibities for breaches of secu‐
121 rity or privacy before sending out a metadata-only image.
122
124 Supported options are listed below. Most options have both single-let‐
125 ter and full-name forms. Multiple single-letter options that do not
126 take an argument can be combined. For example, -fv is the equivalent of
127 -f -v. A full-name option can be abbreviated to a unique prefix of its
128 name.
129
130 -f, --force
131
132 Forces ntfsclone to proceed, even if the filesystem is marked
133 "dirty" following a consistency check.
134
135
136 -h, --help
137
138 Show a list of options with a brief description of each one.
139
140
141 -i, --ignore-fs-check
142
143 Ignore the result of the file system consistency check. This option
144 can be used only with the --meta-data option. Any clusters that
145 cause an inconsistency are saved.
146
147
148 -m, --metadata
149
150 Clone only metadata. With this option, you must clone only to a
151 file.
152
153
154 -o, --output file
155
156 Clone NTFS to the non-existent file. If file is a hyphen (-), clone
157 to the standard output.
158
159
160 -O, --overwrite file
161
162 Clone NTFS to file, overwriting file if it already exists.
163
164
165 --rescue
166
167 Ignore disk read errors so that a disk having bad sectors, for
168 example, a failing disk, can be rescued with minimal impact on the
169 disk. ntfsclone works at the lowest, sector level in this mode,
170 enabling more data to be rescued. The contents of the unreadable
171 sectors are filled with the question mark (?) character; the begin‐
172 ning of such sectors are marked by the string: BadSector.
173
174
175 -r, --restore-image source
176
177 Restore from the special image format specified by source. If
178 source is a hyphen (-), the image is read from the standard input.
179
180
181 -s, --save-image
182
183 Save to the special image format. In terms of space usage and
184 speed, this is the most efficient option if imaging is done to the
185 standard output. This option is useful for image compression,
186 encryption, or streaming through a network.
187
188
190 Example 1 Cloning with Overwrite Option
191
192
193 The following command clones with the --overwrite option.
194
195
196 # ntfsclone --overwrite /dev/dsk/c0d2p1 /dev/dsk/c0d0p1
197
198
199
200 Example 2 Saving to Special Image Format
201
202
203 The following command clones to the special image format to its origi‐
204 nal partition.
205
206
207 # ntfsclone --save-image --output backup.img /dev/dsk/c0d0p1
208
209
210
211 Example 3 Restoring from a Special Image File
212
213
214 The following command restores an NTFS from a special image file.
215
216
217 # ntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 backup.img
218
219
220
221 Example 4 Saving to a Compressed Image
222
223
224 The following command saves an NTFS to a compressed image file.
225
226
227 # ntfsclone --save-image -o - /dev/dsk/c0d0p1
228
229
230
231 Example 5 Restoring from a Compressed Image
232
233
234 The following command restores an NTFS volume from a compressed image
235 file.
236
237
238 # gunzip -c backup.img.gz | \
239 ntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -
240
241
242
243 Example 6 Backing up to a Remote Host Using ssh
244
245
246 The following command backs up to a remote host, using ssh(1). Note
247 that ssh will probably require a password.
248
249
250 # ntfsclone --save-image --output - /dev/dsk/c0d0p1 | \
251 gzip -c | ssh host `cat > backup.img.gz`
252
253
254
255 Example 7 Restoring from a Remote Host Using ssh
256
257
258 The following command backs up to a remote host, using ssh(1). Note
259 that ssh will probably require a password.
260
261
262 # ssh host `cat backup.img.gz` | gunzip -c | \
263 ntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -
264
265
266
267 Example 8 Streaming an Image File from a Web Server
268
269
270 The following command streams an image file from a web server and
271 restore it to a partition.
272
273
274 # wget -qO - http://server/backup.img | \
275 ntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -
276
277
278
279 Example 9 Cloning to a New File
280
281
282 The following command clones an NTFS volume to a non-existent file.
283
284
285 # ntfsclone --output ntfs-clone.img /dev/dsk/c0d0p1
286
287
288
289 Example 10 Packing NTFS Metadata
290
291
292 The following command packs NTFS metadata into an image file. Note that
293 bzip2 takes a much longer time than gzip, but produces an archive that
294 is up to ten times smaller than the latter produces.
295
296
297 # ntfsclone --metadata --output ntfsmeta.img /dev/dsk/c0d0p1
298 bzip2 ntfsmeta.img
299
300
301
302 Example 11 Unpacking NTFS Metadata
303
304
305 The following command unpacks NTFS metadata into a sparse file.
306
307
308 # bunzip2 -c ntfsmeta.img.bz2 | \
309 cp --sparse=always /proc/self/fd/0 ntfsmeta.img
310
311
312
314 The return code is zero on success, non-zero otherwise.
315
317 See attributes(5) for descriptions of the following attributes:
318
319
320
321
322 ┌─────────────────────────────┬─────────────────────────────┐
323 │ ATTRIBUTE TYPE │ ATTRIBUTE VALUE │
324 ├─────────────────────────────┼─────────────────────────────┤
325 │Availability │SUNWntfsprogs │
326 ├─────────────────────────────┼─────────────────────────────┤
327 │Interface Stability │Uncommitted │
328 └─────────────────────────────┴─────────────────────────────┘
329
331 du(1), ssh(1), ntfsresize(1M), ntfsundelete(1M), parted(1M),
332 attributes(5)
333
334
335 http://wiki.linux-ntfs.org
336
338 ntfsclone was written by Szabolcs Szakacsits with contributions from
339 Per Olofsson (special image format support) and Anton Altaparmakov.
340
341
342
343SunOS 5.11 14 May 2009 ntfsclone(1M)