Linux NTFS - NTFSCLONE (8)


NAME

ntfsclone - Efficiently clone, image or restore an NTFS filesystem

SYNOPSIS

ntfsclone [OPTIONS] source
ntfsclone --save-image [OPTIONS] source
ntfsclone --restore-image [OPTIONS] source
ntfsclone --metadata [OPTIONS] source

DESCRIPTION

ntfsclone will efficiently clone (copy, save, backup, restore) an NTFS filesystem to a sparse file, image, device (partition) or standard output. It works at disk sector level and copies only the used data. Unused disk space becomes zero (cloning to sparse file), encoded with control codes (cloning to an image), left unchanged (cloning to a disk/partition) or filled with zeros (cloning to standard output).

ntfsclone can be useful to make backups, an exact snapshot of an NTFS filesystem and restore it later on, or for developers to test NTFS read/write functionality, troubleshot/investigate users’ issues using the clone without the risk of destroying the original filesystem.

The clone (if not using the image format) is an exact copy of the original NTFS filesystem from sector to sector thus it can be also mounted just like the original NTFS filesystem. For example if you clone to a file and the kernel has loopback device and NTFS support then the file can be mounted as

mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone

SPARSE FILES

A file is sparse if it has unallocated blocks (holes). The reported size of such files are always higher than the disk space consumed by them. The du command can tell the real disk space used by a sparse file. The holes are always read as zeros. All major Linux filesystem like, ext2, ext3, reiserfs, Reiser4, JFS and XFS, supports sparse files but for example the ISO 9600 CD-ROM filesystem doesn’t.

HANDLING LARGE SPARSE FILES

As of today Linux provides inadequate support for managing (tar, cp, gzip, gunzip, bzip2, bunzip2, cat, etc) large sparse files. The only main Linux filesystem having support for efficient sparse file handling is XFS by the XFS_IOC_GETBMAPX ioctl. However none of the common utilities supports it. This means when you tar, cp, gzip, bzip2, etc a large sparse file they will always read the entire file, even if you use the "sparse support" options.

bzip2 compresses large sparse files much better than gzip but it does so also much slower. Moreover neither of them handles large sparse files efficiently during uncompression from disk space usage point of view.

At present the most efficient way, both speed and space-wise, to compress and uncompress large sparse files by common tools is using tar with the options -S (handle sparse files "efficiently") and -j (filter the archive through bzip2). Altough tar still reads and analyses the entire file, it doesn’t pass on the large data blocks having only zeros to filters and it also avoids writing large amount of zeros to the disk needlessly. But since tar can’t create an archive from the standard input, you can’t do this in-place by just reading ntfsclone standard output.

THE SPECIAL IMAGE FORMAT

It is also possible to clone an NTFS filesystem to a special image format. Instead of representing unallocated blocks as holes, they are encoded using control codes. Thus, the image saves space without requiring sparse file support. The image format is ideal for streaming filesystem images over the network and similar, and can be used as a replacement for Ghost or Partition Image if it is combined with other tools. The downside is that you can’t mount the image directly, you need to restore it first.

To save an image using the special image format, use the -s or the --save-image option. To restore an image, use the -r or the --restore-image option. Note that you can restore images from standard input by using ’-’ as the source file.

METADATA-ONLY CLONING

One of the features of ntfsclone is it can also save only the NTFS metadata using the option -m or --metadata and the clone still will be mountable. In this case all non-metadata file content will be lost and reading them back will result always zeros.

The metadata-only image can be compressed very well, usually to not more than 1-3 MB thus it’s relatively easy to transfer for investigation, troubleshooting.

In this mode of ntfsclone, NONE of the user’s data is saved, including the resident user’s data embedded into metadata. All is filled with zeros. Moreover all the file timestamps, deleted and unused spaces inside the metadata are filled with zeros. Thus this mode is inappropriate for example for forensic analyses.

Please note, filenames are not wiped out. They might contain sensitive information, so think twice before sending such an image to anybody.

OPTIONS

Below is a summary of all the options that ntfsclone accepts. All options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don’t take an argument, can be combined into a single command, e.g. -fm is equivalent to -f -m.

-o, --output FILE
  Clone NTFS to the non-existent FILE. If FILE is ’-’ then clone to the standard output.
-O, --overwrite FILE
  Clone NTFS to FILE, overwriting if exists.
-m, --metadata
  Clone ONLY METADATA (for NTFS experts). Moreover only cloning to a file is allowed. You can’t metadata-only clone to a device, image or standard output.
-s, --save-image
  Save to the special image format.
-r, --restore-image
  Restore from the special image format specified by source. If the source is ’-’ then the image is read from the standard input.
-f, --force
  Forces ntfsclone to proceed if the filesystem is marked "dirty" for consistency check.
-h, --help Show a list of options with a brief description of each one.

EXAMPLES

Clone (save, backup) an NTFS volume to a non-existent file

ntfsclone --output ntfs.img /dev/hda1

Restore a clone image to its original partition

ntfsclone --overwrite /dev/hda1 ntfs.img

Space and speed-wise the most efficient way to compress a clone image

tar -cjSf ntfs.img.tar.bz2 ntfs.img

Uncompressing a tar archived clone image

tar -xjSf ntfs.img.tar.bz2

In-place compressing an NTFS volume. Note, gzip is faster usually at least 2-4 times but it creates also bigger compressed files.

ntfsclone --output - /dev/hda1 | bzip2 -c > ntfs.img.bz2

Restore an NTFS volume from a compressed image

bunzip2 -c ntfs.img.bz2 | dd of=/dev/hda1 bs=8192

Backup an NTFS volume to a remote host, using ssh default compression.

ntfsclone -o - /dev/hda1 | ssh -C host ’bzip -c9 > ntfs.img.bz2’

Restore an NTFS volume from a remote host via ssh.

ssh host ’cat ntfs.img.bz2’ | bunzip2 | dd of=/dev/hda1 bs=8192

Save a filesystem to a file in the special image format

ntfsclone --save-image --output ntfs.img /dev/hda1

Stream an image from a web server and restore it to a partition

wget -qO - http://server/ntfs.img | \\
ntfsclone --restore-image --overwrite /dev/hda1 -

Pack NTFS metadata for NTFS experts

ntfsclone --metadata --output ntfsmeta.img /dev/hda1
tar -cjSf ntfsmeta.img.tar.bz2 ntfsmeta.img

KNOWN ISSUES

This program has no known bugs. If you find one, please send an email to <linux-ntfs-dev@lists.sourceforge.net>.

Sometimes it might appear ntfsclone froze if the clone is on ReiserFS and even CTRL-C won’t stop it. This is not a bug in ntfsclone, however it’s due to ReiserFS being extremely inefficient creating large sparse files and not handling signals during this operation. This ReiserFS problem was improved in kernel 2.4.22. XFS, JFS and ext3 don’t have this problem.

AUTHOR

ntfsclone was written by Szabolcs Szakacsits <szaka@sienet.hu>.

Special image format support was added by Per Olofsson <pelle@dsv.su.se>.

AVAILABILITY

ntfsclone is part of the ntfsprogs package and is available from
http://linux-ntfs.sourceforge.net/downloads.html

SEE ALSO

ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)

 

 


ntfsprogs version 1.9.3-WIP NTFSCLONE (8) Jul 2004

maintained by flatcap (Richard Russon) generated by manserver 1.07 SourceForge

 

[ top ]