ntfsclone(8)
NAME
ntfsclone - Efficiently clone, image, restore or rescue an NTFS
SYNOPSIS
ntfsclone [OPTIONS] SOURCE ntfsclone --save-image [OPTIONS] SOURCE ntfsclone --restore-image [OPTIONS] SOURCE ntfsclone --metadata [OPTIONS] SOURCE
DESCRIPTION
ntfsclone will efficiently clone (copy, save, backup, restore) or
rescue an NTFS filesystem to a sparse file, image, device (partition)
or standard output. It works at disk sector level and copies only the
used data. Unused disk space becomes zero (cloning to sparse file),
encoded with control codes (saving in special image format), left
unchanged (cloning to a disk/partition) or filled with zeros (cloning
to standard output).
ntfsclone can be useful to make backups, an exact snapshot of an NTFS
filesystem and restore it later on, or for developers to test NTFS
read/write functionality, troubleshoot/investigate users' issues using
the clone without the risk of destroying the original filesystem.
The clone, if not using the special image format, is an exact copy of
the original NTFS filesystem from sector to sector thus it can be also
mounted just like the original NTFS filesystem. For example if you
clone to a file and the kernel has loopback device and NTFS support
then the file can be mounted as
mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone
Windows Cloning
If you want to copy, move or restore a system or boot partition to
another computer, or to a different disk or partition (e.g. hda1->hda2,
hda1->hdb1 or to a different disk sector offset) then you will need to
take extra care.
Usually, Windows will not be able to boot, unless you copy, move or
restore NTFS to the same partition which starts at the same sector on
the same type of disk having the same BIOS legacy cylinder setting as
the original partition and disk had.
The ntfsclone utility guarantees to make an exact copy of NTFS but it
won't deal with booting issues. This is by design: ntfsclone is a
filesystem, not system utility. Its aim is only NTFS cloning, not
Windows cloning. Hereby ntfsclone can be used as a very fast and
reliable build block for Windows cloning but itself it's not enough.
Sparse Files
A file is sparse if it has unallocated blocks (holes). The reported
size of such files are always higher than the disk space consumed by
them. The du command can tell the real disk space used by a sparse
file. The holes are always read as zeros. All major Linux filesystem
like, ext2, ext3, reiserfs, Reiser4, JFS and XFS, supports sparse files
but for example the ISO 9600 CD-ROM filesystem doesn't.
Handling Large Sparse Files
As of today Linux provides inadequate support for managing (tar, cp,
gzip, gunzip, bzip2, bunzip2, cat, etc) large sparse files. The only
main Linux filesystem having support for efficient sparse file handling
is XFS by the XFS_IOC_GETBMAPX ioctl(2). However none of the common
utilities supports it. This means when you tar, cp, gzip, bzip2, etc a
large sparse file they will always read the entire file, even if you
use the "sparse support" options.
bzip2(1) compresses large sparse files much better than gzip(1) but it
does so also much slower. Moreover neither of them handles large sparse
files efficiently during uncompression from disk space usage point of
view.
At present the most efficient way, both speed and space-wise, to
compress and uncompress large sparse files by common tools would be
using tar(1) with the options -S (handle sparse files "efficiently")
and -j (filter the archive through bzip2). Although tar still reads and
analyses the entire file, it doesn't pass on the large data blocks
having only zeros to filters and it also avoids writing large amount of
zeros to the disk needlessly. But since tar can't create an archive
from the standard input, you can't do this in-place by just reading
ntfsclone standard output. Even more sadly, using the -S option results
serious data loss since the end of 2004 and the GNU tar maintainers
didn't release fixed versions until the present day.
The Special Image Format
It's also possible, actually it's recommended, to save an NTFS
filesystem to a special image format. Instead of representing
unallocated blocks as holes, they are encoded using control codes.
Thus, the image saves space without requiring sparse file support. The
image format is ideal for streaming filesystem images over the network
and similar, and can be used as a replacement for Ghost or Partition
Image if it is combined with other tools. The downside is that you
can't mount the image directly, you need to restore it first.
To save an image using the special image format, use the -s or the
--save-image option. To restore an image, use the -r or the
--restore-image option. Note that you can restore images from standard
input by using '-' as the SOURCE file.
Metadata-only Cloning
One of the features of ntfsclone is that, it can also save only the
NTFS metadata using the option -m or --metadata and the clone still
will be mountable. In this case all non-metadata file content will be
lost and reading them back will result always zeros.
The metadata-only image can be compressed very well, usually to not
more than 1-8 MB thus it's easy to transfer for investigation,
troubleshooting.
In this mode of ntfsclone, NONE of the user's data is saved, including
the resident user's data embedded into metadata. All is filled with
zeros. Moreover all the file timestamps, deleted and unused spaces
inside the metadata are filled with zeros. Thus this mode is
inappropriate for example for forensic analyses. This mode may be
combined with --save-image to create a special image format file
instead of a sparse file.
Please note, filenames are not wiped out. They might contain sensitive
information, so think twice before sending such an image to anybody.
OPTIONS
Below is a summary of all the options that ntfsclone accepts. Nearly
all options have two equivalent names. The short name is preceded by -
and the long name is preceded by -- . Any single letter options, that
don't take an argument, can be combined into a single command, e.g.
-fv is equivalent to -f -v . Long named options can be abbreviated to
any unique prefix of their name.
-o, --output FILE
Clone NTFS to the non-existent FILE. If FILE is '-' then clone
to the standard output. This option cannot be used for creating
a partition, use --overwrite for an existing partition.
-O, --overwrite FILE
Clone NTFS to FILE, which can be an existing partition or a
regular file which will be overwritten if it exists.
-s, --save-image
Save to the special image format. This is the most efficient way
space and speed-wise if imaging is done to the standard output,
e.g. for image compression, encryption or streaming through a
network.
-r, --restore-image
Restore from the special image format specified by SOURCE
argument. If the SOURCE is '-' then the image is read from the
standard input.
-n, --no-action
Test the consistency of a saved image by simulating its
restoring without writing anything. The NTFS data contained in
the image is not tested. The option --restore-image must also
be present, and the options --output and --overwrite must be
omitted.
--rescue
Ignore disk read errors so disks having bad sectors, e.g. dying
disks, can be rescued the most efficiently way, with minimal
stress on them. Ntfsclone works at the lowest, sector level in
this mode too thus more data can be rescued. The contents of
the unreadable sectors are filled by character '?' and the
beginning of such sectors are marked by "BadSectoR\0".
-m, --metadata
Clone ONLY METADATA (for NTFS experts). Only cloning to a
(sparse) file is allowed, unless used the option --save-image is
also used. You can't metadata-only clone to a device.
--ignore-fs-check
Ignore the result of the filesystem consistency check. This
option is allowed to be used only with the --metadata option,
for the safety of user's data. The clusters which cause the
inconsistency are saved too.
-t, --preserve-timestamps
Do not wipe the timestamps, to be used only with the --metadata
option.
--full-logfile
Include the Windows log file in the copy. This is only useful
for extracting metadata, saving or cloning a file system which
was not properly unmounted from Windows.
--new-serial, or
--new-half-serial
Set a new random serial number to the clone. The serial number
is a 64 bit number used to identify the device during the
mounting process, so it has to be changed to enable the original
file system and the clone to be mounted at the same time on the
same computer.
The option --new-half-serial only changes the upper part of the
serial number, keeping the lower part which is used by Windows
unchanged.
The options --new-serial and --new-half-serial can only be used
when cloning a file system of restoring from an image.
The serial number is not the volume UUID used by Windows to
locate files which have been moved to another volume.
-f, --force
Forces ntfsclone to proceed if the filesystem is marked "dirty"
for consistency check.
-q, --quiet
Do not display any progress-bars during operation.
-h, --help
Show a list of options with a brief description of each one.
EXIT CODES
The exit code is 0 on success, non-zero otherwise.
EXAMPLES
Clone NTFS on /dev/hda1 to /dev/hdc1:
ntfsclone --overwrite /dev/hdc1 /dev/hda1
Save an NTFS to a file in the special image format:
ntfsclone --save-image --output backup.img /dev/hda1
Restore an NTFS from a special image file to its original partition:
ntfsclone --restore-image --overwrite /dev/hda1 backup.img
Save an NTFS into a compressed image file:
ntfsclone --save-image -o - /dev/hda1 | gzip -c > backup.img.gz
Restore an NTFS volume from a compressed image file:
gunzip -c backup.img.gz | \
ntfsclone --restore-image --overwrite /dev/hda1 -
Backup an NTFS volume to a remote host, using ssh. Please note, that
ssh may ask for a password!
ntfsclone --save-image --output - /dev/hda1 | \
gzip -c | ssh host 'cat > backup.img.gz'
Restore an NTFS volume from a remote host via ssh. Please note, that
ssh may ask for a password!
ssh host 'cat backup.img.gz' | gunzip -c | \
ntfsclone --restore-image --overwrite /dev/hda1 -
Stream an image file from a web server and restore it to a partition:
wget -qO - http://server/backup.img | \
ntfsclone --restore-image --overwrite /dev/hda1 -
Clone an NTFS volume to a non-existent file:
ntfsclone --output ntfs-clone.img /dev/hda1
Pack NTFS metadata for NTFS experts. Please note that bzip2 runs very
long but results usually at least 10 times smaller archives than gzip
on a sparse file.
ntfsclone --metadata --output ntfsmeta.img /dev/hda1
bzip2 ntfsmeta.img
Or, outputting to a compressed image :
ntfsclone -mst --output - /dev/hda1 | bzip2 > ntfsmeta.bz2
Unpacking NTFS metadata into a sparse file:
bunzip2 -c ntfsmeta.img.bz2 | \
cp --sparse=always /proc/self/fd/0 ntfsmeta.img
KNOWN ISSUES
There are no known problems with ntfsclone. If you think you have found a problem then please send an email describing it to the development team: [email protected] Sometimes it might appear ntfsclone froze if the clone is on ReiserFS and even CTRL-C won't stop it. This is not a bug in ntfsclone, however it's due to ReiserFS being extremely inefficient creating large sparse files and not handling signals during this operation. This ReiserFS problem was improved in kernel 2.4.22. XFS, JFS and ext3 don't have this problem.
AUTHORS
ntfsclone was written by Szabolcs Szakacsits with contributions from Per Olofsson (special image format support) and Anton Altaparmakov. It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.
AVAILABILITY
ntfsclone is part of the ntfs-3g package and is available at: http://www.tuxera.com/community/
SEE ALSO
ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)
Opportunity
Personal Opportunity - Free software gives you access to billions of dollars of software at no cost. Use this software for your business, personal use or to develop a profitable skill. Access to source code provides access to a level of capabilities/information that companies protect though copyrights. Open source is a core component of the Internet and it is available to you. Leverage the billions of dollars in resources and capabilities to build a career, establish a business or change the world. The potential is endless for those who understand the opportunity.
Business Opportunity - Goldman Sachs, IBM and countless large corporations are leveraging open source to reduce costs, develop products and increase their bottom lines. Learn what these companies know about open source and how open source can give you the advantage.
Free Software
Free Software provides computer programs and capabilities at no cost but more importantly, it provides the freedom to run, edit, contribute to, and share the software. The importance of free software is a matter of access, not price. Software at no cost is a benefit but ownership rights to the software and source code is far more significant.
Free Office Software - The Libre Office suite provides top desktop productivity tools for free. This includes, a word processor, spreadsheet, presentation engine, drawing and flowcharting, database and math applications. Libre Office is available for Linux or Windows.
Free Books
The Free Books Library is a collection of thousands of the most popular public domain books in an online readable format. The collection includes great classical literature and more recent works where the U.S. copyright has expired. These books are yours to read and use without restrictions.
Source Code - Want to change a program or know how it works? Open Source provides the source code for its programs so that anyone can use, modify or learn how to write those programs themselves. Visit the GNU source code repositories to download the source.
Education
Study at Harvard, Stanford or MIT - Open edX provides free online courses from Harvard, MIT, Columbia, UC Berkeley and other top Universities. Hundreds of courses for almost all major subjects and course levels. Open edx also offers some paid courses and selected certifications.
Linux Manual Pages - A man or manual page is a form of software documentation found on Linux/Unix operating systems. Topics covered include computer programs (including library and system calls), formal standards and conventions, and even abstract concepts.
