| blob | a288e018fe914a39ba495f571bf4107beecc1161 |
1 '\" te
2 .\" Portions Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
3 .\" Copyright (c) 2002-2006 Szabolcs Szakacsits
4 .\" Copyright (c) 2002-2005 Anton Altaparmakov
5 .\" Copyright (c) 2002-2003 Richard Russon
6 .\" Copyright (c) 2007 Yura Pakhuchiy
7 .\" This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation ; either version 2 of the License, or (at your option) any later version. This program is distributed
8 .\" in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program
9 .\" (in the main directory of the Linux-NTFS distribution in the file COPYING); if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 11-1307 USA
10 .TH NTFSCLONE 1M "May 14, 2009"
11 .SH NAME
12 ntfsclone \- clone, image, restore, or rescue an NTFS
13 .SH SYNOPSIS
14 .LP
15 .nf
16 \fBntfsclone\fR [\fIoptions\fR] \fIsource\fR
17 .fi
19 .LP
20 .nf
21 \fBntfsclone\fR \fB--save-image\fR [\fIoptions\fR] \fIsource\fR
22 .fi
24 .LP
25 .nf
26 \fBntfsclone\fR \fB--resotore-image\fR [\fIoptions\fR] \fIsource\fR
27 .fi
29 .LP
30 .nf
31 \fBntfsclone\fR \fB--metadata\fR [\fIoptions\fR] \fIsource\fR
32 .fi
34 .SH DESCRIPTION
35 .sp
36 .LP
37 The \fBntfsclone\fR utility efficiently clones (which includes copy, save,
38 backup, and restore operations) or rescues an NTFS filesystem to a sparse file,
39 an image, a device (partition), or to standard output. It works at disk sector
40 level and copies only the written data (that is, not empty space). Unused disk
41 space becomes zero (cloning to sparse file), encoded with control codes (saving
42 in special image format), left unchanged (cloning to a disk/partition) or
43 filled with zeros (cloning to standard output).
44 .sp
45 .LP
46 \fBntfsclone\fR can be useful in making backups\(emtaking an exact snapshot of
47 an NTFS filesystem\(emand restoring it later on. It also can be used to test
48 NTFS read/write functionality and allows you to troubleshoot users' issues
49 using the clone, without the risk of destroying the original file system.
50 .sp
51 .LP
52 If not using the special image format (see section of the same name below), the
53 clone is an exact copy of the original NTFS file system, from sector to sector.
54 Thus, it can also be mounted just like the original NTFS filesystem. For
55 example, if you clone to a file and the kernel has a loopback device and NTFS
56 support, then the file can be mounted using:
57 .sp
58 .in +2
59 .nf
60 # \fBmount -t ntfs -o loop ntfsclone.img\fR
61 .fi
62 .in -2
63 .sp
65 .SS "Windows Cloning"
66 .sp
67 .LP
68 You must exercise great care to copy, move or restore a system or boot
69 partition to another computer, or to a different disk or partition (for
70 example, \fB/dev/dsk/c0d0p1\fR to \fB/dev/dsk/c0d0p2\fR, \fB/dev/dsk/c0d0p1\fR
71 to \fB/dev/dsk/c0d1p1\fR or to a different disk sector offset).
72 .sp
73 .LP
74 Under most circumstances, to enable Windows to boot you must copy, move, or
75 restore NTFS to the same partition that has the following characteristics as
76 the original partition and disk:
77 .RS +4
78 .TP
79 .ie t \(bu
80 .el o
81 starts at the same sector
82 .RE
83 .RS +4
84 .TP
85 .ie t \(bu
86 .el o
87 on the same type of disk
88 .RE
89 .RS +4
90 .TP
91 .ie t \(bu
92 .el o
93 having the same BIOS legacy cylinder setting
94 .RE
95 .sp
96 .LP
97 The \fBntfsclone\fR utility guarantees an exact copy of NTFS but does not deal
98 with booting issues. This is by design: \fBntfsclone\fR is a file system, not a
99 system, utility. Its goal is only NTFS cloning, not Windows cloning. Because of
100 this, \fBntfsclone\fR can be used as a very fast and reliable building block
101 for Windows cloning, but is not a complete answer. You can find useful tips on
102 NTFS cloning at the NTFS web site, http://wiki.linux-ntfs.org\&.
103 .SS "Sparse Files"
104 .sp
105 .LP
106 A file containing unallocated blocks (holes) is referred to as a "sparse file".
107 The reported size of such files is always higher than the disk space consumed
108 by them. The \fBdu\fR(1) command reports the real disk space used by a sparse
109 file. The holes are always read as zeros. All major Linux file systems, such
110 as, \fBext2\fR, \fBext3\fR, \fBreiserfs\fR, \fBReiser4\fR, JFS, and XFS support
111 sparse files. However, the ISO 9600 CD-ROM file system, as one example, does
112 not.
113 .SS "Special Image Format"
114 .sp
115 .LP
116 It is recommended that you save an NTFS filesystem to a special image format.
117 Instead of representing unallocated blocks as holes, they are encoded using
118 control codes. Thus, the image saves space without requiring sparse file
119 support. The image format is ideal for streaming file system images over the
120 network. The disadvantage of the special image format is that you cannot mount
121 the image directly; you must first restore it.
122 .sp
123 .LP
124 To save an image using the special image format, use the \fB-s\fR or the
125 \fB--save-image\fR option. To restore an image, use the \fB-r\fR or the
126 \fB--restore-image\fR option. Note that you can restore images from standard
127 input by using a hyphen (\fB-\fR) as the source file.
128 .SS "Metadata-only Cloning"
129 .sp
130 .LP
131 Using the \fB-m\fR or \fB--metadata\fR option, \fBntfsclone\fR can save only
132 the NTFS metadata and the clone still will be mountable. In this usage, all
133 non-metadata file content is lost; reading back the data results in all zeros.
134 .sp
135 .LP
136 The metadata-only image can be compressed very well, usually to a size in the
137 range of 1 to 8 MB. It is convenient to transfer such an image for
138 investigation and troubleshooting.
139 .sp
140 .LP
141 In metadata-only mode, \fBntfsclone\fR saves none of the user's data, which
142 includes the resident user's data embedded into metadata. All is filled with
143 zeros. Moreover, all the file timestamps, and deleted and unused spaces inside
144 the metadata are filled with zeros. Thus, this mode is inappropriate, for
145 example, for forensic analyses.
146 .sp
147 .LP
148 Note that filenames are not removed. Because a filename might contain sensitive
149 information, consider the possibities for breaches of security or privacy
150 before sending out a metadata-only image.
151 .SH OPTIONS
152 .sp
153 .LP
154 Supported options are listed below. Most options have both single-letter and
155 full-name forms. Multiple single-letter options that do not take an argument
156 can be combined. For example, \fB-fv\fR is the equivalent of \fB-f\fR \fB-v\fR.
157 A full-name option can be abbreviated to a unique prefix of its name.
158 .sp
159 .ne 2
160 .na
161 \fB\fB-f\fR, \fB--force\fR\fR
162 .ad
163 .sp .6
164 .RS 4n
165 Forces \fBntfsclone\fR to proceed, even if the filesystem is marked "dirty"
166 following a consistency check.
167 .RE
169 .sp
170 .ne 2
171 .na
172 \fB\fB-h\fR, \fB--help\fR\fR
173 .ad
174 .sp .6
175 .RS 4n
176 Show a list of options with a brief description of each one.
177 .RE
179 .sp
180 .ne 2
181 .na
182 \fB\fB-i\fR, \fB--ignore-fs-check\fR\fR
183 .ad
184 .sp .6
185 .RS 4n
186 Ignore the result of the file system consistency check. This option can be used
187 only with the \fB--meta-data\fR option. Any clusters that cause an
188 inconsistency are saved.
189 .RE
191 .sp
192 .ne 2
193 .na
194 \fB\fB-m\fR, \fB--metadata\fR\fR
195 .ad
196 .sp .6
197 .RS 4n
198 Clone only metadata. With this option, you must clone only to a file.
199 .RE
201 .sp
202 .ne 2
203 .na
204 \fB\fB-o\fR, \fB--output\fR \fIfile\fR\fR
205 .ad
206 .sp .6
207 .RS 4n
208 Clone NTFS to the non-existent \fIfile\fR. If \fIfile\fR is a hyphen (\fB-\fR),
209 clone to the standard output.
210 .RE
212 .sp
213 .ne 2
214 .na
215 \fB\fB-O\fR, \fB--overwrite\fR \fIfile\fR\fR
216 .ad
217 .sp .6
218 .RS 4n
219 Clone NTFS to \fIfile\fR, overwriting \fIfile\fR if it already exists.
220 .RE
222 .sp
223 .ne 2
224 .na
225 \fB\fB--rescue\fR\fR
226 .ad
227 .sp .6
228 .RS 4n
229 Ignore disk read errors so that a disk having bad sectors, for example, a
230 failing disk, can be rescued with minimal impact on the disk. \fBntfsclone\fR
231 works at the lowest, sector level in this mode, enabling more data to be
232 rescued. The contents of the unreadable sectors are filled with the question
233 mark (\fB?\fR) character; the beginning of such sectors are marked by the
234 string: \fBBadSector\fR.
235 .RE
237 .sp
238 .ne 2
239 .na
240 \fB\fB-r\fR, \fB--restore-image\fR \fIsource\fR\fR
241 .ad
242 .sp .6
243 .RS 4n
244 Restore from the special image format specified by \fIsource\fR. If
245 \fIsource\fR is a hyphen (\fB-\fR), the image is read from the standard input.
246 .RE
248 .sp
249 .ne 2
250 .na
251 \fB\fB-s\fR, \fB--save-image\fR\fR
252 .ad
253 .sp .6
254 .RS 4n
255 Save to the special image format. In terms of space usage and speed, this is
256 the most efficient option if imaging is done to the standard output. This
257 option is useful for image compression, encryption, or streaming through a
258 network.
259 .RE
261 .SH EXAMPLES
262 .LP
263 \fBExample 1 \fRCloning with Overwrite Option
264 .sp
265 .LP
266 The following command clones with the \fB--overwrite\fR option.
268 .sp
269 .in +2
270 .nf
271 # \fBntfsclone --overwrite /dev/dsk/c0d2p1 /dev/dsk/c0d0p1\fR
272 .fi
273 .in -2
274 .sp
276 .LP
277 \fBExample 2 \fRSaving to Special Image Format
278 .sp
279 .LP
280 The following command clones to the special image format to its original
281 partition.
283 .sp
284 .in +2
285 .nf
286 # \fBntfsclone --save-image --output backup.img /dev/dsk/c0d0p1\fR
287 .fi
288 .in -2
289 .sp
291 .LP
292 \fBExample 3 \fRRestoring from a Special Image File
293 .sp
294 .LP
295 The following command restores an NTFS from a special image file.
297 .sp
298 .in +2
299 .nf
300 # \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 backup.img\fR
301 .fi
302 .in -2
303 .sp
305 .LP
306 \fBExample 4 \fRSaving to a Compressed Image
307 .sp
308 .LP
309 The following command saves an NTFS to a compressed image file.
311 .sp
312 .in +2
313 .nf
314 # \fBntfsclone --save-image -o - /dev/dsk/c0d0p1\fR
315 .fi
316 .in -2
317 .sp
319 .LP
320 \fBExample 5 \fRRestoring from a Compressed Image
321 .sp
322 .LP
323 The following command restores an NTFS volume from a compressed image file.
325 .sp
326 .in +2
327 .nf
328 # \fBgunzip -c backup.img.gz | \e\fR
329 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR
330 .fi
331 .in -2
332 .sp
334 .LP
335 \fBExample 6 \fRBacking up to a Remote Host Using \fBssh\fR
336 .sp
337 .LP
338 The following command backs up to a remote host, using \fBssh\fR(1). Note that
339 \fBssh\fR will probably require a password.
341 .sp
342 .in +2
343 .nf
344 # \fBntfsclone --save-image --output - /dev/dsk/c0d0p1 | \e\fR
345 \fBgzip -c | ssh host `cat > backup.img.gz`\fR
346 .fi
347 .in -2
348 .sp
350 .LP
351 \fBExample 7 \fRRestoring from a Remote Host Using \fBssh\fR
352 .sp
353 .LP
354 The following command backs up to a remote host, using \fBssh\fR(1). Note that
355 \fBssh\fR will probably require a password.
357 .sp
358 .in +2
359 .nf
360 # \fBssh host `cat backup.img.gz` | gunzip -c | \e\fR
361 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR
362 .fi
363 .in -2
364 .sp
366 .LP
367 \fBExample 8 \fRStreaming an Image File from a Web Server
368 .sp
369 .LP
370 The following command streams an image file from a web server and restore it to
371 a partition.
373 .sp
374 .in +2
375 .nf
376 # \fBwget -qO - http://server/backup.img | \e\fR
377 \fBntfsclone --restore-image --overwrite /dev/dsk/c0d0p1 -\fR
378 .fi
379 .in -2
380 .sp
382 .LP
383 \fBExample 9 \fRCloning to a New File
384 .sp
385 .LP
386 The following command clones an NTFS volume to a non-existent file.
388 .sp
389 .in +2
390 .nf
391 # \fBntfsclone --output ntfs-clone.img /dev/dsk/c0d0p1\fR
392 .fi
393 .in -2
394 .sp
396 .LP
397 \fBExample 10 \fRPacking NTFS Metadata
398 .sp
399 .LP
400 The following command packs NTFS metadata into an image file. Note that
401 \fBbzip2\fR takes a much longer time than \fBgzip\fR, but produces an archive
402 that is up to ten times smaller than the latter produces.
404 .sp
405 .in +2
406 .nf
407 # \fBntfsclone --metadata --output ntfsmeta.img /dev/dsk/c0d0p1\fR
408 \fBbzip2 ntfsmeta.img\fR
409 .fi
410 .in -2
411 .sp
413 .LP
414 \fBExample 11 \fRUnpacking NTFS Metadata
415 .sp
416 .LP
417 The following command unpacks NTFS metadata into a sparse file.
419 .sp
420 .in +2
421 .nf
422 # \fBbunzip2 -c ntfsmeta.img.bz2 | \e\fR
423 \fBcp --sparse=always /proc/self/fd/0 ntfsmeta.img\fR
424 .fi
425 .in -2
426 .sp
428 .SH EXIT STATUS
429 .sp
430 .LP
431 The return code is zero on success, non-zero otherwise.
432 .SH ATTRIBUTES
433 .sp
434 .LP
435 See \fBattributes\fR(5) for descriptions of the following attributes:
436 .sp
438 .sp
439 .TS
440 box;
441 c | c
442 l | l .
443 ATTRIBUTE TYPE ATTRIBUTE VALUE
444 _
445 Interface Stability Uncommitted
446 .TE
448 .SH SEE ALSO
449 .sp
450 .LP
451 \fBdu\fR(1), \fBssh\fR(1), \fBntfsresize\fR(1M), \fBntfsundelete\fR(1M),
452 \fBparted\fR(1M), \fBattributes\fR(5)
453 .sp
454 .LP
455 http://wiki.linux-ntfs.org
456 .SH AUTHORS
457 .sp
458 .LP
459 \fBntfsclone\fR was written by Szabolcs Szakacsits with contributions from Per
460 Olofsson (special image format support) and Anton Altaparmakov.