• Wiki Home
• Forum
• Search
• ntfsprogs manpages

• What is NTFS?
• How can I access NTFS?
  • The kernel driver
  • Userspace driver (ntfsmount)
  • Userspace tools (ntfsprogs)
• Current project status
• Other Documentation

• Downloads
• Development
• RedHat/Fedora
• About us

~~CLOUD:30~~

The ntfsclone utility efficiently copies, backups and restores an NTFS filesystem to/from a file, partition or standard output. It is part of the ntfsprogs suite, its full description along with some usage examples can be found in the ntfsclone manual.

Working with ntfsclone is like working with dd, but ntfsclone is always faster. Like dd, ntfsclone works at the disk sector level, but since it knows the underlying filesystem (unlike dd) it either ignores unused sectors or converts them into easily compressible zeros. If you store the resulting images uncompressed, most Unix file systems (xfs, jfs, ext2/3, reiser3/4, etc) as well as NTFS won't waste space for these unused sectors.

Ntfsclone also has an advanced image format which makes the image files much smaller than plain dd images, by not storing the zeros at all. On the down side, such images are not loop-mountable.

• imaging is possible without installed a software on the machine
• freedom to compress with the compressor of your choice
• excellent support for backups to network drives due to the use linux
• as you do all steps manually, you exactly know what is done
• ability to verify images by restoring to a loop device and comparing files to original ones (maybe ntfscmp could easy this task if it is ready)

Well there are also some disadvantages:

• should not be used by people not knowing what they are doing
• it would be difficult to implement incremental backups

If you want to copy, move or restore a system or boot partition to another computer, or to a different disk or partition (e.g. hda1→hda2, hda1→hdb1 or to different disk sector offset) then you will need to take extra care.

Usually, Windows will not be able to boot, unless you copy, move or restore NTFS to the same partition which starts at the same sector on the same type of disk having the same BIOS legacy cylinder setting as the original partition and disk had.

The ntfsclone utility guarantees to make an exact copy of NTFS but it will never deal with booting issues. This is by design: ntfsclone is a filesystem, not system utility. Its aim is only to clone NTFS, not to clone Windows. Therefore ntfsclone can be used as a very fast and absolutely reliable building block for Windows cloning, but itself it's not enough.

If you want to fix the booting issue then please take a look at http://winhlp.com/?q=node/66, or at the Forking an XP-installation mini-howto. An program named relocntfs which is reported to fix the booting issue is located in the contrib section.

An other method is to use GAG (graphical boot manager) after ntfsclone :

• Restore your image in the new partition.
• Download System Rescue CD image http://www.sysresccd.org and burn a CD-ROM
• Boot from CD with your System Rescue CD
• At the prompt, boot with “gag” (F2)
• Install GAG on your hard drive after selecting an icon and a name for your windows boot, and setting boot timer to 0 (if you don't want to see gag at boot)

One of the advanced features of ntfsclone is to be able to create metadata images. These images are useful for analysis rather than backup purposes, as they contain only the filesystem 'metadata' (like file attributes, sizes, and locations), but not the actual file content. Such metadata images are mountable, with all files at the exact same places/names/sizes/attributes, but without the file data.

This feature is mainly used for debugging. If you find the ntfsprogs tools or the kernel_driver behave wrongly with an NTFS volume, create such a very small, bzip2 compressed image (0.5-8 MB), in case the developers want to take a look. Images are also used for future regression testing.

In order to store only the metadata, type the following two commands on separate lines, supposed the first one doesn't give any error:

ntfsclone --metadata --output ntfsmeta.img <your_ntfs_partition>
bzip2 ntfsmeta.img

or

ntfsclone --ignore-fs-check -mo inconsistent-ntfs.img <your_ntfs_partition>
bzip2 inconsistent-ntfs.img

and send the resulting file to the developer that asked for it. Even better: make it available somewhere for download.

Please note that bzip2 is quite slow, on typical images it takes 10-60 minutes. Gzip could be used instead, as it's much faster, but it creates considerably larger files which are often more than 10 times in size. Another alternative would be the tar utility with the –sparse option, however this functionality of tar is seriously broken for over a year now, and results in absolutely unusable archives (tar 1.16.0 should be ok when it is released).

Unpacking is a bit tricky, otherwise bzip2 would create non-sparse file:

bzcat ntfsmeta.img.bz2 | cp --sparse=always /proc/self/fd/0 ntfsmeta.img

If you would like to create a large image (>4GB), be aware that some file systems can not host such large files (e.g. ext2 without large file support or fat32). Therefore, you will not be able to store the image on these file systems directly.

Instead, if you forsee that the image will be large enough (or if you cloned and failed), do:

ntfsclone --save-image -o - /dev/sda1 | split -a 3 -b 4000m -d - windows.img

That will create windows.img000, windows.img001, etc each of 4000MiB in size…

Then to restore the fragments:

cat windows.img* | ntfsclone --restore-image -O /dev/sda1 -

This will also help you to create images that are small enough to be stored on CDs, DVDs, tapes, (diskettes?!?), etc.

When you clone a partition from a disk with bad sectors to a new disk, Windows still reports bad sectors on the new disk. This is because, by design, ntfsclone copies everything, including the bad sector list.

While this is not strictly ntfsclone-related, some people may use the following procedure to reset the bad sector list after cloning:

1. Back up important data from partition just in case
2. Find out size of '$Bad' attribute in $Badclus using ntfsinfo with ntfsinfo -i 8 <partition> (partition is for example /dev/sda1). It will be the “Allocated size” value in the “Dumping attribute $DATA (0×80)” (there will be two 0×80 attributes. Only one has an “Allocated size” line).
3. Use ntfstruncate <partition> 8 0x80 '$Bad' 0 to set $Bad's attribute length to zero.
4. Use ntfstruncate <partition> 8 0x80 '$Bad' <ntfs_size> to set $Bad's attribute length back to proper value which was recorded in step 2.
5. Boot into Windows and run chkdsk. It will find errors and should fix them.

Unless you're certain that the bad clusters were just an error, It is recommended to do a full surface scan using either your hard disk manufacturer's tools or chkdsk /r after doing this.