“Ghost” Your Windows System for Free Using Open-Source Tools


Loading Puppy:

Burn the ISO as an “image” and boot from the CD. You will then have to navigate options for language, X.org, and screen resolution. Most people can just push Enter three times, resulting in a 1024×768 setup, which is perfectly sufficient. You may then eject the CD if you desire. Booting Puppy Linux on my system took only about two minutes.

If you would like network access (required if you want to use SSH), click on the Connect icon. Puppy should (hopefully) find your network module. Select your network card (eth0 in most cases), and configure with Auto DHCP (most cases). If you have a static IP address, you will need to enter that information manually. Once configured, you should have a networking icon in the system tray (see screenshot).


Make Room for the New Partition

If you don’t care about the size of the original partition and just want to store your system image directly on another server with SSH, you may safely skip this section.

Now that you are running from CD, let’s make room for the system image. As I mentioned previously, ntfsclone cannot easily restore an image to a smaller partition than the original. One solution here is to resize your original partition before you create the image. For instance, if you have a 200 GB drive with only 25 GB used, shrink your partition to something more manageable (maybe 40 – 50 GB), and allocate the remaining portion as a separate partition for storage.

Of course, I cannot cover every possible partition scheme, but I assume that many readers of this article have their entire hard disk dedicated to Windows, formatted as NTFS. In that case, I suggest shrinking that partition down to a manageable size, and designating the remainder as a separate NTFS partition.

Resizing a partition is easy, and can be done completely with a graphical interface using GParted. To launch it, go to the Puppy menu, then System, and then choose GParted. Once GParted has opened, select the Windows partition and click Resize/Move. Drag the right side of the original partition to the left, thus shrinking it to your designated size. In the unallocated space, create a new partition and format it using the filesystem of your choice. Note: if you suspect that your system image will be quite large, I do NOT recommend FAT32, since it has a 4 GB file size limit. Yes, you can split the image into 4 GB chunks, but this increases the complexity. If you just plan to use Windows on your machine, NTFS is a fine choice.

In my case, I resized a 40 GB drive with one NTFS partition into two NTFS partitions, ending up with something like this (see screenshot).


Once you have resized and created your partition scheme, click Apply, and let GParted go to work. Depending on the size of your disk and the speed of your processor, this task may take an hour or more. Go make a cup of coffee or something.

If you want to verify that Windows still works when GParted is finished, feel free to reboot afterward. Windows will scan the disk for errors, but should come alive when finished. If all is well, breathe a sigh of relief and boot your Linux live CD again.

Make Directories and Mount

Once again, if you just want to store your system image directly on another server with SSH, you may safely skip this section.

Now we need to mount the newly-created partition. First, we need to specify the folder where it will be mounted. GParted should tell you the name of the spare partition that you just created. If it is the second partition on the first hard drive, the name is likely hda2. If you are using a SATA hard disk, the spare partition is probably named sda2. Whichever it is, remember it, and adjust it accordingly in the steps below. DO NOT MOUNT THE PARTITION THAT CONTAINS WINDOWS.

Using a Terminal, create a directory inside /mnt where you will mount the spare partition. I will use hda2 as the directory name.

# mkdir /mnt/hda2

Assuming your spare partition is formatted as NTFS, let’s mount it using the ntfs-3g driver.

# ntfs-3g /dev/hda2 /mnt/hda2

The above command tells the system, “Using ntfs-3g, mount the second partition of the first hard drive into the folder /mnt/hda2.” Adjust your commands as needed.

Still with me? Good! Now we get to the fun part: Creating our image.

24 thoughts on ““Ghost” Your Windows System for Free Using Open-Source Tools

  1. I’ve found that on most of the machines these days, the MBR is initially much too small. It was originally sized for earlier days when system storage was much smaller. That means you often have fragmented MBR records. Of course, nowdays, a couple of the defragmentors can put them back together.

    But, when setting up from scratch, there’s a command line to set up a larger MBR from the start. This usually results in much faster boot times and running for slower machines. It’s a two step process. Step 1 you create a new file of the desired size, and step 2, you format and specify on the command line to use this new file for the MBR. I’m not listing the commands simply because the reference to them isn’t on my computer at the moment. I have it on a backup drive. You can contact me if you need the specifics.

  2. Brian, thanks for this guide! Very instructive and easy to follow even for someone with almost no linux experience.

  3. Excellent tutorial, Brian. Although this technique is becoming pretty well-documented in “Hack” books, your presentation, along with mention of NTFSCLONE, is a valuable addition to the literature. Kudos for a valuable and freely available technique!

  4. I have been using NTFSTOOLS for about 2 years and share your opinion on the ease of use. I have tested ntfsclone on Vista–It works flawlessly. My suggestion if you are going to use this on Vista, use the latest version of ntfsclone that you can find. The resizing tools didn’t work too well, so I recommend that you use the disk manager in Vista to resize the partition and then use a Linux distro with ntfsclone.

  5. Really, kudos, Brian.
    I have just been setting up a new laptop for my aunt and don’t want nothing more and nothing less then a comfortable way to archive the fresh XP installation and application setup. And I was almost going to bind a commercial solution because I did not want to spent time to learn tweaking/building BartPE with DriveImageXML.

  6. What about if you have multiple OS on the hard drive and wants to move all of them to a bigger hard drive?

    I currently have three OS on my 80GB hard drive and I want all three to a 250 GB HD. Right now I have the following:

    Windows 2003 Server
    Windows XP 64-Bit
    Ubuntu 6 (Feisty Fawn).

  7. In the article towards the end when talking about restoring the image you state:
    “as long as the Master Boot Record (MBR) and partition table are undamaged”.

    When you restore the image does it not restore the MBR and partition table?

  8. There’s a new livecd called clonezilla that is simple, easy to use, and combines drb. ntfsclone, udpcast, and partition image.

  9. I’ve been messing with this. I’m thinking about using some tools to get the partitions and mbr brought over to the clients via udpcast also.

    On Golden Boy
    ntfsclone -s -o – /dev/sda1 | udp-sender –max-bitrate=40M –pipe “gzip -c”

    On Clients
    udp-receiver –pipe “gzip -dc” | ntfsclone -r -O /dev/sda1 –

  10. All this is fine. But in my laptop, (HP Compaq presario AU 6000 series preloaded with Vista Home Basic) g-parted does not work. I get the first screen on boot-up from my flash drive. It offers different choices, but after that nothing works. The same thing happens with clonezilla and different other Dard disk cloning and partitioning software. Can anyone tell me why this happens? Is it because the Bios itself has been engineered to ignore any program not based on Windows?

  11. NO ! I am NOT afraid of the Command Line !

    I have done it. Using Puppy; “Ghosted” my working XP C Drive to a new partition in a harddisk connected via USB. I did not get the ultimate proof by overwriting my C Drive and seeing it re-boot. But I accepted the next best thing by checking that all the files in my C Drive are exactly showing in my ghosted partition.

    To get the final proof. I intend at a later date to open up my computer case; disconnect the cable and power of my C Drive and plug them into the ghosted harddisk. If it boots. then there is the proof.

    GParted treats every device the same; be it sda1 or sdb5 (this latter is on USB) Along as one has got the device numbers right, the imaging and restoring goes between partitions quite smoothly.

    Overall, I am well pleased/

  12. good e
    ici j utilise <>
    je stoke le ghost de la part C sur dvd-rw.
    restauration de C 5go = 25 minutes
    tink you macrium reflect free

  13. Thanks for the great tutorial. I just ran it on my new Vista Business x64 box and it worked flawlessly. 65GB of OS, Apps and Files became a 25GB image file.

    Notice that I used the partitioning tool that comes with Vista to create a storage partition (not GParted). It’s actually an amazing tool. No reboot required!

    I booted Ubuntu 9.04 live CD, mounted the secondary partition and used Brian’s commands as is (just the names changed). Creating the image probably took about 60 to 90 minutes. Restoring it took about 20 minutes.

    I look forward to using this technique frequently.

  14. This all sounds good but I’m not sure where to start.
    I figure I have to download Puppy, but do I have to find ntfs-3g, GParted and ntfsclone also. Do I put them all on the one cd to be the live cd?
    The rest of your explanation sounds clear enough, but I’m just not understanding how to get started. Thanks for the good info.

Comments are closed.