Create the System Image
If you made it this far, congratulations. Most of the hard work is behind you. All that is left now is understanding how the ntfsclone tool works. ntfsclone does exactly what it sounds like: it clones the data on an NTFS partition. Unlike a tool such as the venerable dd command, ntfsclone only copies the used data on a partition, whereas dd copies every sector bit by bit. The result is that ntfsclone will create a much smaller image than dd.
Image compression is handled by an independent tool, such as gzip or bzip2. Unless you are absolutely pressed for space, I recommend using gzip for compression as it will work much faster. The beauty of Linux is that we can easily chain these commands together. Here we go.
Image creation, compression, and saving to the spare partition can all be accomplished in one fell swoop. Assuming that the Windows partition is /dev/hda1, and /mnt/hda2 is our previously-designated save location, here is an example:
# ntfsclone -s -o – /dev/hda1 | gzip -c > /mnt/hda2/name-of-image.img.gz
Here is the anatomy of the above command:
- (-s) essentially means “save to an image”
- (-o) means “output to a file”
- (-) means “clone to the standard ouput,” which is then passed to gzip
through a pipe (the vertical character “|”)
- (-c) an option passed to gzip telling it to keep the incoming file unchanged
- (>) sends all of the incoming information to the path and file that you
That’s it. Let ntfsclone work its magic. Depending on the size of your Windows image, the process may take anywhere from a few minutes to a half hour or more. For me, imaging a roughly 6 GB Windows installation took about 12 minutes.
Note: for maximal gzip compression, pass the -9 option to gzip in the above command (… gzip -c -9…). This will take a little longer, but should result in a slightly smaller image.
Restore the System Image
No backup solution is complete without verifying that the restoration process works. To restore the image that you created, simply reverse the tasks. First we need to “unzip” the compressed archive, then use ntfsclone to restore the data.
Can we do all of this in one command? Of course! Here is an example:
# gunzip -c /mnt/hda2/name-of-image.img.gz | ntfsclone -r -O /dev/hda1 –
The above command un-archives the image that you created and passes the data directly to ntfsclone, which then restores (-r) and overwrites (-O) the data on hda1. Don’t forget the trailing hyphen (-) in the above command.
I found that restoring the image took significantly less time than creating it. Easy as pie, huh? Reboot, and as long as the Master Boot Record (MBR) and partition table are undamaged, Windows should come to life.
Remote Storage Over SSH
If you have access to a remote server over SSH (if you do not know what this means, then you don’t have it), you can send your Windows image directly to the remote server during the creation process. There is no need to mount any partitions when you boot the Linux live CD. Please test your SSH connection before you proceed.
Assuming that Windows is installed on the first partition of the first hard disk, this is an example command:
# ntfsclone -s -o – /dev/hda1 | gzip -c | ssh username@server ‘cat > name-of-image.img.gz’
Notice the two “pipes” in the above command? We use ntfsclone to clone hda1, pass the data directly to gzip for compression, then pass the compressed data directly to the remote server, writing it to the name of the file that you specify. Neat, huh?
To restore the image from the remote server, simply reverse the procedures. First we will SSH into the server to retrieve the image, unzip it, and pass the resulting data to ntfsclone, all in one fell swoop.
# ssh username@server ‘cat name-of-image.img.gz’ | gunzip -c | ntfsclone -r -O /dev/hda1 –
Once again, don’t forget the trailing hyphen (-) at the end of the above command.
A note about SSH passwords: unless you are using SSH keys, the above commands will hang right after you issue them, as they will be waiting for your SSH password. Type your password, press Enter, and they should proceed as normal.