“Ghost” Your Windows System for Free Using Open-Source Tools

Benefits of Remote Backup?

I tested the SSH method in two ways:

  1. I set up my Macbook in the living room and sent the image from my office computer over wireless. The backup time was about as fast as sending the image to a spare partition.
  2. I have about 250 GB available on my 1and1 hosting plan. Since SSH is enabled, I can send the image directly to my web server.

While storing the Windows image on a spare partition may be handy, I highly recommend that you archive it elsewhere. What if your hard disk explodes, or a cat urinates on your motherboard? Hey, it could happen. Storing the image elsewhere, such as on a DVD (if it fits), on another computer in your home, or on an off-site server is handy.

While storing my Windows image on my web server sounds appealing, I am not sure that I am comfortable with the idea, unless I made that folder inaccessible to the public. Anyway, here is how you could restore directly from your web server. Use a tool like wget to grab the image, then send the data to ntfsclone.

wget -qO – http://yourserver/path/name-of-image.img.gz | ntfsclone -r -O /dev/hda1 –

Conclusions / Advanced Restoration

As you can see, a Linux “live” CD truly possesses great power. By simply chaining a few commands together, it is possible to do amazing things. Though this process is not as simple as “point and click,” it is absolutely free, extremely flexible, and requires nothing to install.

One issue that I did not cover at all is a “bare metal” restore, meaning a restoration to a completely-erased (or new) hard disk. This is possible by simply using GParted in conjunction with a few more commands. If you are interested in doing this (and you should be), you need to archive the Master Boot Record (MBR) as well as the partition table. We do this by using the aforementioned dd tool.

Saving the MBR plus primary partition table:

# dd if=/dev/hda bs=512 count=1 of=/mnt/hda2/master-hda.mbr

If you need to restore it, just reverse it:

# dd if=/mnt/hda2/master-hda.mbr of=/dev/hda

Of course, if you are restoring to a completely blank drive, you MUST have the image and the MBR file archived elsewhere, such as on a DVD or a remote server, so you will probably need to alter the restoration path of the MBR file accordingly. Once dd sets the partition table and MBR in order, you may then use GParted to format or alter any additional partitions and restore with ntfsclone as usual.

Restoring from “bare metal” is a complicated issue, but hopefully that gets you on the right track. Perhaps I will create an addendum for this article sometime soon.

If you read all the way to the end of this tutorial, here is your reward. I created a one-page cheatsheet containing all of the relevant commands. Feel free to print it and use it for your reference. 🙂

Good luck, and as always, happy backups!

— Brian Bondari
June 2007

24 thoughts on ““Ghost” Your Windows System for Free Using Open-Source Tools

  1. I’ve found that on most of the machines these days, the MBR is initially much too small. It was originally sized for earlier days when system storage was much smaller. That means you often have fragmented MBR records. Of course, nowdays, a couple of the defragmentors can put them back together.

    But, when setting up from scratch, there’s a command line to set up a larger MBR from the start. This usually results in much faster boot times and running for slower machines. It’s a two step process. Step 1 you create a new file of the desired size, and step 2, you format and specify on the command line to use this new file for the MBR. I’m not listing the commands simply because the reference to them isn’t on my computer at the moment. I have it on a backup drive. You can contact me if you need the specifics.

  2. Brian, thanks for this guide! Very instructive and easy to follow even for someone with almost no linux experience.

  3. Excellent tutorial, Brian. Although this technique is becoming pretty well-documented in “Hack” books, your presentation, along with mention of NTFSCLONE, is a valuable addition to the literature. Kudos for a valuable and freely available technique!

  4. I have been using NTFSTOOLS for about 2 years and share your opinion on the ease of use. I have tested ntfsclone on Vista–It works flawlessly. My suggestion if you are going to use this on Vista, use the latest version of ntfsclone that you can find. The resizing tools didn’t work too well, so I recommend that you use the disk manager in Vista to resize the partition and then use a Linux distro with ntfsclone.

  5. Really, kudos, Brian.
    I have just been setting up a new laptop for my aunt and don’t want nothing more and nothing less then a comfortable way to archive the fresh XP installation and application setup. And I was almost going to bind a commercial solution because I did not want to spent time to learn tweaking/building BartPE with DriveImageXML.
    🙂

  6. What about if you have multiple OS on the hard drive and wants to move all of them to a bigger hard drive?

    I currently have three OS on my 80GB hard drive and I want all three to a 250 GB HD. Right now I have the following:

    Windows 2003 Server
    Windows XP 64-Bit
    Ubuntu 6 (Feisty Fawn).

  7. In the article towards the end when talking about restoring the image you state:
    “as long as the Master Boot Record (MBR) and partition table are undamaged”.

    When you restore the image does it not restore the MBR and partition table?

  8. There’s a new livecd called clonezilla that is simple, easy to use, and combines drb. ntfsclone, udpcast, and partition image.

  9. I’ve been messing with this. I’m thinking about using some tools to get the partitions and mbr brought over to the clients via udpcast also.

    On Golden Boy
    ntfsclone -s -o – /dev/sda1 | udp-sender –max-bitrate=40M –pipe “gzip -c”

    On Clients
    udp-receiver –pipe “gzip -dc” | ntfsclone -r -O /dev/sda1 –

  10. All this is fine. But in my laptop, (HP Compaq presario AU 6000 series preloaded with Vista Home Basic) g-parted does not work. I get the first screen on boot-up from my flash drive. It offers different choices, but after that nothing works. The same thing happens with clonezilla and different other Dard disk cloning and partitioning software. Can anyone tell me why this happens? Is it because the Bios itself has been engineered to ignore any program not based on Windows?

  11. NO ! I am NOT afraid of the Command Line !

    I have done it. Using Puppy; “Ghosted” my working XP C Drive to a new partition in a harddisk connected via USB. I did not get the ultimate proof by overwriting my C Drive and seeing it re-boot. But I accepted the next best thing by checking that all the files in my C Drive are exactly showing in my ghosted partition.

    To get the final proof. I intend at a later date to open up my computer case; disconnect the cable and power of my C Drive and plug them into the ghosted harddisk. If it boots. then there is the proof.

    GParted treats every device the same; be it sda1 or sdb5 (this latter is on USB) Along as one has got the device numbers right, the imaging and restoring goes between partitions quite smoothly.

    Overall, I am well pleased/

  12. good e
    ici j utilise <>
    je stoke le ghost de la part C sur dvd-rw.
    restauration de C 5go = 25 minutes
    tink you macrium reflect free

  13. Thanks for the great tutorial. I just ran it on my new Vista Business x64 box and it worked flawlessly. 65GB of OS, Apps and Files became a 25GB image file.

    Notice that I used the partitioning tool that comes with Vista to create a storage partition (not GParted). It’s actually an amazing tool. No reboot required!

    I booted Ubuntu 9.04 live CD, mounted the secondary partition and used Brian’s commands as is (just the names changed). Creating the image probably took about 60 to 90 minutes. Restoring it took about 20 minutes.

    I look forward to using this technique frequently.

  14. This all sounds good but I’m not sure where to start.
    I figure I have to download Puppy, but do I have to find ntfs-3g, GParted and ntfsclone also. Do I put them all on the one cd to be the live cd?
    The rest of your explanation sounds clear enough, but I’m just not understanding how to get started. Thanks for the good info.

Comments are closed.