“Ghost” Your Windows System for Free Using Open-Source Tools

The following tutorial is intended for those with some knowledge of Linux and the command line. At the least, you should be comfortable with creating and navigating directories, and should possess a fundamental knowledge of hardware device names under Linux.

Sound scary? A “point-and-click” guide to accomplishing most of the same tasks is also available.

The Problem

Like it or not, Windows needs to be reinstalled occasionally. Whether the cause is a bloated registry, a virus/spyware attack, or an idiotic user, with time Windows just seems to slow down and/or behave erratically.

Re-installing Windows from scratch is a pain. Once you get the base system installed, most people have to download millions of updates and patches, scour the web in search of the latest drivers, and reboot, reboot, reboot.

The Solution

Once you get your Windows system installed and configured the way YOU want it, you should be able to restore to that pristine state in a matter of minutes, not hours. The way to do this is to create an “image” of your freshly-installed system, from which you can later restore when necessary. Of course, there are a number of commercial packages available to do this task, but what if you do not want to spend any money?

Linux and open-source software to the rescue. Yes, you can quickly, and (dare I say) easily image and restore a Windows system using open-source tools. Before we begin, please back up any critical data. This procedure worked for me, but I am not responsible for any data loss.

The Main Tools

Repeat after me: “I am NOT afraid of the Command Line!”

The open-source tools that we are going to use are:

  • ntfs-3g – a driver for NTFS
  • GParted – a partition editor
  • ntfsclone – exactly what it sounds like
  • a Linux “live” CD

In order to restore Windows, you need to run from a different working environment, such as a Linux “live” CD. Any Linux “live” CD with the above tools will work, but two available options are SystemRescueCD and Puppy Linux. Both allow you to boot and run entirely in RAM, freeing your CD/DVD burner for any additional tasks that you might need. I successfully completed all of the tasks detailed below using both Puppy and SystemRescueCD. Just grab the latest version of whichever you prefer.puppy-logo.gif

Note: If you use SystemRescueCD, I recommend typing docache doeject at the boot prompt. These two options will load the entire rescue environment into RAM and then eject the CD afterwards. Puppy Linux, on the other hand, loads into RAM by default. The rest of this tutorial will use Puppy Linux, though the commands can easily be issued from any live CD that contains the above tools.

Before you can image and restore your system, you need to consider a few things:

  1. ntfsclone cannot (yet) easily restore an image to a partition smaller than the size of the original partition. Thus, if you clone a 120 GB partition with only 20 GB used, you must restore to a partition size of at least 120 GB. There is a fairly-easy way around this. Keep reading.
  2. Where are you going to store your newly-created image? I recommend storing it on a separate partition or on a separate server (using SSH). I will walk you through both of these methods.
  3. Gloriously, the ntfs-3g driver provides full NTFS read/write support! I did not encounter any problems manipulating NTFS on either Windows 2000 or XP. This procedure should work for Vista, but since I do not own it, so I cannot test it.

The entire process in a nutshell:

  1. Boot into the “live” CD.
  2. Make room for a new partition (recommended, but optional).
  3. Make directories and mount (not applicable for SSH).
  4. Create the image.
  5. Restore the image.
  6. Using SSH (optional)
  7. Conclusion / Advanced Restoration.

24 thoughts on ““Ghost” Your Windows System for Free Using Open-Source Tools

  1. I’ve found that on most of the machines these days, the MBR is initially much too small. It was originally sized for earlier days when system storage was much smaller. That means you often have fragmented MBR records. Of course, nowdays, a couple of the defragmentors can put them back together.

    But, when setting up from scratch, there’s a command line to set up a larger MBR from the start. This usually results in much faster boot times and running for slower machines. It’s a two step process. Step 1 you create a new file of the desired size, and step 2, you format and specify on the command line to use this new file for the MBR. I’m not listing the commands simply because the reference to them isn’t on my computer at the moment. I have it on a backup drive. You can contact me if you need the specifics.

  2. Brian, thanks for this guide! Very instructive and easy to follow even for someone with almost no linux experience.

  3. Excellent tutorial, Brian. Although this technique is becoming pretty well-documented in “Hack” books, your presentation, along with mention of NTFSCLONE, is a valuable addition to the literature. Kudos for a valuable and freely available technique!

  4. I have been using NTFSTOOLS for about 2 years and share your opinion on the ease of use. I have tested ntfsclone on Vista–It works flawlessly. My suggestion if you are going to use this on Vista, use the latest version of ntfsclone that you can find. The resizing tools didn’t work too well, so I recommend that you use the disk manager in Vista to resize the partition and then use a Linux distro with ntfsclone.

  5. Really, kudos, Brian.
    I have just been setting up a new laptop for my aunt and don’t want nothing more and nothing less then a comfortable way to archive the fresh XP installation and application setup. And I was almost going to bind a commercial solution because I did not want to spent time to learn tweaking/building BartPE with DriveImageXML.

  6. What about if you have multiple OS on the hard drive and wants to move all of them to a bigger hard drive?

    I currently have three OS on my 80GB hard drive and I want all three to a 250 GB HD. Right now I have the following:

    Windows 2003 Server
    Windows XP 64-Bit
    Ubuntu 6 (Feisty Fawn).

  7. In the article towards the end when talking about restoring the image you state:
    “as long as the Master Boot Record (MBR) and partition table are undamaged”.

    When you restore the image does it not restore the MBR and partition table?

  8. There’s a new livecd called clonezilla that is simple, easy to use, and combines drb. ntfsclone, udpcast, and partition image.

  9. I’ve been messing with this. I’m thinking about using some tools to get the partitions and mbr brought over to the clients via udpcast also.

    On Golden Boy
    ntfsclone -s -o – /dev/sda1 | udp-sender –max-bitrate=40M –pipe “gzip -c”

    On Clients
    udp-receiver –pipe “gzip -dc” | ntfsclone -r -O /dev/sda1 –

  10. All this is fine. But in my laptop, (HP Compaq presario AU 6000 series preloaded with Vista Home Basic) g-parted does not work. I get the first screen on boot-up from my flash drive. It offers different choices, but after that nothing works. The same thing happens with clonezilla and different other Dard disk cloning and partitioning software. Can anyone tell me why this happens? Is it because the Bios itself has been engineered to ignore any program not based on Windows?

  11. NO ! I am NOT afraid of the Command Line !

    I have done it. Using Puppy; “Ghosted” my working XP C Drive to a new partition in a harddisk connected via USB. I did not get the ultimate proof by overwriting my C Drive and seeing it re-boot. But I accepted the next best thing by checking that all the files in my C Drive are exactly showing in my ghosted partition.

    To get the final proof. I intend at a later date to open up my computer case; disconnect the cable and power of my C Drive and plug them into the ghosted harddisk. If it boots. then there is the proof.

    GParted treats every device the same; be it sda1 or sdb5 (this latter is on USB) Along as one has got the device numbers right, the imaging and restoring goes between partitions quite smoothly.

    Overall, I am well pleased/

  12. good e
    ici j utilise <>
    je stoke le ghost de la part C sur dvd-rw.
    restauration de C 5go = 25 minutes
    tink you macrium reflect free

  13. Thanks for the great tutorial. I just ran it on my new Vista Business x64 box and it worked flawlessly. 65GB of OS, Apps and Files became a 25GB image file.

    Notice that I used the partitioning tool that comes with Vista to create a storage partition (not GParted). It’s actually an amazing tool. No reboot required!

    I booted Ubuntu 9.04 live CD, mounted the secondary partition and used Brian’s commands as is (just the names changed). Creating the image probably took about 60 to 90 minutes. Restoring it took about 20 minutes.

    I look forward to using this technique frequently.

  14. This all sounds good but I’m not sure where to start.
    I figure I have to download Puppy, but do I have to find ntfs-3g, GParted and ntfsclone also. Do I put them all on the one cd to be the live cd?
    The rest of your explanation sounds clear enough, but I’m just not understanding how to get started. Thanks for the good info.

Comments are closed.