Minimizing Hard Disk Drive Failure and Data Loss/Popdisk

Cloning NTFS file systems (and others too)

Backup and restore of NTFS partitions with knoppix to/from a windows share

	Given:
Windows share is at \\192.168.2.3\y
The NTFS partitions to backup is the first partition on the primary IDE drive (hda1)

BACKUP
1. Boot from knoppix CD. 

2. Bring up a root terminal (click on little penguin at bottom left - select “root shell”) 
and create mount point:  mkdir  x

3. Mount windows share:  
mount -t smbfs //192.168.2.3/y x
or with a password:
mount -t smbfs -o username=xxxx,password=xxxx //192.168.2.3/y x

4. Move to mounted destination drive:  cd x 

5. Create partition backup:  
ntfsclone -s /dev/hda1 -o - | gzip | split -b 650m  - backup.hda1.gz

6. Back up boot sector:  dd bs=512 count=1 if=/dev/hda of=bsback.img

7. Back up partition info:  sfdisk -d /dev/hda >partitions.txt


RESTORE 
1. Boot from knoppix CD. 

2. Bring up a root terminal (click on little penguin at bottom left - select “root shell”) 
and create mount point:  mkdir  x

3. Mount windows share:  
mount -t smbfs //192.168.2.3/y x
or with a password:
mount -t smbfs -o username=scott,password=xxxx //192.168.2.3/y x

4. Move to mounted destination drive:  cd x

5. Restore boot sector:  dd count=1 bs=446 bs=if=bsback.img of=/dev/hda 
    Use "bs=446" to exclude the partition table from being written to disk, 
otherwise 512 will restore that too, but if the disk size is different, the you probably 
don't want the partition numbers restored. You can manually restore the table from the 
partitions.txt file info created in step 7 above.  
Another option, if a backup was not available, would be this command:  
      install-mbr /dev/hda 
  
  or from a dos boot disk:  fdisk /mbr

6. Restore partition:  
cat backup.hda1.gz* | gunzip -c backup.hda1.gz |ntfsclone -r -O /dev/hda1 -

Example scripts

Before making a backup, a folder can be prepared with the foldername being the hostname of the PC to backup. The backup script should be copied to the folder and customized to match the partitions to backup. Then to create a backup the share is mounted from knoppix and the user moves into the directory and executes the script. The backup is completed.

The restore script should then be copied to the directory and customized to match the partitions (like the backup script) After the backup is made, the backup script can be deleted or moved to a new folder inside the directory for reference. To restore, the same process of mounting the share - navagating to the folder - then executing the restore script will complete the restore.

Backup of sda2 (ntfs partition)

ntfsclone -s /dev/sda2 -o - | gzip | split -b 2000m - sda2.gz
dd bs=512 count=1 if=/dev/sda of=bsback.img
sfdisk -d /dev/sda >partitions_sfdisk.txt
fdisk -l >partitions_fdisk.txt

Restore of sda2 (ntfs partition, disk must be the same size as the original)

dd bs=512 count=1 if=bsback.img of=/dev/sda
sfdisk  /dev/sda < partitions_sfdisk.txt
cat sda2.gz* | gunzip -c  | ntfsclone -r -O /dev/sda2 -

Backup of linux partitions

partimage -z1 -c -d -o -b  /dev/sda1 sda1.partimage.img
partimage -z1 -c -d -o -b  /dev/sda2 sda2.partimage.img
partimage -z1 -c -d -o -b  /dev/sda4 sda4.partimage.img
dd bs=512 count=1 if=/dev/sda of=bsback.img
sfdisk -d /dev/sda >partitions_sfdisk.txt
fdisk -l >partitions_fdisk.txt

Restore of linux partitions (also re-create swap partition sda3)

dd bs=512 count=1 if=bsback.img of=/dev/sda
sfdisk  /dev/sda < partitions_sfdisk.txt
partimage -b restore  /dev/sda1 sda1.partimg.img.000
partimage -b restore  /dev/sda2 sda2.partimg.img.000  
mkswap /dev/sda3
partimage -b restore  /dev/sda4 sda4.partimg.img.000

Note: Fat32 and other partition types can also be backed up efficiently using partimage. NTFS is one partition type that partimage does not work well with yet (AFAIK), therefore ntfsclone is used above.

Limitations

• Can only restore to the same size disk, because of the dd and sfdisk method of restoring the master boot record and partitions. There are some ways to overcome this limitation but I have not tested and fine tuned them yet.
• When restoring a complete linux system, the grub config may have to be adjusted to point to the partitions by number, instead of by name, which many newer linux distributions tend to do nowdays.

Other Thoughts - Wish list

• The scripts will work on other destination types besides windows shares. That is the beauty of using knoppix type boot disks. Maybe some howtos on mounting file systems would be in order here. Live linux CDs can mount at least the following File systems... to send the backups to:
  • Local partitions (NTFS,FAT32,EXT2,EXT3 are the main ones)
  • USB drives
  • NFS shares
• Would like to create a script generator, that examines the local disks and interactively creates a backup and restore script to match. This will be fun and maybe very useful :)
• Create some scripts to backup to a local CD/DVD drive, and make them bootable.
• create a stripped down, fast booting live linux CD that only has the tools for disk imaging

Misc. Tips

Reseting the bad sectors list after cloning

When you clone a partition from a disk with bad sectors to a new disk, Windows still reports bad sectors on the new disk. This is because, by design, ntfsclone copies everything, including the bad sector list.

While this is not strictly ntfsclone-related, some people may use the following procedure to reset the bad sector list after cloning:

1. Back up important data from partition just in case
2. Find out size of '$Bad' attribute in $Badclus using ntfsinfo with ntfsinfo -i 8 <partition>. It will be the “Allocated size” value in the “Dumping attribute $DATA (0×80)” (there will be two 0×80 attributes. Only one has an “Allocated size” line).
3. Use ntfstruncate <partition> 8 0x80 '$Bad' 0 to set $Bad's attribute length to zero.
4. Use ntfstruncate <partition> 8 0x80 '$Bad' <ntfs_size> to set $Bad's attribute length back to proper value which was recorded in step 2.
5. Boot into Windows and run chkdsk. It will find errors and should fix them.

Unless you're certain that the bad clusters were just an error, It is recommended to do a full surface scan using either your hard disk manufacturer's tools or chkdsk /r after doing this. This paragraph copied from http://www.linux-ntfs.org/doku.php?id=ntfsclone

Further reading

• UNIX Computing Security/Data security