Saturday, May 7, 2011

Hard Drive Images

We use ntfsclone in our Loader project.  I tend to use it to make backups of computers, or copy NT filesystems around between partitions etc.

The command "ntfsclone" has switches "-s" and "-r" to tell ntfsclone to save and restore in a special format.  The special format leaves out all the holes in the file system -- who would want those?  And actually, why would you use ntfsclone if you weren't using those switches?  You could just use "dd" and bit copy the whole partition.  From my point of view, there seems to be little reason to use ntfsclone if you aren't using the special format switches.

Sometimes I'd like to mount an NTFS under Linux.  Ahhh, if the NTFS is in the special format and compressed with gzip, that *IS* a problem.

ntfsclone -r -O - myfs.ntfsclone.gz | gunzip -c > myfs
sudo mount -o loop myfs /mnt

The problem here is that this takes a while and in the end you better have enough free disk space available.

I've been thinking.  If you'd like to hand someone exactly what their (XP) computer had on it before and let them browse it to pull out any important files, how would you do that?  Being on Linux, I have "mount -loop" at my disposal, but Windows users are out of luck, right?

Open source to the rescue again, even on Windows: http://en.wikipedia.org/wiki/ImDisk (their homepage isn't as nice as the wikipedia page)

I tried ImDisk out, seems to work fine.  It might be a little bit hard to use for someone that only knows about their "My Documents" but who knows.  So, you could do something like this:

ntfsresize -s 50G /dev/sda1
ntfsclone -O - /dev/sda1 | \
gunzip -c | ssh bigserver "cat > myfs"
# re-image / re-install victim
rsync bigserver:myfs /mnt/windows/myoldfs
# boot windows, install ImDisk
# mount your oldfs as disk G: for retrieving stuff

 The only trick here is resizing the original ntfs down so it's pretty much full (of files).  This ensures you aren't wasting a bunch of dead space in your image file.

No comments:

Post a Comment