ntfsclone


SYNOPSIS
       ntfsclone [OPTIONS] SOURCE
       ntfsclone --save-image [OPTIONS] SOURCE
       ntfsclone --restore-image [OPTIONS] SOURCE
       ntfsclone --metadata [OPTIONS] SOURCE

DESCRIPTION
       ntfsclone  will efficiently clone (copy, save, backup, restore) or res-
       cue an NTFS filesystem to a sparse file, image, device  (partition)  or
       standard  output.   It  works  at disk sector level and copies only the
       used data. Unused disk space becomes zero  (cloning  to  sparse  file),
       encoded  with  control  codes  (saving  in  special image format), left
       unchanged (cloning to a disk/partition) or filled with  zeros  (cloning
       to standard output).

       ntfsclone  can  be useful to make backups, an exact snapshot of an NTFS
       filesystem and restore it later on, or  for  developers  to  test  NTFS
       read/write  functionality, troubleshoot/investigate users' issues using
       the clone without the risk of destroying the original filesystem.

       The clone, if not using the special image format, is an exact  copy  of
       the  original NTFS filesystem from sector to sector thus it can be also
       mounted just like the original NTFS filesystem.   For  example  if  you
       clone  to  a  file  and the kernel has loopback device and NTFS support
       then the file can be mounted as

              mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone


   Windows Cloning
       If you want to copy, move or restore a  system  or  boot  partition  to
       another computer, or to a different disk or partition (e.g. hda1->hda2,
       hda1->hdb1 or to a different disk sector offset) then you will need  to
       take extra care.

       Usually,  Windows  will  not  be able to boot, unless you copy, move or
       restore NTFS to the same partition which starts at the same  sector  on
       the  same  type of disk having the same BIOS legacy cylinder setting as
       the original partition and disk had.

       The ntfsclone utility guarantees to make an exact copy of NTFS  but  it
       won't  deal  with  booting  issues.  This  is by design: ntfsclone is a
       filesystem, not system utility. Its aim is only NTFS cloning, not  Win-
       dows  cloning. Hereby ntfsclone can be used as a very fast and reliable
       build block for Windows cloning but itself it's not enough.

   Sparse Files
       A file is sparse if it has unallocated  blocks  (holes).  The  reported
       size  of  such  files are always higher than the disk space consumed by
       them.  The du command can tell the real disk space  used  by  a  sparse
       file.   The  holes are always read as zeros. All major Linux filesystem
       like, ext2, ext3, reiserfs, Reiser4, JFS and XFS, supports sparse files
       but for example the ISO 9600 CD-ROM filesystem doesn't.
       files  efficiently  during uncompression from disk space usage point of
       view.

       At present the most efficient way, both speed and space-wise,  to  com-
       press  and uncompress large sparse files by common tools would be using
       tar(1) with the options -S (handle sparse files "efficiently")  and  -j
       (filter the archive through bzip2). Although tar still reads and analy-
       ses the entire file, it doesn't pass on the large  data  blocks  having
       only  zeros to filters and it also avoids writing large amount of zeros
       to the disk needlessly. But since tar can't create an archive from  the
       standard  input,  you  can't do this in-place by just reading ntfsclone
       standard output. Even more sadly, using the -S option  results  serious
       data  loss  since  the  end  of 2004 and the GNU tar maintainers didn't
       release fixed versions until the present day.

   The Special Image Format
       It's also possible, actually it's recommended, to save an NTFS filesys-
       tem  to  a  special  image format.  Instead of representing unallocated
       blocks as holes, they are encoded using control codes. Thus, the  image
       saves  space without requiring sparse file support. The image format is
       ideal for streaming filesystem images over the network and similar, and
       can be used as a replacement for Ghost or Partition Image if it is com-
       bined with other tools. The downside is that you can't mount the  image
       directly, you need to restore it first.

       To  save  an  image  using  the special image format, use the -s or the
       --save-image  option.  To  restore  an  image,  use  the  -r   or   the
       --restore-image  option. Note that you can restore images from standard
       input by using '-' as the SOURCE file.

   Metadata-only Cloning
       One of the features of ntfsclone is that, it can  also  save  only  the
       NTFS  metadata  using  the  option -m or --metadata and the clone still
       will be mountable. In this case all non-metadata file content  will  be
       lost and reading them back will result always zeros.

       The  metadata-only  image  can  be compressed very well, usually to not
       more than 1-8 MB thus it's easy to transfer  for  investigation,  trou-
       bleshooting.

       In  this mode of ntfsclone, NONE of the user's data is saved, including
       the resident user's data embedded into metadata.  All  is  filled  with
       zeros.   Moreover  all  the  file timestamps, deleted and unused spaces
       inside the metadata are filled with zeros. Thus this mode  is  inappro-
       priate  for  example  for forensic analyses.  This mode may be combined
       with --save-image to create a special image format file  instead  of  a
       sparse file.

       Please  note, filenames are not wiped out. They might contain sensitive
       information, so think twice before sending such an image to anybody.

OPTIONS
       Below is a summary of all the options that ntfsclone  accepts.   Nearly
       all options have two equivalent names.  The short name is preceded by -
       -s, --save-image
              Save to the special image format. This is the most efficient way
              space  and speed-wise if imaging is done to the standard output,
              e.g. for image compression, encryption or  streaming  through  a
              network.

       -r, --restore-image
              Restore  from the special image format specified by SOURCE argu-
              ment. If the SOURCE is '-' then the image is read from the stan-
              dard input.

       --rescue
              Ignore  disk read errors so disks having bad sectors, e.g. dying
              disks, can be rescued the most  efficiently  way,  with  minimal
              stress  on  them. Ntfsclone works at the lowest, sector level in
              this mode too thus more data can be rescued.   The  contents  of
              the  unreadable  sectors  are  filled  by  character '?' and the
              beginning of such sectors are marked by "BadSectoR\0".

       -m, --metadata
              Clone ONLY METADATA  (for  NTFS  experts).  Only  cloning  to  a
              (sparse) file is allowed, unless used the option --save-image is
              also used.  You can't metadata-only clone to a device.

       --ignore-fs-check
              Ignore the result of  the  filesystem  consistency  check.  This
              option  is  allowed  to be used only with the --metadata option,
              for the safety of user's data.  The  clusters  which  cause  the
              inconsistency are saved too.

       -t, --preserve-timestamps
              Do  not wipe the timestamps, to be used only with the --metadata
              option.



       --new-serial, or

       --new-half-serial
              Set a new random serial number to the clone. The  serial  number
              is a 64 bit number used to identify the device during the mount-
              ing process, so it has to be changed to enable the original file
              system  and the clone to be mounted at the same time on the same
              computer.

              The option --new-half-serial only changes the upper part of  the
              serial  number,  keeping the lower part which is used by Windows
              unchanged.

              The options --new-serial and --new-half-serial can only be  used
              when cloning a file system of restoring from an image.

              The  serial  number  is  not  the volume UUID used by Windows to
              locate files which have been moved to another volume.

EXIT CODES
       The exit code is 0 on success, non-zero otherwise.

EXAMPLES
       Clone NTFS on /dev/hda1 to /dev/hdc1:

              ntfsclone --overwrite /dev/hdc1 /dev/hda1

       Save an NTFS to a file in the special image format:

              ntfsclone --save-image --output backup.img /dev/hda1

       Restore an NTFS from a special image file to its original partition:

              ntfsclone --restore-image --overwrite /dev/hda1 backup.img

       Save an NTFS into a compressed image file:

              ntfsclone --save-image -o - /dev/hda1 | gzip -c > backup.img.gz

       Restore an NTFS volume from a compressed image file:

              gunzip -c backup.img.gz | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Backup  an  NTFS  volume to a remote host, using ssh. Please note, that
       ssh may ask for a password!

              ntfsclone --save-image --output - /dev/hda1 | \
              gzip -c | ssh host 'cat > backup.img.gz'

       Restore an NTFS volume from a remote host via ssh.  Please  note,  that
       ssh may ask for a password!

              ssh host 'cat backup.img.gz' | gunzip -c | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Stream an image file from a web server and restore it to a partition:

              wget -qO - http://server/backup.img | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Clone an NTFS volume to a non-existent file:

              ntfsclone --output ntfs-clone.img /dev/hda1

       Pack  NTFS  metadata for NTFS experts. Please note that bzip2 runs very
       long but results usually at least 10 times smaller archives  than  gzip
       on a sparse file.

              ntfsclone --metadata --output ntfsmeta.img /dev/hda1
              bzip2 ntfsmeta.img

              Or, outputting to a compressed image :

       Sometimes  it  might appear ntfsclone froze if the clone is on ReiserFS
       and even CTRL-C won't stop it. This is not a bug in ntfsclone,  however
       it's  due to ReiserFS being extremely inefficient creating large sparse
       files and not handling signals during  this  operation.  This  ReiserFS
       problem  was  improved  in kernel 2.4.22.  XFS, JFS and ext3 don't have
       this problem.

AUTHORS
       ntfsclone was written by Szabolcs Szakacsits  with  contributions  from
       Per Olofsson (special image format support) and Anton Altaparmakov.  It
       was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.

AVAILABILITY
       ntfsclone is part of the ntfs-3g package and is available at:
       http://www.tuxera.com/community/

SEE ALSO
       ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)



ntfs-3g 2012.1.15AR.1            February 2006                    NTFSCLONE(8)
Man Pages Copyright Respective Owners. Site Copyright (C) 1994 - 2017 Hurricane Electric. All Rights Reserved.