Provided by: ntfsprogs_1.12.1-1_i386 bug


       ntfsclone - Efficiently clone, image, restore or rescue an NTFS


       ntfsclone [OPTIONS] SOURCE
       ntfsclone --save-image [OPTIONS] SOURCE
       ntfsclone --restore-image [OPTIONS] SOURCE
       ntfsclone --metadata [OPTIONS] SOURCE


       ntfsclone  will  efficiently  clone  (copy,  save,  backup, restore) or
       rescue an NTFS filesystem to a sparse file, image,  device  (partition)
       or  standard output.  It works at disk sector level and copies only the
       used data. Unused disk space becomes zero  (cloning  to  sparse  file),
       encoded  with  control  codes  (saving  in  special image format), left
       unchanged (cloning to a disk/partition) or filled with  zeros  (cloning
       to standard output).

       ntfsclone  can  be useful to make backups, an exact snapshot of an NTFS
       filesystem and restore it later on, or  for  developers  to  test  NTFS
       read/write  functionality, troubleshoot/investigate users’ issues using
       the clone without the risk of destroying the original filesystem.

       The clone, if not using the special image format, is an exact  copy  of
       the  original NTFS filesystem from sector to sector thus it can be also
       mounted just like the original NTFS filesystem.   For  example  if  you
       clone  to  a  file  and the kernel has loopback device and NTFS support
       then the file can be mounted as

              mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone


       A file is sparse if it has unallocated  blocks  (holes).  The  reported
       size  of  such  files are always higher than the disk space consumed by
       them.  The du command can tell the real disk space  used  by  a  sparse
       file.   The  holes are always read as zeros. All major Linux filesystem
       like, ext2, ext3, reiserfs, Reiser4, JFS and XFS, supports sparse files
       but for example the ISO 9600 CD-ROM filesystem doesn’t.


       As  of  today  Linux provides inadequate support for managing (tar, cp,
       gzip, gunzip, bzip2, bunzip2, cat, etc) large sparse files.   The  only
       main Linux filesystem having support for efficient sparse file handling
       is XFS by the XFS_IOC_GETBMAPX  ioctl.   However  none  of  the  common
       utilities supports it.  This means when you tar, cp, gzip, bzip2, etc a
       large sparse file they will always read the entire file,  even  if  you
       use the "sparse support" options.

       bzip2  compresses  large sparse files much better than gzip but it does
       so also much slower. Moreover neither  of  them  handles  large  sparse
       files  efficiently  during uncompression from disk space usage point of

       At present the most  efficient  way,  both  speed  and  space-wise,  to
       compress and uncompress large sparse files by common tools is using tar
       with the options -S (handle sparse files "efficiently") and -j  (filter
       the  archive  through bzip2). Although tar still reads and analyses the
       entire file, it doesn’t pass on the large data blocks having only zeros
       to filters and it also avoids writing large amount of zeros to the disk
       needlessly. But since tar can’t create an  archive  from  the  standard
       input,  you  can’t  do this in-place by just reading ntfsclone standard


       It’s  also  possible,  actually  it’s  recommended,  to  save  an  NTFS
       filesystem   to  a  special  image  format.   Instead  of  representing
       unallocated blocks as holes, they  are  encoded  using  control  codes.
       Thus,  the image saves space without requiring sparse file support. The
       image format is ideal for streaming filesystem images over the  network
       and  similar,  and  can be used as a replacement for Ghost or Partition
       Image if it is combined with other tools.  The  downside  is  that  you
       can’t mount the image directly, you need to restore it first.

       To  save  an  image  using  the special image format, use the -s or the
       --save-image  option.  To  restore  an  image,  use  the  -r   or   the
       --restore-image  option. Note that you can restore images from standard
       input by using ’-’ as the SOURCE file.


       One of the features of ntfsclone is that, it can  also  save  only  the
       NTFS  metadata  using  the  option -m or --metadata and the clone still
       will be mountable. In this case all non-metadata file content  will  be
       lost and reading them back will result always zeros.

       The  metadata-only  image  can  be compressed very well, usually to not
       more  than  1-3  MB  thus  it’s  relatively  easy   to   transfer   for
       investigation, troubleshooting.

       In  this mode of ntfsclone, NONE of the user’s data is saved, including
       the resident user’s data embedded into metadata.  All  is  filled  with
       zeros.   Moreover  all  the  file timestamps, deleted and unused spaces
       inside  the  metadata  are  filled  with  zeros.  Thus  this  mode   is
       inappropriate for example for forensic analyses.

       Please  note, filenames are not wiped out. They might contain sensitive
       information, so think twice before sending such an image to anybody.


       Below is a summary of all the  options  that  ntfsclone  accepts.   All
       options have two equivalent names.  The short name is preceded by - and
       the long name is preceded by --.  Any single letter options, that don’t
       take  an  argument, can be combined into a single command, e.g.  -fm is
       equivalent to -f -m.

       -o, --output FILE
              Clone NTFS to the non-existent FILE. If FILE is ’-’  then  clone
              to the standard output.

       -O, --overwrite FILE
              Clone NTFS to FILE, overwriting if exists.

       -s, --save-image
              Save to the special image format. This is the most efficient way
              space and speed-wise if imaging is done to the standard  output,
              e.g.  for  image  compression, encryption or streaming through a

       -r, --restore-image
              Restore from the special image format specified by  SOURCE.   If
              the  SOURCE  is  ’-’  then  the  image is read from the standard

              Ignore disk read errors so disks having bad sectors, e.g.  dying
              disks,  can  be  rescued  the most efficiently way, with minimal
              stress on them. Ntfsclone works at the lowest, sector  level  in
              this  mode  too  thus more data can be rescued.  The contents of
              the unreadable sectors are  filled  by  character  ’?’  and  the
              beginning of such sectors are marked by "BadSectoR\0".

       -m, --metadata
              Clone ONLY METADATA (for NTFS experts). Moreover only cloning to
              a file is allowed.  You can’t metadata-only clone to  a  device,
              image or standard output.

              Ignore  the  result  of  the  filesystem consistency check. This
              option is allowed to be used only with  the  --metadata  option,
              for  the  safety  of  user’s  data. The clusters which cause the
              inconsistency are saved too.

       -f, --force
              Forces ntfsclone to proceed if the filesystem is marked  "dirty"
              for consistency check.

       -h, --help
              Show a list of options with a brief description of each one.


       The exit code is 0 on success, non-zero otherwise.


       Save an NTFS to a file in the special image format

              ntfsclone --save-image --output backup.img /dev/hda1

       Restore an NTFS from a special image file to its original partition

              ntfsclone --restore-image --overwrite /dev/hda1 backup.img

       Save an NTFS into a compressed image.

              ntfsclone --save-image -o - /dev/hda1 | gzip -c > backup.img.gz

       Restore an NTFS volume from a compressed image file

              gunzip -c backup.img.gz | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Backup an NTFS volume to a remote host, using ssh.

              ntfsclone --save-image --output - /dev/hda1 | \
              gzip -c | ssh hostcat > backup.img.gz’

       Restore an NTFS volume from a remote host via ssh.

              ssh hostcat backup.img.gz| gunzip -c | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Stream an image from a web server and restore it to a partition

              wget -qO - http://server/backup.img | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Clone an NTFS volume to a non-existent file

              ntfsclone --output ntfs-clone.img /dev/hda1

       Pack NTFS metadata for NTFS experts

              ntfsclone --metadata --output ntfsmeta.img /dev/hda1
              tar -cjSf ntfsmeta.img.tar.bz2 ntfsmeta.img


       This  program  has  no known bugs. If you think you have found one then
       please send an email to <>.

       Sometimes it might appear ntfsclone froze if the clone is  on  ReiserFS
       and  even CTRL-C won’t stop it. This is not a bug in ntfsclone, however
       it’s due to ReiserFS being extremely inefficient creating large  sparse
       files  and  not  handling  signals during this operation. This ReiserFS
       problem was improved in kernel 2.4.22.  XFS, JFS and  ext3  don’t  have
       this problem.


       ntfsclone was written by Szabolcs Szakacsits <>.

       Special    image   format   support   was   added   by   Per   Olofsson


       ntfsclone is part of the ntfsprogs package and is available from


       ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)