jammy (8) ntfsclone.8.gz

Provided by: ntfs-3g_2021.8.22-3ubuntu1.2_amd64 bug

NAME

       ntfsclone - Efficiently clone, image, restore or rescue an NTFS

SYNOPSIS

       ntfsclone [OPTIONS] SOURCE
       ntfsclone --save-image [OPTIONS] SOURCE
       ntfsclone --restore-image [OPTIONS] SOURCE
       ntfsclone --metadata [OPTIONS] SOURCE

DESCRIPTION

       ntfsclone  will  efficiently clone (copy, save, backup, restore) or rescue an NTFS filesystem to a sparse
       file, image, device (partition) or standard output.  It works at disk sector level and  copies  only  the
       used data. Unused disk space becomes zero (cloning to sparse file), encoded with control codes (saving in
       special image format), left unchanged (cloning to a disk/partition) or  filled  with  zeros  (cloning  to
       standard output).

       ntfsclone can be useful to make backups, an exact snapshot of an NTFS filesystem and restore it later on,
       or for developers to test NTFS read/write functionality, troubleshoot/investigate users' issues using the
       clone without the risk of destroying the original filesystem.

       The  clone,  if not using the special image format, is an exact copy of the original NTFS filesystem from
       sector to sector thus it can be also mounted just like the original NTFS filesystem.  For example if  you
       clone to a file and the kernel has loopback device and NTFS support then the file can be mounted as

              mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone

   Windows Cloning
       If  you  want  to copy, move or restore a system or boot partition to another computer, or to a different
       disk or partition (e.g. hda1->hda2, hda1->hdb1 or to a different disk sector offset) then you  will  need
       to take extra care.

       Usually,  Windows  will  not be able to boot, unless you copy, move or restore NTFS to the same partition
       which starts at the same sector on the same type of disk having the same BIOS legacy cylinder setting  as
       the original partition and disk had.

       The  ntfsclone  utility  guarantees  to make an exact copy of NTFS but it won't deal with booting issues.
       This is by design: ntfsclone is a filesystem, not system utility. Its  aim  is  only  NTFS  cloning,  not
       Windows cloning. Hereby ntfsclone can be used as a very fast and reliable build block for Windows cloning
       but itself it's not enough.

   Sparse Files
       A file is sparse if it has unallocated blocks (holes). The reported size of such files are always  higher
       than the disk space consumed by them.  The du command can tell the real disk space used by a sparse file.
       The holes are always read as zeros. All major Linux filesystem like, ext2, ext3, reiserfs,  Reiser4,  JFS
       and XFS, supports sparse files but for example the ISO 9600 CD-ROM filesystem doesn't.

   Handling Large Sparse Files
       As  of  today Linux provides inadequate support for managing (tar, cp, gzip, gunzip, bzip2, bunzip2, cat,
       etc) large sparse files.  The only main  Linux  filesystem  having  support  for  efficient  sparse  file
       handling  is  XFS  by  the  XFS_IOC_GETBMAPX ioctl(2).  However none of the common utilities supports it.
       This means when you tar, cp, gzip, bzip2, etc a large sparse file they will always read the entire  file,
       even if you use the "sparse support" options.

       bzip2(1) compresses large sparse files much better than gzip(1) but it does so also much slower. Moreover
       neither of them handles large sparse files efficiently during uncompression from disk space  usage  point
       of view.

       At  present  the  most  efficient way, both speed and space-wise, to compress and uncompress large sparse
       files by common tools would be using tar(1) with the options -S (handle sparse files  "efficiently")  and
       -j  (filter the archive through bzip2). Although tar still reads and analyses the entire file, it doesn't
       pass on the large data blocks having only zeros to filters and it also avoids  writing  large  amount  of
       zeros to the disk needlessly. But since tar can't create an archive from the standard input, you can't do
       this in-place by just reading ntfsclone standard output. Even more sadly, using  the  -S  option  results
       serious  data  loss since the end of 2004 and the GNU tar maintainers didn't release fixed versions until
       the present day.

   The Special Image Format
       It's also possible, actually it's recommended, to save an NTFS filesystem  to  a  special  image  format.
       Instead  of  representing  unallocated  blocks  as holes, they are encoded using control codes. Thus, the
       image saves space without requiring sparse  file  support.  The  image  format  is  ideal  for  streaming
       filesystem  images  over the network and similar, and can be used as a replacement for Ghost or Partition
       Image if it is combined with other tools. The downside is that you can't mount the  image  directly,  you
       need to restore it first.

       To  save  an  image  using the special image format, use the -s or the --save-image option. To restore an
       image, use the -r or the --restore-image option. Note that you can restore images from standard input  by
       using '-' as the SOURCE file.

   Metadata-only Cloning
       One  of the features of ntfsclone is that, it can also save only the NTFS metadata using the option -m or
       --metadata and the clone still will be mountable. In this case all non-metadata file content will be lost
       and reading them back will result always zeros.

       The  metadata-only  image  can be compressed very well, usually to not more than 1-8 MB thus it's easy to
       transfer for investigation, troubleshooting.

       In this mode of ntfsclone, NONE of the user's data is saved, including the resident user's data  embedded
       into  metadata.  All  is  filled with zeros.  Moreover all the file timestamps, deleted and unused spaces
       inside the metadata are filled with zeros. Thus this mode  is  inappropriate  for  example  for  forensic
       analyses.  This mode may be combined with --save-image to create a special image format file instead of a
       sparse file.

       Please note, filenames are not wiped out. They might contain sensitive information, so think twice before
       sending such an image to anybody.

OPTIONS

       Below  is  a  summary  of all the options that ntfsclone accepts.  Nearly all options have two equivalent
       names.  The short name is preceded by - and the long name is preceded by -- .  Any single letter options,
       that  don't  take  an argument, can be combined into a single command, e.g.  -fv is equivalent to -f -v .
       Long named options can be abbreviated to any unique prefix of their name.

       -o, --output FILE
              Clone NTFS to the non-existent FILE.  If FILE is '-' then  clone  to  the  standard  output.  This
              option cannot be used for creating a partition, use --overwrite for an existing partition.

       -O, --overwrite FILE
              Clone NTFS to FILE, which can be an existing partition or a regular file which will be overwritten
              if it exists.

       -s, --save-image
              Save to the special image format. This is the most efficient way space and speed-wise  if  imaging
              is  done  to  the  standard  output, e.g. for image compression, encryption or streaming through a
              network.

       -r, --restore-image
              Restore from the special image format specified by SOURCE argument. If the SOURCE is '-' then  the
              image is read from the standard input.

       -n, --no-action
              Test  the  consistency  of a saved image by simulating its restoring without writing anything. The
              NTFS data contained in the image is not tested.  The option --restore-image must also be  present,
              and the options --output and --overwrite must be omitted.

       --rescue
              Ignore  disk  read  errors  so disks having bad sectors, e.g. dying disks, can be rescued the most
              efficiently way, with minimal stress on them. Ntfsclone works at the lowest, sector level in  this
              mode  too  thus  more  data  can be rescued.  The contents of the unreadable sectors are filled by
              character '?' and the beginning of such sectors are marked by "BadSectoR\0".

       -m, --metadata
              Clone ONLY METADATA (for NTFS experts). Only cloning to a (sparse) file is  allowed,  unless  used
              the option --save-image is also used.  You can't metadata-only clone to a device.

       --ignore-fs-check
              Ignore the result of the filesystem consistency check. This option is allowed to be used only with
              the --metadata option, for the safety of user's data. The clusters which cause  the  inconsistency
              are saved too.

       -t, --preserve-timestamps
              Do not wipe the timestamps, to be used only with the --metadata option.

       --full-logfile
              Include  the  Windows log file in the copy. This is only useful for extracting metadata, saving or
              cloning a file system which was not properly unmounted from Windows.

       --new-serial, or

       --new-half-serial
              Set a new random serial number to the clone. The serial number is a 64 bit number used to identify
              the device during the mounting process, so it has to be changed to enable the original file system
              and the clone to be mounted at the same time on the same computer.

              The option --new-half-serial only changes the upper part of the serial number, keeping  the  lower
              part which is used by Windows unchanged.

              The  options  --new-serial  and  --new-half-serial  can only be used when cloning a file system of
              restoring from an image.

              The serial number is not the volume UUID used by Windows to locate files which have been moved  to
              another volume.

       -f, --force
              Forces ntfsclone to proceed if the filesystem is marked "dirty" for consistency check.

       -q, --quiet
              Do not display any progress-bars during operation.

       -h, --help
              Show a list of options with a brief description of each one.

EXIT CODES

       The exit code is 0 on success, non-zero otherwise.

EXAMPLES

       Clone NTFS on /dev/hda1 to /dev/hdc1:

              ntfsclone --overwrite /dev/hdc1 /dev/hda1

       Save an NTFS to a file in the special image format:

              ntfsclone --save-image --output backup.img /dev/hda1

       Restore an NTFS from a special image file to its original partition:

              ntfsclone --restore-image --overwrite /dev/hda1 backup.img

       Save an NTFS into a compressed image file:

              ntfsclone --save-image -o - /dev/hda1 | gzip -c > backup.img.gz

       Restore an NTFS volume from a compressed image file:

              gunzip -c backup.img.gz | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Backup an NTFS volume to a remote host, using ssh. Please note, that ssh may ask for a password!

              ntfsclone --save-image --output - /dev/hda1 | \
              gzip -c | ssh host 'cat > backup.img.gz'

       Restore an NTFS volume from a remote host via ssh. Please note, that ssh may ask for a password!

              ssh host 'cat backup.img.gz' | gunzip -c | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Stream an image file from a web server and restore it to a partition:

              wget -qO - http://server/backup.img | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Clone an NTFS volume to a non-existent file:

              ntfsclone --output ntfs-clone.img /dev/hda1

       Pack  NTFS  metadata for NTFS experts. Please note that bzip2 runs very long but results usually at least
       10 times smaller archives than gzip on a sparse file.

              ntfsclone --metadata --output ntfsmeta.img /dev/hda1
              bzip2 ntfsmeta.img

              Or, outputting to a compressed image :
              ntfsclone -mst --output - /dev/hda1 | bzip2 > ntfsmeta.bz2

       Unpacking NTFS metadata into a sparse file:

              bunzip2 -c ntfsmeta.img.bz2 | \
              cp --sparse=always /proc/self/fd/0 ntfsmeta.img

KNOWN ISSUES

       There are no known problems with ntfsclone.  If you think you have found a problem then  please  send  an
       email describing it to the development team: ntfs-3g-devel@lists.sf.net

       Sometimes it might appear ntfsclone froze if the clone is on ReiserFS and even CTRL-C won't stop it. This
       is not a bug in ntfsclone, however it's due to ReiserFS being extremely inefficient creating large sparse
       files  and  not  handling  signals  during  this  operation. This ReiserFS problem was improved in kernel
       2.4.22.  XFS, JFS and ext3 don't have this problem.

AUTHORS

       ntfsclone was written by Szabolcs Szakacsits with contributions from Per Olofsson (special  image  format
       support) and Anton Altaparmakov.  It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.

AVAILABILITY

       ntfsclone is part of the ntfs-3g package and is available at:
       https://github.com/tuxera/ntfs-3g/wiki/

SEE ALSO

       ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)