Linux NTFS

This page is part of the Linux Disk Management pages.

References

• ntfs-3g home page (extended attributes)
• JP Andre Blog:
  • File Ownership and Permissions
  • Advanced features
  • Extended attributes

Create

# 1) Create partition using sfdisk
# 2) Format the partition
mkntfs -Q -v -L "Data" /dev/sda3

Mounting

References

• https://help.ubuntu.com/community/MountingWindowsPartitions/ThirdPartyNTFS3G
• http://ubuntuforums.org/archive/index.php/t-1072025.html

Mounting an NTFS partition using file /etc/fstab

First get the UUID of the partition to mount

sudo blkid

Edit /etc/fstab accordingly:

UUID=XXXXXXXXXXXXXXXXXXXXX /media/windows ntfs defaults,nls=utf8,umask=007,gid=46 0 1

Note that gid=46 refers to plugdev group.

Now the partition can be mounted with:

sudo mount /media/windows

Mounting a NTFS partition using command mount

To mount an NTFS partition /dev/sda1 to mount point /media/windows:

sudo mkdir /media/windows
sudo chgrp plugdev /media/windows
sudo mount -t ntfs -o defaults,nls=utf8,umask=007,gid=46 /dev/sda1 /media/windows

Mounting a NTFS partition with compression enabled

sudo mount -t ntfs -o defaults,nls=utf8,umask=007,gid=46 /dev/sda1 /media/windows

Use getfattr to see if a file is compressed or not

getfattr -n system.ntfs_attrib -e hex file
setfattr -h -n system.ntfs_attrib -v 0x00080000 file       # Set compression flag

NTFSFix

Use ntfsfix to fix errors on the NTFS partition (from package ntfsprogs). Say your partition is on /dev/sda1:

sudo ntfsfix /dev/sda1

This fix errors like:

$MFTMirr does not match $MFT (record 1).

Resize an NTFS Partition

Using GParted

The easiest is to use the graphical tool gparted, which shrinks / grows the partition but also edits the partition table

Using ntfsresize

Otherwise here is the equivalent command sequence (shrink partition /dev/sda1 to 35000MB):

# Shrink partition
sudo sfdisk -l /dev/sda                                               # Calibrate /dev/sda1 (get partition info)
sudo ntfsresize -i -f -v /dev/sda1                                    # Check file system
sudo ntfsresize --force /dev/sda1 --size 35000M --no-action           # Shrink file system, test first...
sudo ntfsresize --force /dev/sda1 --size 35000M                       # ... do it
# Edit MBR
sudo sfdisk ...                                                       # Shrink MBR partition
# Grow back partition to new size
sudo ntfsresize -i -f -v /dev/sda1                                    # Check file system
sudo ntfsresize --force /dev/sda1 --no-action                         # Grow file system to fill partition, test first...
sudo ntfsresize --force /dev/sda1                                     # ... do it

Backup an NTFS partition

Backup

1. CLEAN the NTFS partition
• Disable Windows Restore (will delete restore points)
• Disable virtual memory (will delete page file)
• Disable hibernation (will delete hibernat.sys).
• Perform disk clean up (will empty recycle bin, etc)
• Go to Outlook local data, and delete all cache .OST file
  better delete, then restart outlook once so that the .OST are recreated once for all (but quit before send & receive starts)
2. SHRINK the NTFS partition
Data usually do not occupy the full volume. By shrinking the partition, it will allow us to restore the backup on a partition smaller than the original one.
The easiest for this step is to use GUI tool gparted (alternative is to use ntfsresize, see section above). Shrink the partition to its minimum size (give some slack, like few hundred MB, so that partition remains bootable w/o disk full error).

sudo gparted

3. BACKUP the NTFS partition

sudo ntfsclone --save-image -o - /dev/sda1 | gzip -c > mypc-20090908-sda1-ntfs_resized.img.gz

4. TEST the BACKUP
Always good practice! Note that deleting everything & restoring afterwards to validate the backup is NOT a good idea.
5. GROW the NTFS partition back to initial size.
Again use either gparted or ntfsresize.

sudo gparted
# ... OR ...
sudo ntfsresize --force /dev/sda1

6. RESTORE windows features.
• Enable virtual memory
• Enable hibernation
• Enable System Restore

Restore

1. RESTORE the NTFS partition

#zcat is better than gzip -d -c coz' autocomplete works!
zcat mypc-20090908-sda1-ntfs_resized.img.gz | sudo ntfsclone --restore-image --overwrite /dev/sda1 -

2. GROW the NTFS partition back to initial size.
Again use either gparted or ntfsresize.

sudo gparted
# ... OR ...
sudo ntfsresize --force /dev/sda1

3. RESTORE windows features.
• Enable virtual memory
• Enable hibernation
• Enable System Restore

Backup / restore over network

To backup over the network, simply pipe to ssh:

sudo ntfsclone --force --save-image -o - /dev/sda1 | ssh user@myserver "gzip -c > hostname-sda1-ntfs.img.gz"
#Better?
sudo ntfsclone --force --save-image -o - /dev/sda1 | gzip -c | ssh user@myserver "cat > hostname-sda1-ntfs.img.gz"

To restore from the network, we do the reverse:

ssh user@myserver "zcat hostname-sda1-ntfs.img.gz" | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
#Better?
ssh user@myserver "cat hostname-sda1-ntfs.img.gz" | zcat | sudo ntfsclone --restore-image --overwrite /dev/sda1 -

Note that we decompress the file locally to minimize amount of data to transfer through the network.

To backup and restore over the network, we need sudo access on the remote machine. This uses the same trick as for rsync, which allows to run sudo commands via ssh:

#If needed, pre-activate sudo on remote system. Flag -t required to solve 'sudo: no tty present and no askpass program specified'
#
# Also, this requires the following line in /etc/sudoers:
#
#    Defaults     !tty_tickets
#
stty -echo; ssh -t user@server sudo -v; stty echo

sudo ntfsclone --save-image -o - /dev/sdb1 | ssh -t user@server sudo ntfsclone --restore-image --overwrite /dev/sda4 -
#
# Process staled? --> Probably waiting on ssh password. Enter that password and press enter.
#

Backup Master Boot Record (MBR)

Backup the MBR (Master Boot Record), and table of partitions:

sudo dd if=/dev/sda of=mypc-20111201-sda.mbr bs=512 count=2048     # Backup first 2MB to make sure we get MBR + any extension
sudo sfdisk -l -uS /dev/sda > mypc-20111201-sda-sfdisk.txt
sudo sfdisk -d /dev/sda > mypc-20111201-sda-sfdisk.dump            # We can restore with sudo sfdisk /dev/sda < mypc-20111201-sda-sfdisk.dump

Backup a fresh Windows PC

Goals:

• Backup ALL Windows partitions
  So that it can be reinstalled even in case of a complete disk crash
• Reduce the size of Windows partitions
  So that to install Linux alongside

This procedure assumes there is only one disk (/dev/sda), and that we boot from a Linux USB stick.

1. Backup MBR and ALL NTFS partitions AS IS (see above).
   This is just for safety in order to make sure we can recover in case the procedure below fails (typ. resize). This can be done using ntfsclone.
2. Shrink partitions.
3. Backup MBR and ALL NTFS partitions again (see above)
4. Reboot, test, and delete safety backups.

To do also:

• Save the session log
• Write a description of the pc (brand, etc), short description of the partitions
• Backup / encrypt the active password on backup partition (at least for the factory image)
• Do a ntfsresize --info of factory partition / keep a log of the ntfsresize (to know size of the volume)
• In gparted, create new partition aligned on cylinder

Mount an NTFSClone image

Convert an image file to a file, and mount it

gzip -d -c backup-20090908.img.gz | ntfsclone --restore-image --overwrite backup.img -
sudo mount -t ntfs -o loop backup.ntfs /mnt/ntfsclone

! bug ! If you get an error Failed to read last sector (...): Invalid argument, it is probably because the size of the image volume created by ntfsclone does not match the Image device size (the last cluster is incomplete). To fix this bug, simply pad the file with zeroes as necessary. Let's assume the following output for ntfsclone:

...
Cluster size           : 4096 bytes
Image volume size      : 48057282560 bytes (48058 MB)
Image device size      : 48057286656 bytes
...

However the file generated by ntfsclone is smaller than the original device size:

-rw------- 1 root     root     48057283072 2010-03-26 00:07 backup.ntfs

Simply pad the file to the original length:

sudo truncate --size=48057286656 backup.ntfs    # Extremely fast
dd if=/dev/zero bs=3584 count=1 >> backup.ntfs  # ...OR... pad the missing 3584 bytes

Resizing an NTFSClone image

ntfsclone will fail if the original device size is bigger than the destination partition. To fix this, first resize the ntfsclone image by using a loop devices.

gzip -d -c backup.img.gz | sudo ntfsclone --restore-image --overwrite backup.img -
sudo losetup /dev/loop0 backup.img
sudo ntfsresize --no-action --size 20000M /dev/loop0       # Testing
                                                           # If this fail with "Failed to read last sector", increase a bit the size
                                                           # of 'backup.img' using sudo truncate
sudo ntfsresize --size 20000M /dev/loop0
sudo truncate --size=20000M backup.img                     # For more safety, takes actual size of volume + cluster size
sudo ntfsfix /dev/loop0                                    # Fix any error on the volume
sudo losetup -c /dev/loop0                                 # Sync loop device with new file size
sudo ntfsclone --save-image -o - /dev/loop0 | gzip -c > backup-resized.img.gz
sudo losetup -d /dev/loop0

When truncating the file, check first the actual volume size (by calling ntfsclone), and use that size (that should be rounded to cluster size) plus another cluster size.

Advanced features

NTFS extended attributes

See NTFS-3G home page for details ([1], [2]).

First enable extended attributes:

sudo mount -o streams_interface=xattr /dev/sda1 /mnt     # note: xattr is supported by default

Then use getfattr / setfattr (package attr) to copy ntfs attributes. For instance, to backup SAM*.* file attributes:

#! /bin/bash

for f in SAM*; do 
  for ACL in ntfs_attrib_be ntfs_acl; do 
    sudo echo setfattr -h -v $(getfattr -h -e hex -n system.$ACL $f|grep '=' | sed -e 's/^.*=//') -n system.$ACL $f
  done
done > restore_acl.sh
chmod a+x restore_acl.sh

Windows 7

Since Vista / Windows 7, Windows will use MBR Disk Signature to identify the hard drive and assigns it the proper drive letter. If this signature changes, Windows will see the disk as a new drive and assign it a new drive letter (typically D:). Since Windows will not find the boot drive (should be C:), boot will fail with an error 0xc00000e:

0xc00000e : Can't run WINLOAD.EXE

Workaround:

1. Boot with the Windows7 DVD
2. Choose the Repair option
3. Reboot the repaired Windows7
4. Remove all entries in the Registry HKLM\System\MountedDevices\ except Default
5. Reboot with CloneZilla to make a new image
6. Restore the new image: You should now be able to boot Windows7

Also better save the MBR for later reuse if needed with

sudo dd if=/dev/sda of=sda.mbr bs=512 count=63

Reference:

• Can CZ Live image a Windows7 partition?
• Vista's MBR Disk Signature