Linux NTFS
This page is part of the Linux Disk Management pages.
References
- ntfs-3g home page (extended attributes)
- JP Andre Blog:
Create
# 1) Create partition using sfdisk
# 2) Format the partition
mkntfs -Q -v -L "Data" /dev/sda3
Mounting
References
- https://help.ubuntu.com/community/MountingWindowsPartitions/ThirdPartyNTFS3G
- http://ubuntuforums.org/archive/index.php/t-1072025.html
- Mounting an NTFS partition using file /etc/fstab
First get the UUID of the partition to mount
sudo blkid
Edit /etc/fstab accordingly:
UUID=XXXXXXXXXXXXXXXXXXXXX /media/windows ntfs defaults,nls=utf8,umask=007,gid=46 0 1
- Note that gid=46 refers to plugdev group.
Now the partition can be mounted with:
sudo mount /media/windows
- Mounting a NTFS partition using command mount
To mount an NTFS partition /dev/sda1 to mount point /media/windows:
sudo mkdir /media/windows
sudo chgrp plugdev /media/windows
sudo mount -t ntfs -o defaults,nls=utf8,umask=007,gid=46 /dev/sda1 /media/windows
- Mounting a NTFS partition with compression enabled
sudo mount -t ntfs -o defaults,nls=utf8,umask=007,gid=46 /dev/sda1 /media/windows
Use getfattr to see if a file is compressed or not
getfattr -n system.ntfs_attrib -e hex file
setfattr -h -n system.ntfs_attrib -v 0x00080000 file # Set compression flag
NTFSFix
Use ntfsfix to fix errors on the NTFS partition (from package ntfsprogs). Say your partition is on /dev/sda1:
sudo ntfsfix /dev/sda1
This fix errors like:
$MFTMirr does not match $MFT (record 1).
Resize an NTFS Partition
Using GParted
The easiest is to use the graphical tool gparted, which shrinks / grows the partition but also edits the partition table
Using ntfsresize
Otherwise here is the equivalent command sequence (shrink partition /dev/sda1 to 35000MB):
# Shrink partition
sudo sfdisk -l /dev/sda # Calibrate /dev/sda1 (get partition info)
sudo ntfsresize -i -f -v /dev/sda1 # Check file system
sudo ntfsresize --force /dev/sda1 --size 35000M --no-action # Shrink file system, test first...
sudo ntfsresize --force /dev/sda1 --size 35000M # ... do it
# Edit MBR
sudo sfdisk ... # Shrink MBR partition
# Grow back partition to new size
sudo ntfsresize -i -f -v /dev/sda1 # Check file system
sudo ntfsresize --force /dev/sda1 --no-action # Grow file system to fill partition, test first...
sudo ntfsresize --force /dev/sda1 # ... do it
Backup an NTFS partition
Backup
- CLEAN the NTFS partition
- Disable Windows Restore (will delete restore points)
- Disable virtual memory (will delete page file)
- Disable hibernation (will delete hibernat.sys).
- Perform disk clean up (will empty recycle bin, etc)
- Go to Outlook local data, and delete all cache .OST file
better delete, then restart outlook once so that the .OST are recreated once for all (but quit before send & receive starts) - SHRINK the NTFS partition Data usually do not occupy the full volume. By shrinking the partition, it will allow us to restore the backup on a partition smaller than the original one.
- BACKUP the NTFS partition
- TEST the BACKUP Always good practice! Note that deleting everything & restoring afterwards to validate the backup is NOT a good idea.
- GROW the NTFS partition back to initial size. Again use either gparted or ntfsresize.
- RESTORE windows features.
- Enable virtual memory
- Enable hibernation
- Enable System Restore
The easiest for this step is to use GUI tool gparted (alternative is to use
ntfsresize, see section above). Shrink the partition to its minimum size (give some slack, like few hundred MB, so that partition remains bootable w/o disk full error).
sudo gparted
sudo ntfsclone --save-image -o - /dev/sda1 | gzip -c > mypc-20090908-sda1-ntfs_resized.img.gz
sudo gparted
# ... OR ...
sudo ntfsresize --force /dev/sda1
Restore
- RESTORE the NTFS partition
- GROW the NTFS partition back to initial size. Again use either gparted or ntfsresize.
- RESTORE windows features.
- Enable virtual memory
- Enable hibernation
- Enable System Restore
#zcat is better than gzip -d -c coz' autocomplete works!
zcat mypc-20090908-sda1-ntfs_resized.img.gz | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
sudo gparted
# ... OR ...
sudo ntfsresize --force /dev/sda1
Backup / restore over network
To backup over the network, simply pipe to ssh:
sudo ntfsclone --force --save-image -o - /dev/sda1 | ssh user@myserver "gzip -c > hostname-sda1-ntfs.img.gz"
#Better?
sudo ntfsclone --force --save-image -o - /dev/sda1 | gzip -c | ssh user@myserver "cat > hostname-sda1-ntfs.img.gz"
To restore from the network, we do the reverse:
ssh user@myserver "zcat hostname-sda1-ntfs.img.gz" | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
#Better?
ssh user@myserver "cat hostname-sda1-ntfs.img.gz" | zcat | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
Note that we decompress the file locally to minimize amount of data to transfer through the network.
To backup and restore over the network, we need sudo access on the remote machine. This uses the same trick as for rsync, which allows to run sudo commands via ssh:
#If needed, pre-activate sudo on remote system. Flag -t required to solve 'sudo: no tty present and no askpass program specified'
#
# Also, this requires the following line in /etc/sudoers:
#
# Defaults !tty_tickets
#
stty -echo; ssh -t user@server sudo -v; stty echo
sudo ntfsclone --save-image -o - /dev/sdb1 | ssh -t user@server sudo ntfsclone --restore-image --overwrite /dev/sda4 -
Backup Master Boot Record (MBR)
Backup the MBR (Master Boot Record), and table of partitions:
sudo dd if=/dev/sda of=mypc-20111201-sda.mbr bs=512 count=2048 # Backup first 2MB to make sure we get MBR + any extension
sudo sfdisk -l -uS /dev/sda > mypc-20111201-sda-sfdisk.txt
sudo sfdisk -d /dev/sda > mypc-20111201-sda-sfdisk.dump # We can restore with sudo sfdisk /dev/sda < mypc-20111201-sda-sfdisk.dump
Backup a fresh Windows PC
Goals:
- Backup ALL Windows partitions
So that it can be reinstalled even in case of a complete disk crash - Reduce the size of Windows partitions
So that to install Linux alongside
This procedure assumes there is only one disk (/dev/sda), and that we boot from a Linux USB stick.
- Backup MBR and ALL NTFS partitions AS IS (see above).
This is just for safety in order to make sure we can recover in case the procedure below fails (typ. resize). This can be done using ntfsclone. - Shrink partitions.
- Backup MBR and ALL NTFS partitions again (see above)
- Reboot, test, and delete safety backups.
To do also:
- Save the session log
- Write a description of the pc (brand, etc), short description of the partitions
- Backup / encrypt the active password on backup partition (at least for the factory image)
- Do a ntfsresize --info of factory partition / keep a log of the ntfsresize (to know size of the volume)
- In gparted, create new partition aligned on cylinder
Mount an NTFSClone image
Convert an image file to a file, and mount it
gzip -d -c backup-20090908.img.gz | ntfsclone --restore-image --overwrite backup.img -
sudo mount -t ntfs -o loop backup.ntfs /mnt/ntfsclone
! bug ! If you get an error Failed to read last sector (...): Invalid argument, it is probably because the size of the image volume created by ntfsclone does not match the Image device size (the last cluster is incomplete). To fix this bug, simply pad the file with zeroes as necessary. Let's assume the following output for ntfsclone:
... Cluster size : 4096 bytes Image volume size : 48057282560 bytes (48058 MB) Image device size : 48057286656 bytes ...
However the file generated by ntfsclone is smaller than the original device size:
-rw------- 1 root root 48057283072 2010-03-26 00:07 backup.ntfs
Simply pad the file to the original length:
sudo truncate --size=48057286656 backup.ntfs # Extremely fast
dd if=/dev/zero bs=3584 count=1 >> backup.ntfs # ...OR... pad the missing 3584 bytes
Resizing an NTFSClone image
ntfsclone will fail if the original device size is bigger than the destination partition. To fix this, first resize the ntfsclone image by using a loop devices.
gzip -d -c backup.img.gz | sudo ntfsclone --restore-image --overwrite backup.img -
sudo losetup /dev/loop0 backup.img
sudo ntfsresize --no-action --size 20000M /dev/loop0 # Testing
# If this fail with "Failed to read last sector", increase a bit the size
# of 'backup.img' using sudo truncate
sudo ntfsresize --size 20000M /dev/loop0
sudo truncate --size=20000M backup.img # For more safety, takes actual size of volume + cluster size
sudo ntfsfix /dev/loop0 # Fix any error on the volume
sudo losetup -c /dev/loop0 # Sync loop device with new file size
sudo ntfsclone --save-image -o - /dev/loop0 | gzip -c > backup-resized.img.gz
sudo losetup -d /dev/loop0
When truncating the file, check first the actual volume size (by calling ntfsclone), and use that size (that should be rounded to cluster size) plus another cluster size.
Advanced features
NTFS extended attributes
See NTFS-3G home page for details ([1], [2]).
First enable extended attributes:
sudo mount -o streams_interface=xattr /dev/sda1 /mnt # note: xattr is supported by default
Then use getfattr / setfattr (package attr) to copy ntfs attributes. For instance, to backup SAM*.* file attributes:
#! /bin/bash
for f in SAM*; do
for ACL in ntfs_attrib_be ntfs_acl; do
sudo echo setfattr -h -v $(getfattr -h -e hex -n system.$ACL $f|grep '=' | sed -e 's/^.*=//') -n system.$ACL $f
done
done > restore_acl.sh
chmod a+x restore_acl.sh
Windows 7
Since Vista / Windows 7, Windows will use MBR Disk Signature to identify the hard drive and assigns it the proper drive letter. If this signature changes, Windows will see the disk as a new drive and assign it a new drive letter (typically D:). Since Windows will not find the boot drive (should be C:), boot will fail with an error 0xc00000e:
0xc00000e : Can't run WINLOAD.EXE
Workaround:
- Boot with the Windows7 DVD
- Choose the Repair option
- Reboot the repaired Windows7
- Remove all entries in the Registry HKLM\System\MountedDevices\ except Default
- Reboot with CloneZilla to make a new image
- Restore the new image: You should now be able to boot Windows7
Also better save the MBR for later reuse if needed with
sudo dd if=/dev/sda of=sda.mbr bs=512 count=63
Reference: