Linux NTFS: Difference between revisions

From miki
Jump to navigation Jump to search
 
(27 intermediate revisions by the same user not shown)
Line 2: Line 2:


This page is part of the [[Linux Disk Management]] pages.
This page is part of the [[Linux Disk Management]] pages.

== References ==
* [http://www.tuxera.com/community/open-source-ntfs-3g/ ntfs-3g home page] ([http://www.tuxera.com/community/ntfs-3g-advanced/extended-attributes/ extended attributes])
* JP Andre Blog:
** [http://jp-andre.pagesperso-orange.fr/permissions.html File Ownership and Permissions]
** [http://jp-andre.pagesperso-orange.fr/advanced-ntfs-3g.html Advanced features]
** [http://jp-andre.pagesperso-orange.fr/extend-attr.html Extended attributes]

== Create ==
<source lang="bash">
# 1) Create partition using sfdisk
# 2) Format the partition
mkntfs -Q -v -L "Data" /dev/sda3
</source>


== Mounting ==
== Mounting ==
Line 8: Line 22:
* http://ubuntuforums.org/archive/index.php/t-1072025.html
* http://ubuntuforums.org/archive/index.php/t-1072025.html


'''Mounting an NTFS partition using file <tt>/etc/fstab</tt>'''
;Mounting an NTFS partition using file <tt>/etc/fstab</tt>
* First get the UUID of the partition to mount
First get the UUID of the partition to mount
{{pl2|<source lang="bash" enclose="prevalid">sudo blkid</source>}}
<source lang="bash" enclose="prevalid">sudo blkid</source>
* Edit '''/etc/fstab''' accordingly:
Edit '''/etc/fstab''' accordingly:
{{pl2|<source lang="text">UUID=XXXXXXXXXXXXXXXXXXXXX /media/windows ntfs defaults,umask=007,gid=46 0 1</source>}}
<source lang="text">UUID=XXXXXXXXXXXXXXXXXXXXX /media/windows ntfs defaults,nls=utf8,umask=007,gid=46 0 1</source>
:Note that '''gid=46''' refers to '''plugdev''' group.
:Note that '''gid=46''' refers to '''plugdev''' group.
* Now the partition can be mounted with:
Now the partition can be mounted with:
{{pl2|<source lang="bash" enclose="prevalid">sudo mount /media/windows</source>}}
<source lang="bash" enclose="prevalid">sudo mount /media/windows</source>


'''Mounting a NTFS partition using command <tt>mount</tt>'''
;Mounting a NTFS partition using command <tt>mount</tt>
* To mount an NTFS partition '''/dev/sda1''' to mount point '''/media/windows''':
To mount an NTFS partition '''/dev/sda1''' to mount point '''/media/windows''':
{{pl2|<source lang="bash">
<source lang="bash">
sudo mkdir /media/windows
sudo mkdir /media/windows
sudo chgrp plugdev /media/windows
sudo chgrp plugdev /media/windows
sudo mount -t ntfs -o defaults,umask=007,gid=46 /dev/sda1 /media/windows
sudo mount -t ntfs -o defaults,nls=utf8,umask=007,gid=46 /dev/sda1 /media/windows
</source>}}
</source>

;Mounting a NTFS partition with ''compression'' enabled
<source lang=bash>sudo mount -t ntfs -o defaults,nls=utf8,umask=007,gid=46 /dev/sda1 /media/windows</source>
Use <code>getfattr</code> to see if a file is compressed or not
<source lang=bash>
getfattr -n system.ntfs_attrib -e hex file
setfattr -h -n system.ntfs_attrib -v 0x00080000 file # Set compression flag
</source>

== NTFSFix ==
Use <tt>ntfsfix</tt> to fix errors on the NTFS partition (from package '''ntfsprogs'''). Say your partition is on <tt>/dev/sda1</tt>:


== NTFSResize ==
Change the size of an existing NTFS partition
<source lang="bash">
<source lang="bash">
sudo ntfsfix /dev/sda1
$ fdisk -l /dev/sda # List information on partitions on /dev/sda
$ ntfsresize --info /dev/sda1
$ ntfsresize --no-action --size 20152M /dev/sda1 # Testing
$ ntfsresize --no-action --size 20151M /dev/sda1 # Testing
$ ntfsresize --size 20151M /dev/sda1
$ ntfsresize --size 20000M /dev/sda1
</source>
</source>


This fix errors like:
== NTFSClone ==
<source lang="text">
Backup an NTFS partition to an image file
$MFTMirr does not match $MFT (record 1).
</source>

== Resize an NTFS Partition ==
=== Using GParted ===
The easiest is to use the graphical tool '''gparted''', which shrinks / grows the partition but also edits the partition table

=== Using ntfsresize ===
Otherwise here is the equivalent command sequence (shrink partition <tt>/dev/sda1</tt> to ''35000MB''):

<source lang="bash">
<source lang="bash">
# Shrink partition
sudo ntfsclone --save-image -o - /dev/sda1 | gzip -c > backup-20090908.img.gz
sudo sfdisk -l /dev/sda # Calibrate /dev/sda1 (get partition info)
sudo ntfsresize -i -f -v /dev/sda1 # Check file system
sudo ntfsresize --force /dev/sda1 --size 35000M --no-action # Shrink file system, test first...
sudo ntfsresize --force /dev/sda1 --size 35000M # ... do it
# Edit MBR
sudo sfdisk ... # Shrink MBR partition
# Grow back partition to new size
sudo ntfsresize -i -f -v /dev/sda1 # Check file system
sudo ntfsresize --force /dev/sda1 --no-action # Grow file system to fill partition, test first...
sudo ntfsresize --force /dev/sda1 # ... do it
</source>
</source>


Restore an NTFS partition from an image file
== Backup an NTFS partition ==
=== Backup ===
<ol>
<li>'''CLEAN the NTFS partition'''</li>
* Disable ''Windows Restore'' (will delete restore points)
* Disable virtual memory (will delete page file)
* Disable hibernation (will delete hibernat.sys).
* Perform disk clean up (will empty recycle bin, etc)
* Go to Outlook local data, and delete all cache .OST file<br/>better delete, then restart outlook once so that the .OST are recreated once for all (but quit before send & receive starts)
<li>'''SHRINK the NTFS partition'''</li>
Data usually do not occupy the full volume. By shrinking the partition, it will allow us to restore the backup on a partition smaller than the original one.<br/>
The easiest for this step is to use GUI tool '''gparted''' (alternative is to use <code>ntfsresize</code>, see section above). Shrink the partition to its minimum size (give some slack, like few hundred MB, so that partition remains bootable w/o disk full error).
<source lang="bash">
<source lang="bash">
sudo gparted
gzip -d -c backup-20090908.img.gz | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
</source>
</source>
<li>'''BACKUP the NTFS partition'''</li>
<source lang="bash">
sudo ntfsclone --save-image -o - /dev/sda1 | gzip -c > mypc-20090908-sda1-ntfs_resized.img.gz
</source>

<li>'''TEST the BACKUP'''</li>
Always good practice! Note that deleting everything & restoring afterwards to validate the backup is ''NOT'' a good idea.

<li>'''GROW the NTFS partition back to initial size.'''</li>
Again use either '''gparted''' or '''ntfsresize'''.
<source lang="bash">
sudo gparted
# ... OR ...
sudo ntfsresize --force /dev/sda1
</source>
<li>'''RESTORE windows features.'''</li>
* Enable virtual memory
* Enable hibernation
* Enable System Restore
</ol>


=== Restore ===
<ol>
<li>'''RESTORE the NTFS partition'''</li>
<source lang="bash">
#zcat is better than gzip -d -c coz' autocomplete works!
zcat mypc-20090908-sda1-ntfs_resized.img.gz | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
</source>

<li>'''GROW the NTFS partition back to initial size.'''</li>
Again use either '''gparted''' or '''ntfsresize'''.
<source lang="bash">
sudo gparted
# ... OR ...
sudo ntfsresize --force /dev/sda1
</source>
<li>'''RESTORE windows features.'''</li>
* Enable virtual memory
* Enable hibernation
* Enable System Restore
</ol>


==== Backup / restore over network ====
To backup over the network, simply pipe to ssh:
<source lang=bash>
sudo ntfsclone --force --save-image -o - /dev/sda1 | ssh user@myserver "gzip -c > hostname-sda1-ntfs.img.gz"
#Better?
sudo ntfsclone --force --save-image -o - /dev/sda1 | gzip -c | ssh user@myserver "cat > hostname-sda1-ntfs.img.gz"
</source>

To restore from the network, we do the reverse:
<source lang=bash>
ssh user@myserver "zcat hostname-sda1-ntfs.img.gz" | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
#Better?
ssh user@myserver "cat hostname-sda1-ntfs.img.gz" | zcat | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
</source>
Note that we decompress the file locally to minimize amount of data to transfer through the network.

To backup '''and''' restore over the network, we need ''sudo'' access on the remote machine. This uses the same trick as for [[Linux_Disk_Management#rsync|rsync]], which allows to run sudo commands via ssh:

<source lang=bash>
#If needed, pre-activate sudo on remote system. Flag -t required to solve 'sudo: no tty present and no askpass program specified'
#
# Also, this requires the following line in /etc/sudoers:
#
# Defaults !tty_tickets
#
stty -echo; ssh -t user@server sudo -v; stty echo

sudo ntfsclone --save-image -o - /dev/sdb1 | ssh -t user@server sudo ntfsclone --restore-image --overwrite /dev/sda4 -
#
# Process staled? --> Probably waiting on ssh password. Enter that password and press enter.
#
</source>

=== Backup Master Boot Record (MBR) ===
Backup the MBR (Master Boot Record), and table of partitions:
<source lang="bash">
sudo dd if=/dev/sda of=mypc-20111201-sda.mbr bs=512 count=2048 # Backup first 2MB to make sure we get MBR + any extension
sudo sfdisk -l -uS /dev/sda > mypc-20111201-sda-sfdisk.txt
sudo sfdisk -d /dev/sda > mypc-20111201-sda-sfdisk.dump # We can restore with sudo sfdisk /dev/sda < mypc-20111201-sda-sfdisk.dump
</source>

=== Backup a fresh Windows PC ===
Goals:
* Backup '''ALL''' Windows partitions<br/>So that it can be reinstalled even in case of a complete disk crash
* Reduce the size of Windows partitions<br/>So that to install Linux alongside

This procedure assumes there is only one disk (<tt>/dev/sda</tt>), and that we boot from a Linux USB stick.

# Backup '''MBR''' and '''ALL''' NTFS partitions '''AS IS''' (see above).<br/>This is just for safety in order to make sure we can recover in case the procedure below fails (typ. resize). This can be done using ''ntfsclone''.
# Shrink partitions.
# Backup '''MBR''' and '''ALL''' NTFS partitions again (see above)
# Reboot, test, and delete safety backups.

To do also:
* Save the session log
* Write a description of the pc (brand, etc), short description of the partitions
* Backup / encrypt the active password on backup partition (at least for the factory image)
* Do a ntfsresize --info of factory partition / keep a log of the ntfsresize (to know size of the volume)
* In gparted, create new partition aligned on cylinder



== Mount an NTFSClone image ==
Convert an image file to a file, and mount it
Convert an image file to a file, and mount it
<source lang="bash">
<source lang="bash">
gzip -d -c backup-20090908.img.gz | sudo ntfsclone --restore-image --overwrite backup.img -
gzip -d -c backup-20090908.img.gz | ntfsclone --restore-image --overwrite backup.img -
mount -t ntfs -o loop backup.ntfs /mnt/ntfsclone
sudo mount -t ntfs -o loop backup.ntfs /mnt/ntfsclone
</source>
</source>
<div style="padding-left:2em;">
<font color="red">'''! bug !'''</font> If you get an error '''<tt>Failed to read last sector (...): Invalid argument</tt>''', it is probably because the size of the image volume created by ntfsclone does not match the Image device size (the last cluster is incomplete). To fix this bug, simply pad the file with zeroes as necessary. Let's assume the following output for ntfsclone:
<font color="red">'''! bug !'''</font> If you get an error '''<tt>Failed to read last sector (...): Invalid argument</tt>''', it is probably because the size of the image volume created by ntfsclone does not match the Image device size (the last cluster is incomplete). To fix this bug, simply pad the file with zeroes as necessary. Let's assume the following output for ntfsclone:

...
...
Cluster size : 4096 bytes
Cluster size : 4096 bytes
Line 59: Line 213:
Image device size : 48057286656 bytes
Image device size : 48057286656 bytes
...
...

However the file generated by ntfsclone is smaller than the original device size:
However the file generated by ntfsclone is smaller than the original device size:

-rw------- 1 root root 48057283072 2010-03-26 00:07 e6500.ntfs
-rw------- 1 root root 48057283072 2010-03-26 00:07 backup.ntfs
We see that '''3584 bytes''' are missing. Simply pad the file:

Simply pad the file to the original length:
<source lang="bash">
<source lang="bash">
sudo truncate --size=48057286656 backup.ntfs # Extremely fast
dd if=/dev/zero bs=3584 count=1 >> e6500ntfs
dd if=/dev/zero bs=3584 count=1 >> backup.ntfs # ...OR... pad the missing 3584 bytes
mount -t ntfs -o loop backup.ntfs /mnt/ntfsclone
</source>
</source>

</div>
== Resizing an NTFSClone image ==
ntfsclone will fail if the original device size is bigger than the destination partition. To fix this, first resize the ntfsclone image by using a loop devices.

<source lang="bash">
gzip -d -c backup.img.gz | sudo ntfsclone --restore-image --overwrite backup.img -
sudo losetup /dev/loop0 backup.img
sudo ntfsresize --no-action --size 20000M /dev/loop0 # Testing
# If this fail with "Failed to read last sector", increase a bit the size
# of 'backup.img' using sudo truncate
sudo ntfsresize --size 20000M /dev/loop0
sudo truncate --size=20000M backup.img # For more safety, takes actual size of volume + cluster size
sudo ntfsfix /dev/loop0 # Fix any error on the volume
sudo losetup -c /dev/loop0 # Sync loop device with new file size
sudo ntfsclone --save-image -o - /dev/loop0 | gzip -c > backup-resized.img.gz
sudo losetup -d /dev/loop0
</source>
When truncating the file, check first the actual volume size (by calling ntfsclone), and use that size (that should be rounded to cluster size) plus another cluster size.

== Advanced features ==

=== NTFS extended attributes ===
See NTFS-3G home page for details ([http://jp-andre.pagesperso-orange.fr/extend-attr.html], [http://www.tuxera.com/community/ntfs-3g-advanced/extended-attributes/]).

First enable extended attributes:

<source lang=bash>
sudo mount -o streams_interface=xattr /dev/sda1 /mnt # note: xattr is supported by default
</source>

Then use <code>getfattr</code> / <code>setfattr</code> (package {{deb|attr}}) to copy ntfs attributes. For instance, to backup {{file|SAM*.*}} file attributes:
<source lang=bash>
#! /bin/bash

for f in SAM*; do
for ACL in ntfs_attrib_be ntfs_acl; do
sudo echo setfattr -h -v $(getfattr -h -e hex -n system.$ACL $f|grep '=' | sed -e 's/^.*=//') -n system.$ACL $f
done
done > restore_acl.sh
chmod a+x restore_acl.sh
</source>

== Windows 7 ==
Since Vista / Windows 7, Windows will use MBR Disk Signature to identify the hard drive and assigns it the proper drive letter. If this signature changes, Windows will see the disk as a new drive and assign it a new drive letter (typically D:). Since Windows will not find the boot drive (should be C:), boot will fail with an error 0xc00000e:

<source lang="text">
0xc00000e : Can't run WINLOAD.EXE
</source>

Workaround:
# Boot with the Windows7 DVD
# Choose the Repair option
# Reboot the repaired Windows7
# Remove all entries in the Registry HKLM\System\MountedDevices\ except Default
# Reboot with CloneZilla to make a new image
# Restore the new image: You should now be able to boot Windows7

Also better save the MBR for later reuse if needed with
<source lang="bash">
sudo dd if=/dev/sda of=sda.mbr bs=512 count=63
</source>

Reference:
* [http://sourceforge.net/projects/clonezilla/forums/forum/394751/topic/3523829 Can CZ Live image a Windows7 partition?]
* [http://www.multibooters.co.uk/mbr.html Vista's MBR Disk Signature]

Latest revision as of 17:29, 1 July 2015

This page is part of the Linux Disk Management pages.

References

Create

# 1) Create partition using sfdisk
# 2) Format the partition
mkntfs -Q -v -L "Data" /dev/sda3

Mounting

References

Mounting an NTFS partition using file /etc/fstab

First get the UUID of the partition to mount

sudo blkid

Edit /etc/fstab accordingly:

UUID=XXXXXXXXXXXXXXXXXXXXX /media/windows ntfs defaults,nls=utf8,umask=007,gid=46 0 1
Note that gid=46 refers to plugdev group.

Now the partition can be mounted with:

sudo mount /media/windows
Mounting a NTFS partition using command mount

To mount an NTFS partition /dev/sda1 to mount point /media/windows:

sudo mkdir /media/windows
sudo chgrp plugdev /media/windows
sudo mount -t ntfs -o defaults,nls=utf8,umask=007,gid=46 /dev/sda1 /media/windows
Mounting a NTFS partition with compression enabled
sudo mount -t ntfs -o defaults,nls=utf8,umask=007,gid=46 /dev/sda1 /media/windows

Use getfattr to see if a file is compressed or not

getfattr -n system.ntfs_attrib -e hex file
setfattr -h -n system.ntfs_attrib -v 0x00080000 file       # Set compression flag

NTFSFix

Use ntfsfix to fix errors on the NTFS partition (from package ntfsprogs). Say your partition is on /dev/sda1:

sudo ntfsfix /dev/sda1

This fix errors like:

$MFTMirr does not match $MFT (record 1).

Resize an NTFS Partition

Using GParted

The easiest is to use the graphical tool gparted, which shrinks / grows the partition but also edits the partition table

Using ntfsresize

Otherwise here is the equivalent command sequence (shrink partition /dev/sda1 to 35000MB):

# Shrink partition
sudo sfdisk -l /dev/sda                                               # Calibrate /dev/sda1 (get partition info)
sudo ntfsresize -i -f -v /dev/sda1                                    # Check file system
sudo ntfsresize --force /dev/sda1 --size 35000M --no-action           # Shrink file system, test first...
sudo ntfsresize --force /dev/sda1 --size 35000M                       # ... do it
# Edit MBR
sudo sfdisk ...                                                       # Shrink MBR partition
# Grow back partition to new size
sudo ntfsresize -i -f -v /dev/sda1                                    # Check file system
sudo ntfsresize --force /dev/sda1 --no-action                         # Grow file system to fill partition, test first...
sudo ntfsresize --force /dev/sda1                                     # ... do it

Backup an NTFS partition

Backup

  1. CLEAN the NTFS partition
    • Disable Windows Restore (will delete restore points)
    • Disable virtual memory (will delete page file)
    • Disable hibernation (will delete hibernat.sys).
    • Perform disk clean up (will empty recycle bin, etc)
    • Go to Outlook local data, and delete all cache .OST file
      better delete, then restart outlook once so that the .OST are recreated once for all (but quit before send & receive starts)
  2. SHRINK the NTFS partition
  3. Data usually do not occupy the full volume. By shrinking the partition, it will allow us to restore the backup on a partition smaller than the original one.
    The easiest for this step is to use GUI tool gparted (alternative is to use ntfsresize, see section above). Shrink the partition to its minimum size (give some slack, like few hundred MB, so that partition remains bootable w/o disk full error).
    sudo gparted
    
  4. BACKUP the NTFS partition
  5. sudo ntfsclone --save-image -o - /dev/sda1 | gzip -c > mypc-20090908-sda1-ntfs_resized.img.gz
    
  6. TEST the BACKUP
  7. Always good practice! Note that deleting everything & restoring afterwards to validate the backup is NOT a good idea.
  8. GROW the NTFS partition back to initial size.
  9. Again use either gparted or ntfsresize.
    sudo gparted
    # ... OR ...
    sudo ntfsresize --force /dev/sda1
    
  10. RESTORE windows features.
    • Enable virtual memory
    • Enable hibernation
    • Enable System Restore


Restore

  1. RESTORE the NTFS partition
  2. #zcat is better than gzip -d -c coz' autocomplete works!
    zcat mypc-20090908-sda1-ntfs_resized.img.gz | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
    
  3. GROW the NTFS partition back to initial size.
  4. Again use either gparted or ntfsresize.
    sudo gparted
    # ... OR ...
    sudo ntfsresize --force /dev/sda1
    
  5. RESTORE windows features.
    • Enable virtual memory
    • Enable hibernation
    • Enable System Restore


Backup / restore over network

To backup over the network, simply pipe to ssh:

sudo ntfsclone --force --save-image -o - /dev/sda1 | ssh user@myserver "gzip -c > hostname-sda1-ntfs.img.gz"
#Better?
sudo ntfsclone --force --save-image -o - /dev/sda1 | gzip -c | ssh user@myserver "cat > hostname-sda1-ntfs.img.gz"

To restore from the network, we do the reverse:

ssh user@myserver "zcat hostname-sda1-ntfs.img.gz" | sudo ntfsclone --restore-image --overwrite /dev/sda1 -
#Better?
ssh user@myserver "cat hostname-sda1-ntfs.img.gz" | zcat | sudo ntfsclone --restore-image --overwrite /dev/sda1 -

Note that we decompress the file locally to minimize amount of data to transfer through the network.

To backup and restore over the network, we need sudo access on the remote machine. This uses the same trick as for rsync, which allows to run sudo commands via ssh:

#If needed, pre-activate sudo on remote system. Flag -t required to solve 'sudo: no tty present and no askpass program specified'
#
# Also, this requires the following line in /etc/sudoers:
#
#    Defaults     !tty_tickets
#
stty -echo; ssh -t user@server sudo -v; stty echo

sudo ntfsclone --save-image -o - /dev/sdb1 | ssh -t user@server sudo ntfsclone --restore-image --overwrite /dev/sda4 -
#
# Process staled? --> Probably waiting on ssh password. Enter that password and press enter.
#

Backup Master Boot Record (MBR)

Backup the MBR (Master Boot Record), and table of partitions:

sudo dd if=/dev/sda of=mypc-20111201-sda.mbr bs=512 count=2048     # Backup first 2MB to make sure we get MBR + any extension
sudo sfdisk -l -uS /dev/sda > mypc-20111201-sda-sfdisk.txt
sudo sfdisk -d /dev/sda > mypc-20111201-sda-sfdisk.dump            # We can restore with sudo sfdisk /dev/sda < mypc-20111201-sda-sfdisk.dump

Backup a fresh Windows PC

Goals:

  • Backup ALL Windows partitions
    So that it can be reinstalled even in case of a complete disk crash
  • Reduce the size of Windows partitions
    So that to install Linux alongside

This procedure assumes there is only one disk (/dev/sda), and that we boot from a Linux USB stick.

  1. Backup MBR and ALL NTFS partitions AS IS (see above).
    This is just for safety in order to make sure we can recover in case the procedure below fails (typ. resize). This can be done using ntfsclone.
  2. Shrink partitions.
  3. Backup MBR and ALL NTFS partitions again (see above)
  4. Reboot, test, and delete safety backups.

To do also:

  • Save the session log
  • Write a description of the pc (brand, etc), short description of the partitions
  • Backup / encrypt the active password on backup partition (at least for the factory image)
  • Do a ntfsresize --info of factory partition / keep a log of the ntfsresize (to know size of the volume)
  • In gparted, create new partition aligned on cylinder


Mount an NTFSClone image

Convert an image file to a file, and mount it

gzip -d -c backup-20090908.img.gz | ntfsclone --restore-image --overwrite backup.img -
sudo mount -t ntfs -o loop backup.ntfs /mnt/ntfsclone

! bug ! If you get an error Failed to read last sector (...): Invalid argument, it is probably because the size of the image volume created by ntfsclone does not match the Image device size (the last cluster is incomplete). To fix this bug, simply pad the file with zeroes as necessary. Let's assume the following output for ntfsclone:

...
Cluster size           : 4096 bytes
Image volume size      : 48057282560 bytes (48058 MB)
Image device size      : 48057286656 bytes
...

However the file generated by ntfsclone is smaller than the original device size:

-rw------- 1 root     root     48057283072 2010-03-26 00:07 backup.ntfs

Simply pad the file to the original length:

sudo truncate --size=48057286656 backup.ntfs    # Extremely fast
dd if=/dev/zero bs=3584 count=1 >> backup.ntfs  # ...OR... pad the missing 3584 bytes

Resizing an NTFSClone image

ntfsclone will fail if the original device size is bigger than the destination partition. To fix this, first resize the ntfsclone image by using a loop devices.

gzip -d -c backup.img.gz | sudo ntfsclone --restore-image --overwrite backup.img -
sudo losetup /dev/loop0 backup.img
sudo ntfsresize --no-action --size 20000M /dev/loop0       # Testing
                                                           # If this fail with "Failed to read last sector", increase a bit the size
                                                           # of 'backup.img' using sudo truncate
sudo ntfsresize --size 20000M /dev/loop0
sudo truncate --size=20000M backup.img                     # For more safety, takes actual size of volume + cluster size
sudo ntfsfix /dev/loop0                                    # Fix any error on the volume
sudo losetup -c /dev/loop0                                 # Sync loop device with new file size
sudo ntfsclone --save-image -o - /dev/loop0 | gzip -c > backup-resized.img.gz
sudo losetup -d /dev/loop0

When truncating the file, check first the actual volume size (by calling ntfsclone), and use that size (that should be rounded to cluster size) plus another cluster size.

Advanced features

NTFS extended attributes

See NTFS-3G home page for details ([1], [2]).

First enable extended attributes:

sudo mount -o streams_interface=xattr /dev/sda1 /mnt     # note: xattr is supported by default

Then use getfattr / setfattr (package attr) to copy ntfs attributes. For instance, to backup SAM*.* file attributes:

#! /bin/bash

for f in SAM*; do 
  for ACL in ntfs_attrib_be ntfs_acl; do 
    sudo echo setfattr -h -v $(getfattr -h -e hex -n system.$ACL $f|grep '=' | sed -e 's/^.*=//') -n system.$ACL $f
  done
done > restore_acl.sh
chmod a+x restore_acl.sh

Windows 7

Since Vista / Windows 7, Windows will use MBR Disk Signature to identify the hard drive and assigns it the proper drive letter. If this signature changes, Windows will see the disk as a new drive and assign it a new drive letter (typically D:). Since Windows will not find the boot drive (should be C:), boot will fail with an error 0xc00000e:

0xc00000e : Can't run WINLOAD.EXE

Workaround:

  1. Boot with the Windows7 DVD
  2. Choose the Repair option
  3. Reboot the repaired Windows7
  4. Remove all entries in the Registry HKLM\System\MountedDevices\ except Default
  5. Reboot with CloneZilla to make a new image
  6. Restore the new image: You should now be able to boot Windows7

Also better save the MBR for later reuse if needed with

sudo dd if=/dev/sda of=sda.mbr bs=512 count=63

Reference: