Switch to SpeakEasy.net DSL

The Modular Manual Browser

Home Page
Manual: (Debian-3.1)
Apropos / Subsearch:
optional field

NTFSCLONE(8)                System Manager's Manual               NTFSCLONE(8)

       ntfsclone - Efficiently clone, image or restore an NTFS filesystem

       ntfsclone [OPTIONS] source
       ntfsclone --save-image [OPTIONS] source
       ntfsclone --restore-image [OPTIONS] source
       ntfsclone --metadata [OPTIONS] source

       ntfsclone  will efficiently clone (copy, save, backup, restore) an NTFS
       filesystem to a sparse file, image, device (partition) or standard out-
       put.   It  works  at  disk  sector level and copies only the used data.
       Unused disk space becomes zero (cloning to sparse file),  encoded  with
       control codes (saving in special image format), left unchanged (cloning
       to a disk/partition) or filled with zeros (cloning to standard output).

       ntfsclone can be useful to make backups, an exact snapshot of  an  NTFS
       filesystem  and  restore  it  later  on, or for developers to test NTFS
       read/write functionality, troubleshot/investigate users'  issues  using
       the clone without the risk of destroying the original filesystem.

       The  clone,  if not using the special image format, is an exact copy of
       the original NTFS filesystem from sector to sector thus it can be  also
       mounted  just  like  the  original NTFS filesystem.  For example if you
       clone to a file and the kernel has loopback  device  and  NTFS  support
       then the file can be mounted as

              mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone

       A  file  is  sparse  if it has unallocated blocks (holes). The reported
       size of such files are always higher than the disk  space  consumed  by
       them.   The  du  command  can tell the real disk space used by a sparse
       file.  The holes are always read as zeros. All major  Linux  filesystem
       like, ext2, ext3, reiserfs, Reiser4, JFS and XFS, supports sparse files
       but for example the ISO 9600 CD-ROM filesystem doesn't.

       As of today Linux provides inadequate support for  managing  (tar,  cp,
       gzip,  gunzip,  bzip2, bunzip2, cat, etc) large sparse files.  The only
       main Linux filesystem having support for efficient sparse file handling
       is XFS by the XFS_IOC_GETBMAPX ioctl.  However none of the common util-
       ities supports it.  This means when you tar, cp,  gzip,  bzip2,  etc  a
       large  sparse  file  they will always read the entire file, even if you
       use the "sparse support" options.

       bzip2 compresses large sparse files much better than gzip but  it  does
       so  also  much  slower.  Moreover  neither of them handles large sparse
       files efficiently during uncompression from disk space usage  point  of

       At  present  the most efficient way, both speed and space-wise, to com-
       press and uncompress large sparse files by common tools  is  using  tar
       with  the options -S (handle sparse files "efficiently") and -j (filter
       the archive through bzip2). Altough tar still reads  and  analyses  the
       entire file, it doesn't pass on the large data blocks having only zeros
       to filters and it also avoids writing large amount of zeros to the disk
       needlessly.  But  since  tar  can't create an archive from the standard
       input, you can't do this in-place by just  reading  ntfsclone  standard

       It's also possible, actually it's recommended, to save an NTFS filesys-
       tem to a special image format.   Instead  of  representing  unallocated
       blocks  as holes, they are encoded using control codes. Thus, the image
       saves space without requiring sparse file support. The image format  is
       ideal for streaming filesystem images over the network and similar, and
       can be used as a replacement for Ghost or Partition Image if it is com-
       bined  with other tools. The downside is that you can't mount the image
       directly, you need to restore it first.

       To save an image using the special image format,  use  the  -s  or  the
       --save-image   option.   To  restore  an  image,  use  the  -r  or  the
       --restore-image option. Note that you can restore images from  standard
       input by using '-' as the source file.

       One  of  the  features  of ntfsclone is that, it can also save only the
       NTFS metadata using the option -m or --metadata  and  the  clone  still
       will  be  mountable. In this case all non-metadata file content will be
       lost and reading them back will result always zeros.

       The metadata-only image can be compressed very  well,  usually  to  not
       more  than  1-3 MB thus it's relatively easy to transfer for investiga-
       tion, troubleshooting.

       In this mode of ntfsclone, NONE of the user's data is saved,  including
       the  resident  user's  data  embedded into metadata. All is filled with
       zeros.  Moreover all the file timestamps,  deleted  and  unused  spaces
       inside  the  metadata are filled with zeros. Thus this mode is inappro-
       priate for example for forensic analyses.

       Please note, filenames are not wiped out. They might contain  sensitive
       information, so think twice before sending such an image to anybody.

       Below  is  a  summary  of  all the options that ntfsclone accepts.  All
       options have two equivalent names.  The short name is preceded by - and
       the long name is preceded by --.  Any single letter options, that don't
       take an argument, can be combined into a single command, e.g.   -fm  is
       equivalent to -f -m.

       -o, --output FILE
              Clone  NTFS  to the non-existent FILE. If FILE is '-' then clone
              to the standard output.

       -O, --overwrite FILE
              Clone NTFS to FILE, overwriting if exists.

       -m, --metadata
              Clone ONLY METADATA (for NTFS experts). Moreover only cloning to
              a  file  is allowed.  You can't metadata-only clone to a device,
              image or standard output.

       -s, --save-image
              Save to the special image format.

       -r, --restore-image
              Restore from the special image format specified by  source.   If
              the  source  is  '-'  then  the  image is read from the standard

       -f, --force
              Forces ntfsclone to proceed if the filesystem is marked  "dirty"
              for consistency check.

       -h, --help
              Show a list of options with a brief description of each one.

       Save an NTFS to a file in the special image format

              ntfsclone --save-image --output ntfs-backup.img /dev/hda1

       Restore an NTFS from a special image file to its original partition

              ntfsclone --restore-image --overwrite /dev/hda1 ntfs-backup.img

       Save  an  NTFS into a compressed image. Note, gzip is faster usually at
       least 2-4 times than bzip2 but it creates also bigger compressed files.

              ntfsclone --save-image -o - /dev/hda1 | bzip2 -c >> ntfs.img.bz2

       Restore an NTFS volume from a compressed image file

              bunzip2 -c ntfs.img.bz2 | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Backup an NTFS volume to a remote host, using ssh.

              ntfsclone --save-image --output - /dev/hda1 | \
              gzip -c | ssh host 'cat >> ntfs.img.gz'

       Restore an NTFS volume from a remote host via ssh.

              ssh host 'cat ntfs.img.gz' | gunzip -c | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Stream an image from a web server and restore it to a partition

              wget -qO - http://server/ntfs.img | \
              ntfsclone --restore-image --overwrite /dev/hda1 -

       Clone an NTFS volume to a non-existent file

              ntfsclone --output ntfs-clone.img /dev/hda1

       Pack NTFS metadata for NTFS experts

              ntfsclone --metadata --output ntfsmeta.img /dev/hda1
              tar -cjSf ntfsmeta.img.tar.bz2 ntfsmeta.img

       This program has no known bugs. If you think you have  found  one  then
       please send an email to <linux-ntfs-devATlists.net>.

       Sometimes  it  might appear ntfsclone froze if the clone is on ReiserFS
       and even CTRL-C won't stop it. This is not a bug in ntfsclone,  however
       it's  due to ReiserFS being extremely inefficient creating large sparse
       files and not handling signals during  this  operation.  This  ReiserFS
       problem  was  improved  in kernel 2.4.22.  XFS, JFS and ext3 don't have
       this problem.

       ntfsclone was written by Szabolcs Szakacsits <szakaATsienet.hu>.

       Special   image   format   support   was   added   by   Per    Olofsson

       ntfsclone is part of the ntfsprogs package and is available from

       ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)

ntfsprogs version 1.9.4            Sep 2004                       NTFSCLONE(8)