On the job over the past couple years, I’ve developed a really solid workflow
for backing up Windows computers quickly and reliably. It’s so fast and easy
that we make full system backups before we attempt any potentially destructive
job such as malware removal or a Windows Repair Install.
(Note: In some cases, it is helpful to defragment your filesystems before
you begin. See the bit below on ntfsresize to find out whether this applies to
you.)
First, you need a bootable Ubuntu Live distribution. I recommend using a USB
flash drive if you can, as it boots and loads programs sooo much faster. But a
CD works just as well (and more universally). Download an Ubuntu ISO.
Don’t try to get fancy. The most universally compatible and useful version is
the 32-bit Desktop edition. Now either burn the ISO to a CD or set up a USB
flash drive. If you can, use Ubuntu’s own USB Creator for this. If you’re
not running Ubuntu, use Unetbootin.
Boot
Boot from the CD or USB media that you made. You’re probably going
to need to install something, so ensure that you have a network
connection and
Set Up a Backup Destination
You need a destination for your backup. You can use another hard drive, some
USB-attached storage, or a network location. If you don’t know what backup
media to use or how to format and mount it, try Googling it. This page
may also help. (Tip: Use cfdisk, not parted, fdisk, sfdisk, etc. Partition
type 07 for NTFS, 82 for ext. Don’t use FAT32.)
If you’re going to use Samba (Windows share), the command looks something like
this:
sudo apt-get install -y smbfs
sudo mount //server/share /mnt -ousername=yourname
If you’re going to use NFS, the mount command looks something like this:
sudo apt-get install -y nfs-common
mount server:/path/to/export /mnt
Now I’m going to assume you got through all of that, and your backup target is
mounted on /mnt.
Get ntfsprogs
In Ubuntu 9.10, ntfsprogs is present on the Live distribution. If you don’t
have it, you need to
sudo apt-get install -y ntfsprogs
Backup
For all of the following, I’m assuming that you’ve mounted your backup target
to /mnt and your backup source is /dev/sda. If this isn’t true, adjust
accordingly. If it is, you can mostly copy and paste these commands.
Back up your partition table (-l lists the partitions and -d writes a format
that can be piped directly back into sfdisk. Super convenient.)
sfdisk -ld /dev/sda > sda.sfdisk
At this point, you can choose to shrink your NTFS filesystems before you back
them up. They won’t occupy any less disk space–ntfsclone does a
filesystem-aware block copy that doesn’t use space for unused blocks. The
benefit of doing this is that it does enable you to restore the filesystem to a
smaller partition in the future.
Resize the Filesystem (optional)
First, get an estimate of the space you can save
sudo ntfsresize -i /dev/sda1
Look for a line resembling this:
You might resize at 42704896000 bytes or 42705 MB (freeing 3965 MB).
ntfsresize can handle a finite (and kind of small) amount of extents, or file
fragments. If your filesystem is fragmented, you can’t reclaim as much space.
You may want to defrag (from within Windows) before you get started.
So make several dry runs until you find a resize that works. Try
sudo ntfsresize -n -s 42706M /dev/sda1
If you get something like
ERROR: Extended record needed (3696 > 1024), not yet supported!
Run it again. Just bump the size up by 100M or so at a time until it says
The read-only test run ended successfully.
Then run it again without the -n, like
sudo ntfsresize -s 43706M /dev/sda1
Back to the Backup
Finally, back up your NTFS partition(s):
sudo ntfsclone -s -o sda1.ntfsclone /dev/sda1
Repeat, substituting 1 with the number of the partition for each NTFS
partition.
That’s it!
Restoring
If you were to now start from scratch with a similar disk, you would cd into
your backup directory and run
sudo sfdisk /dev/sda < sda.sfdisk
sudo ntfsclone -r -O /dev/sda1 sda1.ntfsclone
sudo ntfsresize /dev/sda1 --force
And you’re fully restored. Neat, huh?
You can do something similar with other filesystems using tools like partimage,
and you can rescue data from damaged filesystems and disks using GNU ddrescue.
Google it.