Introduction:
This section show that how to create image of an installed Windows XP and restore it back using Linux utilities. Linux utilities used are 'ntfsclone' and 'dd'. ntfsclone was used as it creates images of ntfs partition efficiently copying only used blocks from disk. dd will copy entire HD image wasting a lot of space. We will create image over the network.
Preparation:
We had used a windows XP system.
A Liveubuntu CD (10.04)and Internet connection.
A destination machine which will recieve the Backup image over the network. SSH server must be installed and running on it.
Backing Steps:
The windows system had single 75 GB partition. Boot the system from Live CD. if network has DHCP server machine will be on the network and may be able to connect to internet as well.
To work remotely , install openssh . This is optional not required.
sudo aptitude install openssh-server
After this optinal step perform following .
Backup NTFS partition to an Image and save it to remote location:
sudo ntfsclone --save-image --output - /dev/sda1 | gzip -c | ssh testuser@192.168.1.203 'cat - > /home/testuser/IMAGES/diskimage.img.gz'
Backup MBR and Partition Information:
First 446 bytes of MBR (sector 0) conatins boot code. We want to copy the boot code only. Next 64 Bytes contains the Partition table. We do not want to copy the partition table because destination disk may be larger in size and thus will have different C/H/S information. We will copy partition information based on sectors only. And in restoring process we will create partition table based on this sector information only. Partitions created with sectors are more accurate rather than cylinders. Thus making exact partitions on new disk with old information will be easier and much accurate.
Copy the Boot code.
sudo dd if=/dev/sda bs=446 count=1 | ssh testuser@192.168.1.203 'dd of=/home/testuser/IMAGES/MBR446.img'
Copy the Partition information using secotrs as unit.
sudo sfdisk -d /dev/sda | ssh testuser@192.168.1.203 'cat - > /home/testuser/IMAGES/partitionInfo.txt'
Opitonally backup fdisk information:
sudo fdisk -u -l | ssh testuser@192.168.1.203 'cat - > /home/testuser/IMAGES/fdisk.txt'
In above commad -u gives sectors rather than cylinders in the output.
Restoring Steps:
Boot the system with LIVE CD. and bring it on the network. It will be by default if network is available and DHCP server is running in network.
Restore MBR:
Restore the Boot code:
ssh testuser@192.168.1.203 'dd if=/home/testuser/IMAGES/MBR446.img' | dd of=/dev/sdb
Create partitions exactly as it were present on old disk.
ssh testuser@192.168.1.203 'cat /home/testuser/IMAGES/partitionInfo.txt' | sfdisk /dev/sdb
Note: We had used the 160GB drive as the restore drive (destination drive). Original drive was 80GB. Both drives were connected to same computer. 80GB drive was /dev/sda and 160GB drive was /dev/sdb.
Restore NTFS partition:
ssh testuser@192.168.1.203 'cat /home/testuser/IMAGES/diskimage.img.gz' | gunzip -c | ntfsclone --restore-image --overwrite /dev/sdb1 -
When the above step is finished, reboot the system with the second drive. (you may disconnect the first drive). If eveything goes fine it will not complain anything not even filesystem check. System may ask for the reboot after first login because it has detected new disk and have installed its driver. Reboot the system when this message appears. Thats it.