Poor Man's Drive Imaging and Backup

Most of you have probably heard of products like Norton Ghost, Powerquest Drive Image, or similar disk imaging software. If you need to create an exact duplicate of the data so that you can restore it quickly in the event of data loss or hardware failure these two products can fill your need. There's even partimage, that will make an image of a drive and compress it for restoration later.

However, Norton Ghost and Drive Image are rather pricey (close to US$1000) if you want to back-up a non desktop OS like Windows 2000 Server (Standard or Advanced) or Windows NT Server. The consumer level version of these products won't install on those OS's, and partimage only experimentally supports NTFS.

And what if you don't have the money to buy these products, especially if you need to backup 20 or so servers or workstations from time to time.

Along comes a neat little *nix (or *BSD) tool called dd. It is a very powerful (and dangerous) tool that takes input from any sort of partition (/mnt/path), device (/dev/hda), or even a network mounted (NFS, SAMBA, nc) sources and outputs it to the same myriad of destinations.

The simple way is to use dd to create an image of a hard disk and copy it to another disk. This will give you an exact duplicate of the original disk, free space and all. However, if you are only using 10GB of a 60GB hard drive, you waste a lot of space imaging the empty sections of your disk. On a server this could get to be quite a headache, as you can have many large drives to image, and would require the same sized disks to back them up on.

So, in the tradition of other articles such as "Poor Man's Ghost", I present to you instructions to take any source drive and back it up, all while compressing the image so it takes up quite a bit less space. For this set of instructions, all you need is a secondary hard drive to store the images on, and a bootable CD Linux distro such as Knoppix (or any of its variants).

In my example I used Knoppix 3.3 to backup a 60GB Hard Drive with Windows XP Professional installed. The disk image storage drive is 120GB, enough space to normally store two 60GB images.

I'm going to assume this is a brand new backup drive, so I'll walk through the steps of creating a partition and formatting it for use.

First boot the Knoppix CD, and at the prompt type:

knoppix 2

This will boot Knoppix into Console-only mode. You can optionally just press enter at the prompt and work with the full KDE interface, but its not really necessary.

So, in our computer we have two IDE hard drives (original and backup) and one CD-ROM drive. Usually (though not always), the Master drive on the primary IDE channel is hda, the Slave is hdb, on the secondary IDE channel you have hdc (Master) and hdd (Slave). In our case both hard drives are on the primary channel, so the original is hda and the backup drive is hdb. This isn't really a good idea, due to IDE signaling slowing down transfer rates on the same channel, though if you have SATA (Serial ATA) this is not a problem - but for this example it makes things less confusing.

If you aren't sure which disk is which (and even if you are I would recommend doing this), issue the following command:

root@tty1[/]#fdisk -lu

This will show you a list of all of your drives, their sizes, and partition types. In our example, one shows NTFS/HPFS (hda) and the other shows no valid partition (hdb).

Knoppix and most CD distros don't turn on 32-bit drive access and DMA by default, so we're going to do that here so that we can increase transfer rates by 400-500% over 16-bit PIO mode:

root@tty1[/]#hdparm -c 1 -d 1 -k 1 /dev/hda (If your hard disk supports 32-bit I/O "c" and DMA "d")
root@tty1[/]#hdparm -c 1 -d 1 -k 1 /dev/hdb (If your hard disk supports 32-bit I/O "c" and DMA "d")

Now we're going to prepare the new disk by creating a new primary ext2fs partition on hdb that uses the entire drive:

root@tty1[/]#fdisk /dev/hdb
Command (m for help): n (For a new partition)
Create primary partition #1 with size equal to entire disk('p', then '1', then 'return')
Command (m for help): w (to write the changes and quit)
root@tty1[/]#mke2fs -c /dev/hdb1 (Will use entire partition)

Now we're going to create a directory "dskimgs" to hold our image, and mount our new partition to that directory:

root@tty1[/]#mkdir /dskimgs
root@tty1[/]#mount -t auto /dev/hdb1 /dskimgs

We should be now all set to make an image of the original and compress it, storing the image into a file called 'diskimage.gz'. We use gzip and maximum compression "-9" here. You can use any compression agent you wish, its just that gzip is usually present in any distro by default.

root@tty1[/]#dd if=/dev/hda bs=1k | gzip -c9 > /dskimgs/diskimage.gz

In that line, we take dd's input and pipe it to gzip a 1024-byte size block at a time, which with the -c option sends the compressed image to standard out, which we redirect to a file. You can try larger bs= sizes if you have the memory for it, since the compression is done in memory. I've used 1024K blocksizes before.

This takes about 90 minutes to run with our original 60GB hard drive. After its done, we have a 14GB file which contains an exact duplicate of the original drive.

How do we restore our image from hdb to hda if we need? Easy, just do most of the same steps with a change in our last command:

Boot the Knoppix CD:

knoppix 2
root@tty1[/]#hdparm -c 1 -d 1 -k 1 /dev/hda (If your hard disk supports 32-bit I/O "c" and DMA "d")
root@tty1[/]#hdparm -c 1 -d 1 -k 1 /dev/hdb (If your hard disk supports 32-bit I/O "c" and DMA "d")
root@tty1[/]#mkdir /dskimgs
root@tty1[/]#mount -t auto /dev/hdb1 /dskimgs
root@tty1[/]#gzip -cd /dskimgs/diskimage.gz | dd of=/dev/hda

The last line uncompresses the drive image to standard out, which we pipe to dd's output which is the hda drive.

Now remove hdb and reboot, and your OS is back just like it was when you imaged it. (In our example, the restore took about 30 minutes to complete).

DISCLAIMER: Use this at your own risk, no guarantees or any other warranties are implied or transferred. This may or may not work for you.