Imaging Hard Drives

[Kevin Hunter Kesling]

Yeah, dd is generally my tool of choice as well when I simply need a raw 
image - an exact duplicate of the exact bytes on a device.

The plus to me is that because dd is so simple and so low-level, I 
*know* the image is bit for bit the same.   I can't always trust higher 
level tools to this degree, and have been bitten when claims don't meet 
reality.  dd has never done this to me.

A suggestion, if using it for this type of imaging: dd can operate below 
the file system layer, and so views devices as simply a string of 1's 
and 0's.  Knowing this, you can prepare a device prior to taking an 
image so that you can store your image a lot more efficiently. 
Basically, write a bunch of zeros to a file, then delete that file, then 
take your image.  In CLI:

     $ dd if=/dev/zero of=./big_empty_file_of_zeros bs=1M
     ... No space left on device

     $ rm ./big_empty_file_of_zeros

     $ dd if=/dev/sdX bs=1M | pigz > img.gz

Using this trick, you are only storing the data and the rest gets 
compressed away.  For example we recently delivered a 2 TiB image to a 
client, but the image only had about 3 GiB of actual data.  This method 
meant we gave them a file of about 1.5 GiB (easily on a thumb drive), 
and they still got their 2 TiB image.

Cheers,

Kevin

At 6:22am -0400 Mon, 29 Aug 2016, David Brown (Test Dept) wrote:
> I would just dd all partition(s) to a file.
>   dd if=/dev/sdx of=mydisk.img
> To restore to a disk that is the same size or bigger:
>   dd if=mydisk.img of=/dev/sdx
>
> David (Doc) Brown
>
> -----Original Message-----
> From: cinlug On Behalf Of Bernie Hoefer
> Sent: Friday, August 26, 2016 9:26 PM
> To: cinlug at lists.cinlug.org
> Subject: Imaging Hard Drives
>
>      I came across something today that I wanted to share with the group.
>      I wanted to make a `perfect` copy of one of my computer's hard drives.  Basically, I wanted to image it so that if I needed, I could restore the hard drive to the *exact* condition it is in, today.
>      I normally use SystemRescueCD's partimage for this task.  But while looking online for some other information, I stumbled across the fact that partimage hasn't been actively developed for about 6 years![1]
>      It seems there is another program that is actively developed[2] that has improved features over partimage.[3]  I especially like the ability to restore the file system to a partition which is smaller than the original.
>      Unfortunately, NTFS support is "experimental".  Since fsarchiver is not a block-level imaging program like partimage is, some of the NTFS file system peculiarities cause more trouble for fsarchiver.[4]  I could not archive a Windows 7 NTFS; I kept getting errors like this:
>
>   [errno=31, Too many links]:
>   oper_save.c#349,createar_item_winattr(): winattr:
>   lgetxattr(/dell/Image/Factory3.wim,system.ntfs_dos_name):
>   returned negative attribute size
>
>      Despite its failure with Windows 7 NTFS,[5] I still thought this tool was commendable and wanted to share!
>
>
> [1]<http://www.partimage.org/Changelog>
> [2]<http://www.fsarchiver.org/Changelog>
> [3]<http://www.fsarchiver.org/Fsarchiver_vs_partimage>
> [4]<http://www.fsarchiver.org/Cloning-ntfs#Limitations>
> [5]Apparently this is just a Windows 7/8/10 problem?