This article is part of BackupYourSystem, for more information on backup, see that article, it provides more introductory information as well as alternative means of backup.
Read ALL of this article and understand what you are doing BEFORE proceeding. Improperly imaging a drive can result in severe data loss, especially with a command line program like dd. Ensure you understand what is being done!
Drive imaging is basically the copying of every byte of data within a certain section of a hard drive; be it just a partition or an entire drives contents. Once the snapshot of the drive (a term used to refer to an image created on a certain date) is taken, it can be used later to restore the partitions or entire drive to the EXACT state it was backed up at. This is important to understand, all new files will be destroyed. For this reason, it is important to use an incremental backup system such as archive creation or folder synchronization to preserve changes made after the snapshot, both are explained in this article's parent.
Information on Pseudo-Graphical Programs
Before continuing, please read and understand more about partitions and drives in general. Additionally, there are two means of imaging, with a pseudo-graphical interface or simply from the command such as dd from any command line interface (explained in parent article). Pseudo-graphical interfaces haven't been explained yet, they denote a half way point between a true graphical program and a terminal program. The former relies on graphical libraries to generate a GUI with buttons and images usually, like Simple Backup Suite). Terminal programs by contrast have no graphical component and simply accept text commands and arguments. Pseudo-graphical environments basically generate a region of text within a terminal that can be highlighted and clicked like a button or used for entry of data like a path to a file. These environments are manipulated exclusively by keyboard as follows:
Tab - Is used to move from one text region to the next, it could be a button, an area to check an option or even for text entry.
Arrow Keys - Are used to move about within a designated region, exact function depends on the active selection.
Enter/Return - Is used to select whatever is under selection.
- The rest of the standard keyboard operates as normal for text entry where applicable, like writing a path.
Just like modifying partitions, drive imaging requires exclusive access to a drive. The drive being backed up shouldn't be mounted. If you are backing up your root or /home directories for instance, or another partition frequently used while booted, it is advisable to boot into a live CD and operate from there. Alternatively, see the SystemRescueCD below, a highly customized live CD designed for backup and recovery.
One additional step required is that images must be created somewhere. From any live environment, you can mount a USB drive, network share or local partition (ensure it is NOT being backed up, simply written to). All such mounted drives should be under /media, know the path of device. For instance, is my USB drive was labelled Shadow, it would automatically mount to /media/Shadow upon attachment.
To get partimage on a liveCD ensure Universe section of the Ubuntu repositories is enabled in your Software Sources. To install this software in Ubuntu, install the following package: partimage. Note well, partimage is only currently functional on 32 bit systems. 64 bit users will have to use a 32 bit live CD or see below.
For those without a net connection, download and burn the SystemRescueCD. It comes configured with gparted, partimage, testdisk, and a full GUI environment (among other things). It is well suited to backup as well as recovery.
In either case, once booted into the live environment with partimage installed, simply call the program in any terminal available with the following command:
Above is the first screen you will be confronted with. I shall go through every area and the options presented so you understand.
Partition to save/restore - Lists all of the partitions on all drives available to be backed up from or restored to. You can only do one partition or drive at a time, so select as you will.
Image file to create/use - In this textbox, you will enter the path to the first file (it is possible to split archives) that contains the backup you have created. If you are creating a new backup, the path here should direct to the mounted partition you wish to create the image. In the case above, /media/Shadow/partimage/RootBackup.Sept262009 would create a backup with the designated name in a folder called partimage on Shadow. I advise you date your archives to keep track of them, also would be well to include in name partition backed up.
- Action to be done: Several options are listed here, they are:
Save partition into a new image file - This will tell partimage to backup the partition listed in Partition to save/restore and save to an image file created in the location specified under Image file to create/use.
Restore partition from an image file - This will tell partimage to restore the partition listed in Partition to save/restore to the state saved in the designated Image file to create/use. Note, be sure you use the right image for the right partition. Trying to restore an image of 50GB to a partition that can only hold 5GB of data will not work.
Restore an MBR from an image file - This option will restore the MBR of the drive in question listed under Partition to save/restore to the state saved in the designated Image file to create/use.
Connect to server - This option will allow you to connect remotely to a server. It is much easier to mount network shares in the live environment prior to starting partimage. Nonetheless, this option remains for more advanced users to make use of.
The Next, About and Exit buttons are all fairly self-explanatory. On to the next screen. Users restoring an image, will not need the second screen.
On this second screen we will be selecting options that will apply to the creation of our archive. I will explain them in much the same way as before.
Compression level - Select the level of compression you would like to apply to the image created. More compression reduces the final image size, however it takes time, especially on older CPUs. Each is explained in brackets, I advise Gzip to be used, as Bzip2 support is still under development and won't allow you to restore an MBR.
Options - Miscellaneous options to be used.
Check partition before saving - Checks the integrity of the disk before archiving it in a snapshot. Recommended for people who don't run such checks often, or in doubt.
Enter description - Allows user to enter a description of the archive, this will be readable by partimage prior to restoring. Recommended, but not essential so long as your naming system for snapshots is understandable.
Overwrite without prompt - If you know for certain you will overwrite an old image, select this option.
Image split mode - Allows images to be split for archiving longterm. This is useful for those storing on old file systems with low maximum file size (such as FAT32 with it's 4GB cap) or for those wanting to burn to CD the images after.
Automatic split (when no space left) - This option will simply write one large image file until it runs out of space, ensure you have the required space before starting.
Into files whose size is:.... X - Simply put, when the image reaches the size X (in Mib) it will make a new file automatically generated, much like archive creation with zip files. Each subsequent one will be numbered, 001, 002, etc... until finished.
Wait after each volume change - Will allow you to specify a new place to save a partition after each new partition.
If finished successfully: - Will instruct partimage what to do after completing the listed backup operation, options are standard. By default, will wait for new instructions.
Once desired options are set, please select Continue. Exit and Main window do what would be expected. Users who opted to enter a description, will be prompted to do so after selecting to Continue. Otherwise, users will be taken to backup screen and the backup will be carried out after one final confirmation. Ensure all information is correct before approving the operation.
Backup or restore would be completed then, and a new operation can be carried out or program quit.
Another pseudo-graphical program like partimage, is Clonezilla. Some prefer it. Information on it's operation and to retrieve it can be found on it's website.
Creating Disc Images Using dd
Read carefully and don't make typos!
dd is an old command line program used for low level copying of files. It is a legacy program from UNIX, as such it does not behave or configure like traditional programs in the GNU suite. Caution is advised, using this command with the wrong operators can cause serious data loss.
In the following commands, if and of are short for input file and output file respectively. As the names imply, the input is the partition being backed up and output is the directory where the archive is created. Last important note, you need to know what partition you want to backup and what it's label is. To find out, open a terminal and use the following command:
sudo fdisk -l
The output of the command will list each hard drive installed, and all the partitions on it. It is usually possible to tell which is which by looking at the filesystem installed (ntfs for Windows, Linux for Linux) and the size it occupies on the disk. The user is responsible for knowing which partition is to be backed up. In the following examples replace /dev/hda1 with the name of the partition listed under device boot in the output. Those who prefer a graphical display of your partitions, use gparted. If you want to backup an entire drives data, rather than simply a partition on it, omit the number after the drive name, in our example, use hda.
One additional important note is that if you are restoring a partition to the hard drive, it is highly recommended that you work from a live CD session of Ubuntu. Restoring partitions that are in use (i.e. while booted in Ubuntu or Windows) will cause errors.
Backup with dd
The following are simply examples to understand use of dd, they are informational in nature. Do not simply copy them and use them in a terminal, ensure their use is understood and that they have been modified to a user's specific situation and needs.
The following example will create a drive image of partition hda1, the image will be created in the home directory as the file hda1.bin .
dd if=/dev/hda1 of=/home/hda1.bin bs=1024
This command creates the drive image and then passes it through gzip for compression. Bzip2 could be substituted instead of gzip for greater compression.
dd if=/dev/hda1 bs=1024 | gzip > /home/hda1.bin.gz
Back up the MBR of the hard drive labelled hda.
dd if=/dev/hda of=/home/hda.boot.mbr bs=512 count=1
The following command will overwrite drive hdb to have the same data as hda, this will wipe out all data previously on hdb. This is the same as synchronizing all data on the first drive with the second.
dd if=/dev/hda of=/dev/hdb conv=noerror,sync bs=1024
Restoring a Drive Image
To restore a drive image, as noted above always perform such an action from a live environment to avoid problems with the running operating system, unless your certain it won't conflict. The drive or partition you want to restore to must be exactly equal to or larger than the original size of the partition. Restoration is quite simple, and really just involves reversing the if and of values. This will tell dd to overwrite the drive or partition with the data that is stored in the file. ALLOne caveat, ensure the file dd is using as reference isn't stored on the partition or drive you're restoring to. If you do this, eventually during the operation dd will overwrite the reference and then fail. Best to use an external/other drive or network storage to hold such drive image archives.
First go superuser and switch to runlevel 1 so that you can fumble around with the harddisk without other services interfering:
sudo -i init 1
To restore the first partition on hda continuing our example, we would do the following.
dd if=/home/hda1.bin of=/dev/hda1 bs=1024
To restore a gzipped image of a partition we would use the following syntax (substitute bzip2 for gzip if you used bzip2 compression):
gzip -dc /home/hda1.bin.gz | dd of=/dev/hda1 bs=1024
The option -d means decompress, the option -c means output to stdout, or in this case, to dd via the pipe.
The following command would restore the mbr of the first drive with the backup we previously made.
dd if=/mnt/hda1/home/hda.boot.mbr of=/dev/hda bs=512 count=1
If you restored the whole drive (/dev/hda), the system will not automatically create the devices (/dev/hda1, /dev/hda2). To force automatic detection, reboot after completion.
If you restored the system to a new drive, and the device identifiers (called UUIDs, see UsingUUID for a more complete discussion) changed then you must adapt the bootloader and the mount points. While still on runlevel 1, edit these files with your preferred text editor:
To know what the new UUIDs for your drives are, use the following command:
From this list, you can cross-reference the information with that of fdisk to know which drive/parition is which. Then simply update the UUIDs in both GRUB and fstab files.
Once all this is finished, you will be able to resume normal operation where you left off. At this time, if the drive in question is larger than the original, you can edit the partition structure to your liking or add new ones. For this, see Gparted and decide on what action is best for your case.
by Jason Boxman