How do I backup/restore XP using Knoppix?

Hi:

Having just spent a week restoring Windows XP on my laptop, I have come to Knoppix.net to learn how to be able to do it better next time (without any help from Microsoft who will have stopped supporting XP by then). I have lots of old software that I fear may not run under W7 so I want to keep this old laptop going for ever.

Can I describe what I think I need to do and maybe someone out there can tell me if I have it right, or if it won't work and there's a better way.

My plan is to buy a USB drive big enough to take the entire C: drive (hda2), make an NTFS partition on it (sda1) which is big enough to take it (I can do that in Windows I think), then reboot into Knoppix, mount the two drives and do the command:

dd if=/dev/hda2 of=/mnt/sda1

If I have understand correctly, that will give me a byte-for-byte clone of the C: drive on the USB drive. Back in Windows I should be able to read/restore individual files from this. If (when?) Windows crashes, I should be able to boot into the Knoppix CD and mount sda1 and then ....

At this point I am not sure what to do about mounting hda2. The plan is to execute the "dd" command again but with if=/dev/sda1 and of=/mnt/hda2 but I can't figure out if hda2 needs to be formatted first, and if so, how. The dd command is doing a byte-for-byte copy so it shouldn't need to know how to write in the NTFS environment, but I can't figure out whether I need to format the partition first, and if so, whether it even matters what type of filing system I choose for the formatting.

The thing that worries me is that I have been told that operating systems other than Windows may have difficulty writing to NTFS partitions (because NTFS is poorly documented?). If I have got it right, using "dd" for the backup AND for the restore gets round this. If I need to restore XP and the hard disk is corrupt, I am not sure I know how to proceed if Knoppix must format the Windows partition as an NTFS filesystem and this is not easy.

Maybe some of you reading this can tell me if I am worrying too much. Is all this written-down somewhere?

Thanks
Peter

first do NOT use ntfs, use the linux format ext3,
positive, it can be reliably read and written from Linux and is capable of storing huge single files.
downside, to read ext3 from windows you will have to use one of these or something similar.
http://www.howtoforge.com/access-lin...s-from-windows
http://www.fs-driver.org/
http://www.diskinternals.com/linux-reader/

also to avoid problems I would clone WHOLE disk, not just first partition, reason is that
mbr, partiton-table, bootloader... will then be copied, that you loose if you only copy C:\,
as result and your restored copy of windows will not boot.
another thing, be 100% certain what you are doing as to disk names and partition numbers when using dd, no way to revert if you dd a blank disk over a xp install, that is what will happen if you swap sda and hda for if= and of= (if= is input and of= is output).

first an important thing!

Quote:

---

before removing any USB plug, powercord... make sure you sync (write everything
from RAM to actual image) and Umount the disk (no I did not misspell unmout, command is actually called umount).
first shut down filemanagers... that you have been using on /dev/sda1 then do the command below

Code:

---

sudo sync&&sudo sync&&sudo umount /mnt/backup

---

if you unplug it without this something WILL go wrong and it may not even be obvious from the start

---

to make a "clone" of the drive make certain you can access the drive sda1 under /mnt/sda1 by mounting it there

Code:

---

sudo mount -t ext3 /dev/sda1 /mnt/sda1

---

then to make the actual image do this simple command in a xterm, konsole, aterm... (many names fro same thing) window

Code:

---

sudo dd if=/dev/hda of=/mnt/sda1/XP-backup2011-01-23.img

---

if you want to access separate files from windows I have NO real idea how (for Linux I will show below).
one possible avenue is using what is above to read the ext3 filesystem + another tool
I have heard that you can buy/download something called isobuster to use DVD images...
instead of DVD's when gaming, no idea if it will work though.

here you have another option, using a packaging tool (gzip) together with dd to reduce file size,
downside is that the above tools will likely not be able to read it.

Code:

---

sudo dd if=/dev/hda | gzip -9 > /mnt/sda1/XP-backup2011-01-23.gz

---

for the above to be 100% effective and you get minimal file size you should zero the disk before partitioning the disk and installing windows...

WARNING the command below will WIPE the disk clean beyond many recovery tools /WARNING.

Code:

---

dd if/dev/zero of=/dev/hda

---

WARNING the command above will WIPE the disk clean beyond most recovery tools /WARNING.

to restore normal image just type

Code:

---

sudo dd if=/mnt/sda1/XP-backup2011-01-23.img of=/dev/hda

---

and for gzipped image do

Code:

---

gzip -dc /mnt/sda1/XP-backup2011-01-23.gz | dd of=/dev/hda

---

depending on system (usb1.0, usb1,1, usb2... ata33, ata66...) and disk size...
this can take looooong time before completing both making the image and restoring it,
longest yet was 27 hours for a 40G hdd...
normal is few hours, and on plus side you do not need to stand there waiting.

now to read unzipped image in Linux do

Code:

---

sudo su

---

to become root
then create a directory to mount the image to

Code:

---

mkdir /mnt/backup

---

now mount it

Code:

---

mount -t ntfs-3g /mnt/sda1/XP-backup2011-01-23.img /mnt/backup -o loop -ro

---

now you can see the content in the directory /mnt/backup,
before removing any USB plug, powercord... make sure you sync and Umount the disk as before

Code:

---

sync&&sync&&umount /mnt/backup

---

the

OErjan:

Many thanks for your detailed reply. Before I answer (with more questions!), I think the start and end of your reply were missing. I also saw two replies but I think they are identical. Did I miss something?

Thanks
Peter

hmm, yes there is a double post, i edited some and must have hit the wrong button.
you did not miss anything, important, just a comment at the end.
please keep asking, it is how we all learn, that or trial and error, uhm, which by the way is a form of asking a question testing the formed hypothesis and either failing or succeeding.

n.b.: The extra post has been moved to the Moderators Forum.

OErjan:
Many thanks for your reply. It was very useful.

Your suggestion to clone the whole of hda is a good idea, to catch any corruption of the MBR and partition table. My idea to copy only hda2 would not do that. For sure I will also follow your advice about flushing the USB drive cache.

I understand the reasons for not using LINUX to write to an NTFS filesystem but I was not planning to do this. Let me explain my idea better and you can tell me if it will work or if there are other problems that I have not identified yet.

If I do as you suggest and make sda1 as an ext3 filesystem. I can execute:

dd if=/dev/hda of=/mnt/sda1/backup.img

but this gives me no way to access the files inside this image from Windows - I do think the 'read ext3 files' utilities you mention can 'mount' an image of a filesystem or an image of a volume in the same way that LINUX can.

So my idea is to execute:

dd /dev/hda2 of=/dev/sda1

[I said before "of=/mnt/sda1" but I think that is wrong: I don't want sda1 as a filesystem]

Notice that this is a dd between two devices, not a dd from a device to a mounted filesystem - the dd command knows nothing about NTFS and is just copying the 'raw' data, so if /dev/hda2 did contain a Windows-written NTFS filesystem, then /dev/sda2 will become the same. I should be able to see it in Windows as a clone of C: and this will be a way to be sure the backup is good (but see later below).

For the restore I think I just need to execute:

dd if=/dev/sda1 of=/dev/hda2

Question 1: Is this OK or have I missed something?

Question 2 is about the partition sizing. Your method copies the hda device to a file. I guess this file will have exactly the correct size so the restore will copy the file back to hda with exactly the correct size, but in my method I am not sure how the size of the source and destination partitions should be set. I can guess that if the source partition is smaller than the destination, the dd command will succeed in
the backup operation (leaving some unwritten space at the end) but in this case the source partition of the restore operation will be bigger than the destination. Will dd truncate the source (which will be safe in this case if I had made sda1 larger than hda2) or overwrite beyond the end of the destination partition (which may corrupt the next partition)? The best idea would be to make sda1 EXACTLY the same size as hda2, but I do not know how to do this yet. The documentation for fdisk is not good. Maybe I use Windows to format sda1 and cross-check it did the right thing by physical inspection of the partition tables of both drives. Do you have any suggestions about this?

My idea does not back-up/restore the MBR and partition table but I am sure that's an easy job by itself. For a restore operation I can try restoring the MBR/partition table first and if I am lucky there may be no need for the full restore!

Question 3 is about how to test the back-up to be confident that the restore will work if I ever need it (but without actually making the restore over a working OS!). I will be able to see sda1 as E: or F: in Windows of course, but I do not think that will be enough to prove that it will boot if/when I copy it back to C:. Maybe I can add an extra operating system to BOOT.INI (in C:\) which will boot into the backup at sda1. To test the backup I can select it at boot time but still be able to return to the original if it didn't work. Will XP run from a USB drive or will it think it is a pirated copy?

Please tell me if you see any problems with my ideas. LINUX/Knoppix is very new to me but I am ready to learn.

Peter

dd will "create" te filesystems and partitions... if you clone the whole disk. if disk fail you need a new disk with same sector, cylinder and head count and preferably same exact size to make a bootable cloned system.

the

Code:

---

dd /dev/hda2 of=/dev/sda1

---

will require the two disks to be equal size and geometry that is same number of sectors, heads, cylinders... to work or there will be trouble somewhere, also just cloning one partition is near pointless as you will loose partitiontable and bootloader... making any files unreadable anyway, you can only do this safley if you make an IMAGE (one single file).

if you really MUST use ntfs you could always do the

Code:

---

sudo dd if=/dev/hda of=/mnt/sda1/XP-backup2011-01-23.img

---

to a linux partition of the extra hdd and then using the tools available to see linux partitions from windows copy the file created to a NTFS partition, doing a dd FROM a ntfs partition should work.

just so you know this, that would still NOT allow you to ADD anything, that can not easily be done safely to a cloned XP+ntfs system, not even if it was seen as a valid partition by windows I would do it, this because XP and NTFS has some very nasty tricks up their sleeve for things like this to go wrong, to name on the timestamps of the files will not match which may make windows crash even before full boot.
on the other hand I think I have something like 10 gzip'ed clones of my fathers computer on the backup disk I use to backup for him...

OErjan:
Thanks for your information again. I understand everything you say. I now have a 250GB USB drive and it IS the same 'geometry' as the main HD (255 heads, 64 sectors/track) but I think this is a 'virtual geometry' and not real.

I have partitioned the USB drive with two partitions (sda1, sda2) which are exactly the same sector-size as the hda2 (the C: drive where Windows XP is located) and another 32GB FAT2 partition. Below is the output of the fdisk -l -u command:
++
Disk /dev/sda: 250.0 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Device Boot Start End Blocks Id System
/dev/sda1 63 111266252 55633095 7 HPFS/NTFS
/dev/sda2 111266253 222532442 55633095 7 HPFS/NTFS
/dev/sda3 222532443 288061514 32764536 c W95 FAT32 (LBA)

Disk /dev/hda: 60.0 GB, 60011642880 bytes
255 heads, 63 sectors/track, 7296 cylinders, total 117210240 sectors
Units = sectors of 1 * 512 = 512 bytes
Device Boot Start End Blocks Id System
/dev/hda1 63 160649 80293+ de Dell Utility
/dev/hda2 * 160650 111426839 55633095 7 HPFS/NTFS
/dev/hda3 111426840 117194174 2883667+ db CP/M
/dev/hda4 117194175 117210239 8032+ 83 Linux
++
I did this partitioning with fdisk itself so that I could be certain that the sizes were exact - the partition tool in XP will only partition in integer multiples of 1MB. On hda I saw that the NTFS partition starts on a cylinder boundary but I didn't do this on sda, just start the first partition on sector 63 as usual. Windows seems to be happy about this. I formatted sda1, sda2 and sda3 in Windows and I can work with all partitions in both operating systems (but the NTFS partitions are read-only in Knoppix of course).

Next job was to execute "dd if=/dev/hda2 of=/dev/sda1" but I found a problem - it's very slow (139kB/sec). The backup and restore operations will take more than 4 days at this speed! I checked a few other dd commands like "dd if=/dev/zero of=/dev/sda1" (fill sda1 with zeros) and that is also the same slow speed; "dd if=/dev/hda2 of=/dev/null" (read hda2 only) is 32MB/sec so that's OK. In Windows XP the transfer rate from the HD to the USB is 4MB/sec but that is copying a folder as files so maybe it could be faster for a single unfragmented file. But 4MB/sec would be acceptable for my purpose (~4 hours).

So I have some work to do, to find why Knoppix is so slow. Maybe I experiment with the bs= parameter. Maybe Knoppix is driving my USB port in USB 1.0 mode. Maybe someone else reading this can help me with this?

I don't think I will get into trouble with the NTFS filesystem inside sda1. Windows will only need to read/write inside the NTFS filing system on hda2. For the backup operation Knoppix will ONLY read hda2 and write sda1 as a single device. For the restore operation Knoppix will read sda1 and write hda2 as a single device. There will be no need for Windows or Knoppix to write to the NTFS filesystem in sda1. I could make it read-only. I think it will be OK for Windows to read files from the NTFS filesystem on sda1 if I need to do it. Knoppix could read files from sda1 but there will be no need for this for the backup/restore job.

I think it will be easy to backup/restore the MBR/partitiontable on hda with ..
dd if=/dev/hda of=/.../mbr.dat bs=512 count=1
dd if=/.../mbr.dat of=/dev/hda

Similarly for the other partitions on hda if I ever need them again, but they can be restored in other ways.

Peter

For the information of anyone else reading this, I did get the above idea working. But because there were some bad sectors on the HD, the 'dd' command failed on these and corrupted the filing system. Using 'dd_rescue' instead was OK although rather slower - it switches from 65536 byte blocks to 512-byte blocks when it sees the first bad sector but unfortunately then stays with 512 byte blocks for the rest of the copy.

Copying to the backup partition rather than to an image file makes it easy to verify the backup is correct and easy to restore individual files from inside Windows. I have not yet needed to do a complete restore, but the plan would be to do that just by reversing the dd command from the Knoppix CD, after restoring the MBR/partition-table by hand.

Peter