Create an image of HD using (dd), resize NTFS with qparted

How to do things, solutions, recipes, tutorials
Message
Author
User avatar
cobelloy
Posts: 204
Joined: Mon 23 May 2005, 07:12
Location: Karratha W.Australia

Create an image of HD using (dd), resize NTFS with qparted

#1 Post by cobelloy »

Merry Christams!!!

I am trying to use sleuthkit/autopsy to recover deleted photos from my hard drive, but first I need to make an image of the entire drive, I don't know how to use the dd command and the man pages seem like another language to me, I followed some instructions and ended up with a "file".img.gz but I think I need an .iso, or maybe just an .img, can someone cleverer than me tell me what to type at the command line to do this? Or alternately I downloaded a small app called ubercopy (a front end to dd) - but there are no instructions available on how it works...

well, hope u can help - Thanks!!

User avatar
Ted Dog
Posts: 3965
Joined: Wed 14 Sep 2005, 02:35
Location: Heart of Texas

dd commands.

#2 Post by Ted Dog »

dd if=/dev/hda1 of=/hdimage.raw
will pull the first partion of the first drive. (normal windows drive C:)

dd if=/dev/hda2 of=/hdimage.raw

will pull the second partion of the first drive.

dd if=/dev/hda3 of=/hdimage.raw

will pull the third partion of the first drive.

dd if=/dev/hdb1 of=/hdimage.raw

will pull the first partion of the second drive.


dd if=/dev/hdb2 of=/hdimage.raw

will pull the second partion of the second drive.

bigger better uncut:
dd if=/dev/hda of=/hdfullimage.raw
will pull total drive with boot MBR included
other methods.
growisofs uses dd to burn direct to DVD (I use this all the time)
growisofs -Z /dev/dvd=/dev/hda
will burn the first 4.7GiB of the first drive directly to DVD in raw format.

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

Re: dd commands.

#3 Post by Flash »

Ted Dog wrote:... growisofs uses dd to burn direct to DVD (I use this all the time)
growisofs -Z /dev/dvd=/dev/hda
will burn the first 4.7GiB of the first drive directly to DVD in raw format.
Hey Ted, is that from the very beginning of the hard drive? (I.e., does it include the boot sector or partition with the MBR etc.?) If so, does the reverse command restore the first 4.7 GB of the hd to just the way it was?

User avatar
Ted Dog
Posts: 3965
Joined: Wed 14 Sep 2005, 02:35
Location: Heart of Texas

growiosfs and dd happy pair

#4 Post by Ted Dog »

yes and yes
this does back up full HD including MBR, hidden Windows storage & unused cruff. The resulting disk image is restored.
after DVD is burned the HD image is restored with

Code: Select all

dd if=/dev/dvd of=/dev/hda 
Simple as can be, now package a nice complicated GUI around it and sell it for big bucks!!

One minor flaw and its all my fault. If you backup WinXP then upgrade your LAN & DVD firmware, install new video card. and then hopelessly screwup your windows install. Do not reuse earlier backup, I did and it force a 3 day only forced re-activate of my windows machine, so I am hosed for about three months (I reinstalled it two months-ago). Lession learned firmware upgrades changes the way the hardware reports to windows. Puppy rules badly hosed puppy is only a mv command and reboot away 2 minutes max!

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#5 Post by Flash »

Thanks Ted. Ha ha, I have Windows 2000 so no problems with "reactivating."

I have a notion to put Puppy on a multisession DVD and then use it to backup my W2KPro system partition to the DVD. What commands would you suggest I use to backup my W2KPro partition to the multisession DVD, and what commands to restore from the disk image on the multisession DVD?
Ted Dog wrote:... Simple as can be, now package a nice complicated GUI around it and sell it for big bucks!!
Don't laugh! I paid good money for a program called Drive Backup! which does pretty much what you describe. I've used it a couple of times and it worked as advertised, but the restore is very slow. The company told me that's because the DVD boots DOS which then restores the hard drive, including the boot sector, from the image on the DVD. I'm hoping to use Puppy Linux to do the same thing only faster.

Thanks again. :)

JaDy
Posts: 159
Joined: Wed 04 May 2005, 15:59
Location: SE PA USA
Contact:

#6 Post by JaDy »

Felicitations & Facilitations, Rev. John G. Derrickson
Wrote fast. Goofs happen. Tell me.

kethd
Posts: 451
Joined: Thu 20 Oct 2005, 12:54
Location: Boston MA USA

guides to dd usage

#7 Post by kethd »

Don't miss these more-than-you-ever-imagined guides to dd usage.

This is the most comprehensive documentation and example sheet for one of the most useful, and least understood linux commands, called "dd". This command has been part of UNIX since the 1970's. It is a bitstream duplicator for copying data, but can use input or output pipes to another command.

http://www.linuxquestions.org/linux/ans ... ng_With_DD

User avatar
Ted Dog
Posts: 3965
Joined: Wed 14 Sep 2005, 02:35
Location: Heart of Texas

dd christmas gift

#8 Post by Ted Dog »

Those links are great, now I know how to use the partial cylinders at the end of my HD, puppy storage.

warning do not use dd on usb flash drives, I have a worthless dongle.

kethd
Posts: 451
Joined: Thu 20 Oct 2005, 12:54
Location: Boston MA USA

#9 Post by kethd »

USB broken by dd ?!? Tell us more...
I was certainly intending to do this!
Did you break it by writing, or by just reading with dd?

User avatar
Ted Dog
Posts: 3965
Joined: Wed 14 Sep 2005, 02:35
Location: Heart of Texas

dd and usb flash

#10 Post by Ted Dog »

I tried to dd same sized usb flash drives(different package types one CF other just USB) . The results are bad the resulting usb drive is still alive but zero length refuses to mount on any OS and can not be recycled with HP's usb flash formater

kethd
Posts: 451
Joined: Thu 20 Oct 2005, 12:54
Location: Boston MA USA

#11 Post by kethd »

Ted Dog,

Please let us all know whatever more you learn about this important subject...

Interesting details on getting USB device formatted properly for Linux:
http://www.pcc.com/staff/phil/usb_howto.txt

CypherBit
Posts: 36
Joined: Thu 15 Dec 2005, 22:21
Contact:

#12 Post by CypherBit »

I've been thinking of using DD to clone one of my partitions to a new partition on another drive. Both are NTFS and different sizes, are there any problems because of that?

I've also read here: http://episteme.arstechnica.com/groupee ... 7000096731
2. The destination disk has to be identical to the source disk (including model
number and geometry). This is because dd copies the entire disk image (including
the label {vtoc}). So, if a 9Gb Seagate drive was dd'd to a 36Gb IBM drive, then
after the operation, the 36Gb IBM drive would show up as a Seagate 9Gb and there
is no easy way to reclaim the missing space.
I just want to make sure that using dd if=/dev/hda1 of=/dev/sdb1 won't have any undesired consequences.

GuestToo
Puppy Master
Posts: 4083
Joined: Wed 04 May 2005, 18:11

#13 Post by GuestToo »

i don't think it matters whether it is NTFS or VFAT or whatever file system it uses

it will usually not work if the source partition is larger than the destination partition

it will probably work if the source partition is smaller than the destination partition, but the destination partition will not use all the space available ... it will be the same size as the original

you can use parted to resize an NTFS partition, i think ... there is a parted dotpup package (untested by me)

Ghost can do this ... and probably Partition Magic

i don't know if Partition Saving can do this or not

CypherBit
Posts: 36
Joined: Thu 15 Dec 2005, 22:21
Contact:

#14 Post by CypherBit »

Guest I'll have to test this on my own.
My hda1 is 12GB (10GB full) and my sdb1 is 18GB I'd very much like to keep it that way, even after using dd. After using dd I'd like my sdb1 to have 8GB free space.

If anyone has any additional input, please let me know.

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#15 Post by Flash »

CypherBit wrote:I've been thinking of using DD to clone one of my partitions to a new partition on another drive. Both are NTFS and different sizes, are there any problems because of that?

I've also read here: http://episteme.arstechnica.com/groupee ... 7000096731
2. The destination disk has to be identical to the source disk (including model
number and geometry). This is because dd copies the entire disk image (including
the label {vtoc}). So, if a 9Gb Seagate drive was dd'd to a 36Gb IBM drive, then
after the operation, the 36Gb IBM drive would show up as a Seagate 9Gb and there
is no easy way to reclaim the missing space.
I just want to make sure that using dd if=/dev/hda1 of=/dev/sdb1 won't have any undesired consequences.
I suspect that information is either obsolete or simply incorrect, but I don't really know. I suggest you do some more research before giving up on cloning the small hd to a bigger one. I know there is commercial software that does exactly that.

CypherBit
Posts: 36
Joined: Thu 15 Dec 2005, 22:21
Contact:

#16 Post by CypherBit »

Thank you for trying to clear this up Flash.
I know there are quite a few commercial programs that can easily do this. The problem is I'm about to do this on a wider scale and don't really want to buy any software. Came across dd and thought this would easily do the job.

Does anyone use anything else (F/OSS) for this same purpose?

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#17 Post by Flash »

Surely you can find one or two sacrificial computers to try it out on, to see if it will do what you want. :)

CypherBit
Posts: 36
Joined: Thu 15 Dec 2005, 22:21
Contact:

#18 Post by CypherBit »

I'd rather not.
But if no one comes up with a confirmation/another solution I'll just have to try. Hopefully I'm not the first one that wants to do this.

CypherBit
Posts: 36
Joined: Thu 15 Dec 2005, 22:21
Contact:

#19 Post by CypherBit »

Well I tried it. It seemed to be a complete success, but when I attempted to boot from the new HDD I recived the dreaded "NTLDR is missing".
I then disconnected the drive and booted with the old one. Not only do I get the above error but it displays that only 2.8GB is free, same as the old drive and the partition of this one was 5GB larger. Which it totally ignores.

In short dd doesn't seem to be what I'm after at all. Please provide me with an alternative.

GuestToo
Puppy Master
Posts: 4083
Joined: Wed 04 May 2005, 18:11

#20 Post by GuestToo »

dd can duplicate a partition, byte for byte
the new partition will be an exact duplicate of the old partition ... same size, same everything

if you want to move the files from a smaller partition to a larger partition, you have to do it on a file-by-file basis, from within the file system ... if it is an NTFS system, then the file system was invented by Microsoft ... only they and partner businesses that pay them for the rights know how the NTFS system works ... there has been some limited reverse-engineering that has been done, to try and figure out exactly how it works, but it's not easy to do ... see here

so to do what you want to do requires using programs that have been written by people who have paid Microsoft to tell them how NTFS works ... in other words, there are probably no open-source programs that can do what you want to do

Ghost can do this ... probably Partition-Magic ... i think http://www.terabyteunlimited.com/ has a good reputuation

Post Reply