13

Case scenario:

$ sudo fdisk -l
Disk /dev/sda: 223,6 GiB, 240057409536 bytes, 468862128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x13a30a5a

Device  Boot     Start     Final  Sectors Size Id Type
/dev/sda1  *           2048   1333247   1331200   650M 27 WinRE NTFS hidden
/dev/sda2           1333248 264058879 262725632 125,3G  7 HPFS/NTFS/exFAT
/dev/sda3         264060926 468860927 204800002  97,7G  5 Extended
/dev/sda5         264060928 434049023 169988096  81,1G  7 HPFS/NTFS/exFAT
/dev/sda6         434051072 464771775  30720704  14,7G 83 Linux
/dev/sda7         464773120 468860927   4087808     2G 82 Linux swap / Solaris

Windows 10 is installed on /dev/sda2 and I assume that /dev/sda1 is a hidden partition from the same Windows system.

How can I backup my Windows 10 installation from Linux in order to restore it later?

Further data upon request:

  • By "Installation" I mean the "full partition" (or partitions) required to return Windows to the moment the cloning was made.
  • Being able to restore to the same system (computer, hardware) and even hard drive would enough. I.e: I installed Windows 10, made backup, and a few months ago I want to restore the backup I made, so there is no need to perform the full installation of Windows 10 (drivers, printers, programs...etc) again.

Tested until now (all tests performed on the same computer with the same partition layout):

  • PartImage (cloning sda1 and sda2): not working. The restored operating system will not boot.
  • FSArchiver (cloning sda1 and sda2): not working. The restored operating system will not boot.
Sopalajo de Arrierez
  • 6,481
  • 5
    What on Earth is the downvote for??? – ajeh May 15 '18 at 21:13
  • If by 'installation' you meant the entire partition, then dd is the most reliable way. If however you meant files on the partition, then tar can do that just fine. This is worth clarifying in your question. How are you testing the restore - onto the same drive, or a different drive with a different partition layout? – ajeh May 15 '18 at 21:14
  • Added the data you requested, @ajeh . I just want the classic full wiping (of the Windows partition) & restoring used by Norton Ghost, PartImage or FSArchiver. If dd can do it, it could be OK for me, but please remember there are more partitions on the drive. – Sopalajo de Arrierez May 15 '18 at 21:52
  • Okay, dd can certainly do that and I use it all the time to image drives, including Windows. All you need to do is grab images of all involved partitions and store them so that you would know to which device to restore, i.e. name them after sda1.img, sda2.img etc. And as there will be tons of free space in most cases, pipe dd output through pbzip2 or p7zip to create sda1.img.bz etc. to save space. – ajeh May 15 '18 at 22:01
  • But I have always used PartImage and FSArchiver to image drives without a flaw, mostly Windows, and on a (my first) Windows 10 image it failed, @ajeh . Did you test dd it on Windows 10? – Sopalajo de Arrierez May 15 '18 at 22:05
  • 1
    I used dd with up to Windows 8.1 images, as well as QNX, Apple Mac, Solaris, FreeBSD and OS/2. I do not have a Windows 10 distro to try, as I consider this a giant malware to stay away from. – ajeh May 15 '18 at 22:08
  • 2
    I wouldn't use dd since that will backup empty space too. Instead look at something like clonezilla – ivanivan May 15 '18 at 23:42
  • I dd the entire drive when I need the restored image to boot reliably afterwards. It does take up more space, but it's simpler than messing with rebuilding the boot partition. – Mio Rin May 16 '18 at 07:23
  • The fact, @ivanivan , is that Clonezilla is a live distro, so you rather need to boot with it. Programs that can be installed have the great (for me) advantage of being used via remote sessions (SSH), so you can restore some Windows 10 (practically) without user cooperation. There are some tutorials on installing Clonezilla for Linux, and I tested them on 2013, but I don't know if they work as for today. – Sopalajo de Arrierez May 16 '18 at 13:24
  • Did you backup and restore the MBR when you tried partimage? Tools such as partimage and partclone --and depending on how it's used dd-- work on the partition level; Well, the block device level actually, but anyway... The MBR contains part of the Windows bootloader, so without restoring it Windows won't boot. – Emmanuel Rosa May 16 '18 at 17:48
  • The MBR was supposedly untouched, @EmmanuelRosa . Just creating and restoring a partition backup with partimage or fsarchiver does not modify it. The process is the same I performed for many years with any other Windows or Linux operating system's partition. As I wrote on my answer below, I executed dd only on the partition (not the MBR or the whole disk) and it worked like a charm... a slow and huge (high GB consumption) charm, but a charm. – Sopalajo de Arrierez May 16 '18 at 20:08
  • 1
    Not an answer per se, but worth reading for anyone reading this page or considering doing this: ***BOTH* PartImage & FSArchiver** (I've used them both & read about both extensively) are NOT certified for use for NTFS, in fact it's considered "Experimental" ; They do work fine for FAT 32, but otherwise should be considered "OFF-LIMITS" for any windows backups, System or otherwise. Linux & Win don't play well together---the best "common ground" is FAT 32 (I have a dual boot sys with just a partition I use frequently!) – Just tried Puppy Jul 08 '20 at 13:53
  • OP, did any of the answers help you? If so, please accept one, which will help others who read this question in future. Thanks – Mawg says reinstate Monica Dec 19 '20 at 09:47

5 Answers5

6

pv method

You could use pv (man page) utility like so:

sudo sh -c 'pv < /dev/sda > /destination'

Of course you could become root first:

sudo -i

And then just do the backup:

pv < /dev/sda > /BackupDestination

And then when needed do the restore:

pv < /BackupDestination > /dev/sda

Notes

  • This basically does the same job as dd in the other answer, but is faster and shows progress.

  • This method may be slower than rsync, but that just copies files, which is not intended.

  • It copies everything 1:1, a perfect copy might you say.

  • You need also the boot sector for it to boot later on. The simplest method is to backup the whole drive.

  • To show progress with dd (man page), you could just add to the command:

    status=progress

Tip

For you to be able to effectively compress the image afterwards, don't forget to zero free space.

Vlastimil Burián
  • 28,462
4

I have just successfully finished the described scenario of backing up Windows 10 from Linux to a file and restoring them on a new drive.

Use SDelete to fill unused space with zeros

sdelete -z c:

This isn't necessary per se but improves compression of the generated file. Deleted files aren't actually replaced with zeroes on disk, the space they occupy is simply marked as usable again but the data is still there. dd recovers those data too so filling every space marked as free with zeros allows compression to be more efficient

Get some live Linux USB to boot and backup MBR and partition table to a spare drive

dd if=/dev/sda of=/somewhere/file.mbr bs=512 count=63

copy the boot partition to a file

dd if=/dev/sda1 bs=1M status=progress | lz4 > /somewhere/sda1.lz4

copy the system partition to a file

dd if=/dev/sda2 bs=1M status=progress | lz4 > /somewhere/sda2.lz4

Place the new disk into the computer, boot the live Linux again and restore the beginning of the disk

dd of=/dev/sda if=/somewhere/file.mbr

That gets you the same primary partition layout (partitions inside extended partition are stored somewhere else and will not be restored by doing this).

Now restore the two Windows partitions

dd of=/dev/sda1 bs=1M status=progress < lz4cat /somewhere/sda1.lz4
dd of=/dev/sda2 bs=1M status=progress < lz4cat /somewhere/sda2.lz4

The drive didn't boot at this stage (grub complaining). So boot windows rescue disk or the installation media and select "repair". In Troubleshooting start cmd prompt and run

bootrec /fixmbr

At this stage I got the original Windows system to boot on the new bigger drive. I got 50% compression rate with both gzip and lz4 (with 70% full drive) but gzip was limited by the CPU speed (27MB/s in my case) while lz4 was not (480MB/s CPU limit, 180MB/s my backup drive limit).

My first try was with ntfsclone but that didn't produce bootable Windows (it was complaining of some missing files in \Windows\System32). I am not sure why it didn't work. At the end the dd + lz4 solution created smaller image than ntfsclone by itself. Your mileage may vary based on how full the disk is modulo bugs in ntfsclone - dd seems much easier to get right :-)

AnthoJack
  • 103
Zbyněk Winkler
  • 149
  • 1
  • 3
2

Yes, the most simple solution is

dd if=/dev/sda of="/media/usb/$(date).img"

That is slow and takes up a lot of space so you can

  • just copy the partition[s] + boot sector you want
  • zero and compress free space
  • file instead of block based backups
  • rdiff-backup for reverse diffs (dramatic size reduction after the first)
  • rsync (for dramatic speedup over slow networks)
  • cow FS (btrfs/zfs) for faster/smaller than rsync/diff backups are only an option if you put windows in a VM, and I'm not sure how well they are suited to that scenario.

Likely you missed the boot sector, UUIDs and should read up on grub and https://en.m.wikipedia.org/wiki/Windows_Vista_startup_process

user1133275
  • 5,574
  • Why cloning the other partitions? The question is just about backup/restore Windows 10. – Sopalajo de Arrierez May 16 '18 at 00:29
  • 2
    @SopalajodeArrierez the whole thing is the simple method, otherwise you need to think about partition tabe type, boot sector, UUIDs, alignment, flags, utility partitions etc. – user1133275 May 16 '18 at 01:15
1

Like other solutions posted until now, this one show progress (like the pv solution, not relative to total, just number of MB transferred) and does not compress (a 100GB partition would result in a 100GB file), but it backups only the partition file system (sda1), not the entire disk or partition:

dcfldd if=/dev/sda1 of=Image.dd bs=2M

The dcfldd tool is a simple dd that shows progress.
The buffer size bs=2M seems to me a good value for USB devices (a 120 GB partition copied in about 15-20 minutes).

Tested working on Windows 10 version 1803. No need (or so it seems) to backup too the entire hard disk, happily.

Of course, compressing the resulting file later would probably be a good idea.

ron
  • 6,575
Sopalajo de Arrierez
  • 6,481
1

I did a backup of a freshly installed Windows computer, following Zbyněk Winkler's answer above. I tried lzma and gzip --fast, but those became a bottleneck (my two SSDs managed a transfer speed of 2 GB/s without compression). Actual command line:

$ sudo dd if=/dev/nvme0n1 bs=1M status=progress | pzstd -o /tmp/windows-disk.zst

The process took about eight minutes, and the 1 TB SSD was compressed to an 8 GB file. Note, this was a fresh install, so just Windows, no user data or applications.

Restore with :

$ pzstd -d /tmp/windows-disk.zst -c | sudo dd of=/dev/nvme0n1 bs=1M status=progress
Community
  • 1
Ketil Malde
  • 131