7

the zerofree command finds the unallocated, non-zeroed blocks in an ext2 or ext3 file-system and fills them with zeroes

A NTFS Windows machine, with a mechanical drive, was upgraded from 7 to 10. The drive is old and I suspect that much of the free space actually has data and not filled with zeros.

Is it possible (how?) to zero out the free space, so that when an image is created, the size is minimal?

Assume either a bootable USB configured with Ubuntu or SysRescueCD is available to process the HDD by mounting the NTFS partion with NTFS-3G if necessary

Vlastimil Burián
  • 28,462
gatorback
  • 1,384
  • 23
  • 48

7 Answers7

15

Depends on the tool you are using to create the image. Usually you don't need to zero it out.

For example ntfsclone (part of ntfs-3g) states this in the man page:

ntfsclone will efficiently clone (copy, save, backup, restore) or rescue an NTFS filesystem to a sparse file, image, device (partition) or standard output. It works at disk sector level and copies only the used data. Unused disk space becomes zero (cloning to sparse file), encoded with control codes (saving in special image format), left unchanged (cloning to a disk/partition) or filled with zeros (cloning to standard output).

So, the free space will be ignored and, if you are cloning to a file, converted to "holes" in the sparse result.

Other cloning software, such as Clonezilla will use ntfsclone by default to create the partition image.

Eduardo Trápani
  • 12,834
6

You could use dd for Windows.

dd if=/dev/zero of=EMPTY bs=128k
del EMPTY

Should do the trick.

Artem S. Tashkinov
  • 29,025
2

I BELIEVE this command does what you described zerofree does (namely zeroes out unused blocks/clusters that are NOT already 0) but I have not checked the code / contacted the dev to be sure.

Here is a forum post about suggested changes which I presume were implemented if you want to follow up with the dev : https://forum.tuxera.com/viewtopic.php?f=2&t=30812&view=next

The tool is called ntfswipe and is a part of ntfs-3g, however it needs to be properly configured to get your (and mine) desired result.

I think the following command is correct; i.e. will skip unallocated clusters that are already 0 and otherwise only overwrite unallocated clusters with 0 (by default ntfswipe uses random/list bytes, for "wiping" purposes).

sudo ntfswipe -U -b 0 -v /dev/sdx#

Where sdx# is replaced with the ntfs partition you want to process.

Jack Hadley
  • 101
1

You wrote "Assume USB/CD is available" but can you log into the upgraded Windows system, too?

For my Windows VM, from time to time I use Mark Russinovic's sdelete from the sysinternals suite.

In an admin-CMD enter the following

sdelete -z C:

According to documentation, this will

-z Zero free space (good for virtual disk optimization).

Alternatively, use

-c Clean free space.

instead.

Running this after a cleanmgr run in the WindowsVM, the VM-image can be compacted by several GBs.

Paul w. Muad'dib
  • 98
1

[EDIT] Since secure erasing is not part of the problem here, this question might actually be a duplicate, the answer of which suggests ddrescue, another great tool, handling potentially failing disks.

Paul gave a good solution on Windows (SDelete from sysinternals/Microsoft).

However, since this question has been posted in "Unix & Linux", I suppose a tool working in those environments is being seeked for.

I would then suggest sfill from the secure-delete Debian package, using:

  • -l to reduce passes to 2 (one 0xff + the last one)
  • -z to replace the last random pass with a zeroing one
Bernard Rosset
  • 111
0

Assuming you have enough space to temporarily create a full-size image, you could then mount the resulting image using losetup and/or mount -o loop, then run the fstrim tool against the mountpoint.

On modern kernels, when the filesystem is backed by a loop-device, fstrim will make the image file sparse – the empty areas will immediately stop occupying space and will return zeros when read.

This works for NTFS given a recent ntfs-3g version. It also works for any other filesystem that the kernel has discard support for.

u1686_grawity
  • 5,858
  • 1
    fstrim does not wipe out the data. It simply marks it as not there. It's already marked as 'not there' but OP wants it overwritten with zeros. – abligh Jun 08 '20 at 07:13
  • 1
    It's currently marked as 'not there' at filesystem level – fstrim reads that information and marks it as 'not there' at the underlying block device level. For SSDs, that translates into a "TRIM" command – but for image files, that translates into a hole within the image. (Linux supports punching holes in an existing file, turning a non-sparse file into sparse.) The result is that the image file will very quickly have those unused areas replaced with zeros. – u1686_grawity Jun 08 '20 at 08:06
0

I am using that script:

#!/usr/bin/env bash
f="./zeros.tmp"
sync
df -HB MiB .
pv /dev/zero >> "$f"
sync
pv /dev/zero >> "$f"
sync
df -HB 1 .
echo -n cleaning...
rm "$f"
echo ok
sync
df -HB MiB .
pbies
  • 464