diff --git a/ntfsprogs/ntfsclone.8.in b/ntfsprogs/ntfsclone.8.in index befdf869..c40d328d 100644 --- a/ntfsprogs/ntfsclone.8.in +++ b/ntfsprogs/ntfsclone.8.in @@ -1,19 +1,105 @@ -.\" Copyright (c) 2003 Richard Russon. All Rights Reserved. +.\" -*- nroff -*- +.\" Copyright (c) 2003 Richard Russon +.\" Copyright (c) 2003 Szabolcs Szakacsits +.\" All Rights Reserved. .\" This file may be copied under the terms of the GNU Public License. .\" -.TH NTFSCLONE 8 "September 2003" "Linux\-NTFS version @VERSION@" +.TH NTFSCLONE 8 "Oct 2003" "ntfsprogs @VERSION@" .SH NAME -ntfsclone \- Copy an NTFS volume. +ntfsclone \- Efficiently clone an NTFS filesystem .SH SYNOPSIS .B ntfsclone [ -.I options +.B -fhm +] +.B -o +[ +.I FILE +| +.B - ] .B device +.br +.B ntfsclone +[ +.B -fhm +] +.B -O +.I FILE +.B device .SH DESCRIPTION .B ntfsclone -will efficiently clone an NTFS volume to a sparse file, device or stdandard -output. +will efficiently clone (copy, save, backup, restore) an NTFS filesystem to a +sparse file, device (partition) or standard output. +It works at disk sector level and +copies only the used data. Unused disk space becomes zero (cloning to +sparse file), left unchanged (cloning to a disk/partition) or +filled with zeros (cloning to standard output). + +.B ntfsclone +can be useful to make backups, an exact snapshot of an NTFS filesystem +and restore it later on, or for developers to test NTFS read/write +functionality, troubleshot/investigate users' issues using the clone +without the risk of destroying the original filesystem. + +The clone is an exact copy of the original +NTFS filesystem from sector to sector thus it can be also mounted +just like the original NTFS filesystem. +For example an ntfsclone'd sparse file can be mounted as + 'mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone' +.SH HANDLING LARGE SPARSE FILES +As of today Linux provides inadequate support for managing (tar, cp, +[un]gzip, [un]bzip2, etc) large sparse files. The only main Linux filesystem +having support for efficient sparse file handling is XFS (by XFS_IOC_GETBMAPX). +However none of the common utility supports XFS_IOC_GETBMAPX. This +means when you tar, cp, gzip, bzip2, etc a large sparse file they will +always read the entire file, even if you use the "sparse support" options. + +.BR bzip2 +compresses large sparse files much better than +.BR gzip +but it does so +also much slower, usually. Moreover neither of them handles large sparse +files efficiently during uncompression from disk space usage point of view. + +At present the most efficient way, both speed and space-wise, to +compress and uncompress large sparse files by common tools +is using +.BR tar +with the options +.B -S +(handle sparse files "efficiently") and +.B -j +(filter the archive through bzip2). Altough +.BR tar +still reads and analyses the entire file, it doesn't pass on the +large data blocks having only zeros to filters and it also avoids +writing large amount of zeros to the disk needlessly. +.SH METADATA-ONLY CLONING +One of the features of +.BR ntfsclone +is it can also save only the NTFS metadata using the option +.B -m +or +.B --metadata +and the clone still will be +mountable (but of course all non-metadata file content will be zeros). + +The metadata-only image can be compressed very +well, usually to not more than 1-3 MB thus it's relatively easy to transfer +it via the Internet for investigation to NTFS experts. + +In this mode of ntfsclone, +.B NONE +of the user's data is saved, including the resident user's data +embedded into metadata (they are also filled with zeros). +Moreover all the file timestamps, deleted and unused spaces inside +the metadata are filled with zeros. Thus this mode is inappropriate +for example for forensic analyses. + +Please note, filenames are not wiped out. They might contain +sensitive information, so think twice before sending such an +image to anybody. .SH OPTIONS Below is a summary of all the options that .B ntfsclone @@ -23,54 +109,98 @@ and the long name is preceded by .BR \-\- . Any single letter options, that don't take an argument, can be combined into a single command, e.g. -.BR \-fv +.BR \-fm is equivalent to -.BR "\-f \-v" . -Long named options can be abbreviated to any unique prefix of their name. +.BR "\-f \-m" . .TP .BI "\-o " FILE .br .ns .TP .BI "\-\-output " FILE -Clone NTFS to the non-existent FILE +Clone NTFS to the non-existent FILE. If FILE is '-' then clone to the +standard output. .TP .BI "\-O " FILE .br .ns .TP .BI "\-\-overwrite " FILE -Clone NTFS to FILE, overwriting if exists +Clone NTFS to FILE, overwriting if exists. .TP .B \-m .br .ns .TP .B \-\-metadata -Clone *only* metadata (for NTFS experts) +Clone +.B ONLY METADATA +(for NTFS experts). Moreover only cloning to a file is allowed. +You can't metadata-only clone to a device or standard output. .TP .B \-f .br .ns .TP .B \-\-force -This will override some sensible defaults, such as not working with a mounted -volume. Use this option with caution. +Forces ntfsclone to proceed, overriding some safety checks. +You can use this parameter multiply times if you want +to overcome every single safety checks. +.TP +.B \-h +.br +.ns .TP .B \-\-help Show a list of options with a brief description of each one. .SH EXAMPLES +Clone (save, backup) an NTFS to a non-existent file +.RS +.sp +.B ntfsclone \-\-output ntfs.img /dev/hda1 +.sp +.RE +Restore a clone image to its original partition +.RS +.sp +.B ntfsclone \-\-overwrite /dev/hda1 ntfs.img +.sp +.RE +Efficiently compress a clone image +.RS +.sp +.B tar \-cjSf ntfs.img.tar.bz2 ntfs.img +.sp +.RE +Efficiently uncompress a clone image +.RS +.sp +.B tar \-xjSf ntfs.img.tar.bz2 +.sp +.RE +Pack NTFS metadata for NTFS experts +.RS +.sp +.B ntfsclone \-\-metadata \-\-output ntfsmeta.img /dev/hda1 +.br +.B tar \-cjSf ntfsmeta.img.tar.bz2 ntfsmeta.img .SH BUGS This program has no known bugs. If you find one, please send an email to .nh - +. + +Sometimes it might appear ntfsclone froze using Reiserfs and even +CTRL-C won't stop it. This is not a bug in ntfsclone, however +it's due to Reiserfs being extremely inefficient creating large +sparse files and not handling signals during this operation. +XFS, JFS and ext3 don't have this problem. .hy .SH AUTHOR .B ntfsclone was written by Szabolcs Szakacsits . .SH AVAILABILITY .B ntfsclone -is part of the linux\-ntfs package and is available from +is part of the ntfsprogs package and is available from .br .nh http://linux\-ntfs.sourceforge.net/downloads.html