RoBlog – Refactoring Reality

Discrete thought packets on .Net, software development and the universe; transmitted by Rob Levine

Imaging a hard disk over the network

by Rob Levine on 19-Apr-2010

Yesterday I found myself in need of a way to take a hard disk image over the network; that is to image the entire hard disk to a remote Windows share.

It’s not a particularly complex operation, but it is nevertheless useful, so I thought I’d jot down the steps here.

In my case, the machine is a Windows Server (2008), which I am about to rebuild. However, I wanted to be able to image the drive so I could roll back to its current state the new install didn’t go so well.

Bear in mind, my aim is to take a snapshot of the drive, a “saved position”, in its current state so I can restore it. I am not attempting to take a backup with a view to being able to retrieve data from it later. As such I am taking an image of the whole drive, rather than creating mountable copies of the individual partitions or backing up files.

Anyway – to perform this imaging, I downloaded the latest Ubuntu as a "Live CD" with the aim of using this to snapshot the drive to a remote Windows share.

Here are the steps I went through:

  1. Create a share on the target machine (another Windows box) and set share and NTFS permissions to grant read/write permissions a user on the windows box.
  2. Boot the computer containing the drive to be backed up into Ubuntu
  3. Optionally zero the free space on the drive (see below for more information)
  4. Install smbfs; this allows you to mount windows shares:
    sudo apt-get install smbfs 
  5. Create a mount point for the remote Windows share:
    cd /mnt
    sudo mkdir remoteshare
  6. Mount your remote Windows share: 
    sudo smbmount //<remoteip>/<remoteshare> /mnt/remoteshare -o username=<username>

    in my case:

    sudo smbmount //192.168.1.1/backup /mnt/remoteshare -o username="robert levine"
  7. Finally, perform the disk image itself:
    sudo dd if=/dev/sda | gzip > /mnt/remoteshare/backup.dd.gz

    [Note: the drive I am backing up is /dev/sda. Your drive may not be – YOU MUST USE THE CORRECT DRIVE DEVICE NAME OR YOU WILL BACKUP THE WRONG DISK!]

Restoring the backup

To restore the backup, you follow the same steps of booting the target into Ubuntu, installing “smbfs”, creating the mount point for the remote share, and mounting the remote share.

To actually perform the restore, issue the following command:

gzip -dc /mnt/remoteshare/backup.dd.gz | dd of=/dev/sda

As with the backup – I am restoring to the drive /dev/sda. Your drive may not be – YOU MUST USE THE CORRECT DRIVE DEVICE NAME OR YOU WILL RESTORE OVER WRONG DISK AND LOSE YOUR DATA!

Well – it worked for me!

Zeroing the free space on the drive

You may wish to zero the free space on the drive. The backup operation detailed above uses gzip to compress the drive image. However, if your drive has a lot of free space that previously contained files, then this space will actually contain the detritus of those files and may not be very compressible.

In my case it contained many tens of gigs of mp3s that had been deleted. Writing a single file of zeros will clean this and make the free space compressible.

However, it may also take a bit of time 🙂

Here are the steps – you may want to repeat this for each partition on the drive. In my case, only one partition contained "deleted free space": /dev/sda2, so this is the only one I zeroed

  1. Create a mount point for the source drive in Ubuntu:
    cd /mnt
    sudo mkdir srcdrive
  2. Mount the source drive:
    sudo mount /dev/X /mnt/srcdrive

    where X is the device name and partition of the drive (in my case "sda2"). If you are not sure what the device name of the drive is, try listing all the drives/partitions on the system with:

    sudo fdisk -l

    This should help you to identify the drive/partition

  3. Once you have mounted the drive, write your zero file (this may take some time):
    cat /dev/zero > /mnt/sourcedrive/zero.dat

    This may take some time!

  4. Once done, delete the file, and then unmount the drive:
    sudo rm /mnt/srcdrive/zero.dat sudo umount /mnt/srcdrive

Comments are closed.