Ghost equivalent for Linux - Knoppix Hacks excerpt, Hack #48

[Wagner, Steven G]

I don't have a scanner and my typing is atrocious, but here's an exerpt from
O'Reilly's "Knoppix Hacks", ISBN: 0-596-00787-6. I highly recommend this
book to anyone interested in Linux, though most on this list probably
already have it or are, at least, aware of it.

I've spell-checked this rendition, gone back and rechecked it against the
original and paid special attention to the code excerpts. However, as I
said, my typing is bad so be warned that I'm not claiming that this is an
_exact_ reproduction of the original, though it is as close as I am able to
manually reproduce. I abbreviated the command prompt originally shown in the
book. For this "hack" in the book the prompt shown is
"knoppix at ttyp0[knoppix]$". Since I didn't feel like typing this I simply
replaced it with "[linux]$"

I've gotten a lot of help from the blackbelt penguins on this list and I
hope to someday be able to contribute. You guys rule, thanks a
11110100001001000000!

from "Knoppix Hacks":

Hack #48 - Clone Hard Drives

Cloning entire partitions has long been a time-saver for sys admins. Instead
of running through the same install process for tens or hundreds of
machines, a sys admin can set up a single machine just how he wants it, then
copy the hard-drive image to the next machine, saving hours of work. Plus, a
broken machine can be reimaged and back to the "factory" state in minutes,
reducing downtime. There are many different hdd-imaging programs you can
purchase, but with a Knoppix disc, you can easily create partition images,
partition-to-partition copies, and even disk-to-disk copies. This hack
covers two programs: dd, which  is commonly used to create and copy drive
images, and partimage, which combines the power of dd with an easy-to-use
interface and the capability to save images over the network.

dd

Ask any Unix-sys admin about disk imaging, and, most likely, the first tool
that he suggests is dd. Dd is a very powerful program that creates exact
bit-for-bit copies of drives or partitions. You might have used this command
previously if you had to create a boot floppy or an iso from a cd-rom.

While there are quite a few different arguments you can pass dd to change
its behavior, the two basic options are if and of, which specify the input
file and the output file for dd to use, respectively. As with Unix, in Linux
"everything is a file," so the input file of the output file is an actual
file on the system--for example, drive.img, a partition such as /dev/hda1,
or a complete drive such as /dev/hda. When you use Knoppix for disk imaging,
you run completely outside any disks on the system, so you don't have to
worry about files changing or being modified by your login.

A direct disk-to-disk copy is a common use of dd. In this scenario, you have
partitioned and configured one disk, hda, that you want to mirror--partition
tables and all--to a second blank disk, hdb. It is important that hdb be the
same size or greater than the size of hda when you copy the image;
otherwise, only some of your files are copied, or, the worst case, the image
does not mount. To perform the disk-to-disk copy, open a terminal and run
the following command:

[linux]$ sudo dd if=/dev/hda of=/dev/hdb

This command takes some time depending on size and speed of your disks, and
unfortunately, dd does not provide a fancy progress meter.

If you don't want to copy a complete drive, but just copy a partition from
one system to another, you add the particular partition number you want to
use. Similar to copying a disk to another disk, make sure that the partition
that you are copying to is the same size or larger than the partition you
are copying from. This command copies the first partition from /dev/hda to
the first partition of /dev/hdb:

[linux]$ sudo dd if=/dev/hda1 of=/dev/hdb1

Like with a disk-to-disk copy, this takes some time to complete, although,
generally cloning entire disks or partitions with dd is faster than doing
file-for-file copies with tar or cpio.

You also have the option to store a complete disk image to a file. This
enables you to create a complete snapshot of a hard drive that you can
reimage back to the drive to restore it to a certain state. This can be
particularly useful in the case of computer forensics [hack #47], when you
want to create a complete copy or multiple copies of a drive so that you can
examine the drive without risking any data loss. To copy a disk image to a
file, simply pass a filename instead of a device name to the of argument.
Most likely, disks you want to image in this way are larger than your
available Knoppix ramdisk, so you need to mount another disk to which to
save the image. To create a complete image of the /dev/hda1 partition and
save it in the root directory of a file system mounted at /mnt/hdb1, use the
following command:

[linux]$ sudo dd if=/dev/hda1 of=/dev/hdb1/hda1_drive_image.img

Many people make a point of adding an .img extension to their image files as
a reminder that the file is a complete disk image, but you can name the file
whatever you wish. Even though dd doesn't list progress, when you save to a
file, you can monitor the size of the file to see how much time you have
left.

The watch utility is particularly useful for this task because it performs a
command every two seconds and shows you the output. To monitor the progress
of this image, type the command:

[linux]$ watch ls -l /mnt/hdb1/hda1_drive_image.img

Once the operation completes, the complete contents of /dev/hda1 are stored
in hda1_drive_image.img.

You can also utilize ssh to save the disk image over the network to a
different machine. If you don't specify an output file, dd outputs the disk
image to STDOUT, which can then be piped through ssh to the remote machine.
So, if you have an account on 192.168.0.2 to which you want to save the
file, issue the command:

[linux]$ sudo dd if=/dev/hda1 | ssh username at 192.168.0.2 "cat >
/home/username/hda1_drive_image.img"

After you enter your password, dd copies the complete encrypted drive image
over the network and stores it in hda1_drive_image.img.

By storing a partition image in a file, you can use Linux's loopback
mounting option to mount this file as though it were an actual partition and
examine the files. For instance, if you have an image of an ext2 partition,
you can create a new mount point in /mnt and mount the file under Knoppix
with the following command:

[linux]$ sudo mkdir /mnt/temp
[linux]$ sudo mount -o loop -t ext2 /mnt/hdb1/hda1_drive_image.img /mnt/temp

Now you can browse through the file system at /mnt/temp just as if it were
the actual partition. This also works for browsing through ISO images, such
as the Knoppix CD image, or any other CD images you might have.

To reimage /dev/hda1 with a file you have saved, simply issue the dd command
in reverse:

[linux]$ sudo dd if=/mnt/hdb1/hda1_drive_image.ing of=/dev/hda1

If you have saved your image over the network, you can also reimage by
reversing the command by typing:

[linux]$ssh username at 192.168.0.2 "cat /home/username/hda1_drive_image.img" |
sudo dd of=/dev/hda1

With these commands, you can easily image and reimage machines just from dd,
but if you want a more graphical experience, Knoppix has included a utility,
partimage, that provides you with an easy-to-use GUI and still gives you
many options without  any command-line kung fu.

Partimage

While partimage can be run from the command line directly, this hack also
covers partimage's interactive mode, which it executes when you run
partimage with no options. Partimage requires root privileges, so under
Knoppix, type:

[linux]$ sudo partimage

When launched, the first option you see is to choose which partion you want
to save or restore. Like its name alludes to, partimage is only for the
purposes of saving and restoring partition images. Partimage also attempts
to guess which filesystem the partition is currently using, which makes it
easier to see which partitions you want to image on a multi partition,
dual-boot system. After selecting the partition to save, move the cursor
down to select the image file to save to. Knoppix has limited ramdisk space,
so you must save the partition image to another partition on the system.
Make sure that partition is already mounted and then type in the full path
of the file you want to save--for instance, /mnt/hdb1/hda1_drive_image.img.
Once you enter the filename, if you are saving to the local machine, you can
simply hit F5 to move to the next screen.

Partimage also provides an option to save the partition image over the
network to another machine. This requires the other machine to be running
the partimaged sever, so you need either another machine running Linux with
partimaged installed, or you can use another Knoppix disk booted on that
machine to run the server. If you choose to run partimaged from Knoppix, you
must create a password for the root user, because partimage prompts you for
a username and password before connecting to partimaged. On the remote
server, open a terminal and type sudo passwd to enter in a new password for
root. Then you can run the partimaged server in interactive mode (which lets
you see connections as they are created along with their progress):

[linux]$ sudo partimaged

Partimaged supports connections from multiple clients at the same time, so
you could potentially image multiple systems at the same time over the
network and save to a single file server.

After the server has been configured, on the partimage client, check
"Connect to server" and enter the IP address or hostname of the partimaged
server in the next field. Keep in mind that when you save to a remote
server, the path and filename you enter are the path and filename you have
used on the server, not on the local machine, so make sure that path exists
and you  have enough room for the image. When you hit F5 to continue,
partimage attempts to connect to the remote machine and prompts you for a
username and password. If the partimaged server is running on Knoppix as
well, enter root for the username and the password you have set up, and then
choose OK.

Once you've authenticated, you are presented with some compression and
file-splitting options. Partimage can compress partition images using gzip
and bzip2 algorithms, which are progressively slower but provide
progressively smaller images. By default, partimage also splits images into
files that are less than 2GB. This is a safeguard in case you are saving to
a filesystem that doesn't allow files to be larger than 2 GB. If you want to
burn the images to a cd-rom later, you can also modify this option to save
the image to 650 MB or 700 MB files. Once you have changed these settings to
suit your needs, hit F5 to move to the next screen, which allows you to type
a description of the saved partition. By default, partimage presents you
with information about the partition. Hit Enter to start the image-copying
process.

One nice thing about using partimage over dd is that the progress bars tell
you how far in the process you are, how much time has elapsed, how much time
is remaining, and information about how large the image is and how much free
space you have available. If you saved to a remote server, you can also
monitor the progress from there. Once the process finishes, partimage
displays how long the process has taken and then exits.

To restore an image using partimage, the process is quite similar: specify
the partition to which you want to restore to, and specify the image file's
path that has already been created. Check "Restore partition from an image
file" instead of "Save partition into a new image file."







-----Original Message-----
From: plug-discuss-bounces at lists.plug.phoenix.az.us
[mailto:plug-discuss-bounces at lists.plug.phoenix.az.us]On Behalf Of augie
Sent: Thursday, July 14, 2005 3:12 AM
To: plug-discuss at lists.plug.phoenix.az.us
Subject: Ghost equivalent for Linux


Hey Pluggers,
Anyone know of a program that'll clone a hd like ghost? I'm trying to clone
a
hd that has xp on another box and then install linux to have a dual boot
system or do I need to step away from the crack pipe?
Has anybody done this before? Any pointers?
TIA
--
	augie
grayfox78 at cox dot net

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change  you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
--
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.8.11/45 - Release Date: 7/9/2005

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.0/45 - Release Date: 7/16/2005