Solved What is the best HDD image tool in FreeBSD?

mbzadegan

mbzadegan

Hi everybody,
I want to get an image from a MSWindows8.1 HDD(3 partitions) when I booting from my Live FreeBSD memstick.
What is the best and fastest tools for whole HardDisk Imaging that can restore its HDD image?
 
There are plenty disk imaging software such as Acronis True Image (commercial) or Clonezilla (open source). They generally boot from USB drive to keep the hard drive or usb drive intact during copying or imaging. I primarily use Acronis TI for any imaging jobs.

I don't know much about Clonezilla but they're popular free software that basically does the same thing as TI or Norton Ghost.

There is a FreeBSD tool called aimage that can image the drive but again I don't know much about it.

http://www.forensicswiki.org/wiki/How_to_image_an_IDE_disk_with_aimage_and_FreeBSD
 
OK, It's right for window and linux OS.
But if I want to Image UFS or HammerFS at the other senario, can Clonezilla imaging the UFS or HammerFS?
This means that it's better to use Traditional dd.
Can dd pair with pipe lines to understanding the imaging process time?
Ex. 0% =======> 100%
 
Making an HDD/SDD image meeting forensic standards is booting an (Live)OS from a readonly medium. But you have i.e. a Windows and a FreeBSD installation on the same HDD and you want to make a backup of one of your Windows partitions only, just boot your FreeBSD an do the work from there. This does not meet forensic specs but works perfectly also.

The utility copying raw blocks is dd(1). Default blocksize used by dd is bs=512 (byte-blocks) which results in many I/O events thus being slow. Speeding up is done by increasing to i.e. bs=8m or bigger but less than the cache of the disk drive.

You can copy the whole disk or single partitions or create .iso files. When copying partitions it is advisable to have a look on the disks first before with gpart show to be absolutely sure what you are going to do. A typo in the of= option of dd might erase a target for good unintentionally.

If you search the FreeBSD ports tree with ports-mgmt/psearch like this psearch -c sysutils -l dd you will find some specialized tools, some of them having a progress bar. But those are not sitting on a FreeBSD Live medium, making it necessary to create one with additional tools.
 
With FreeBSD's dd you can press Ctrl+t and it will print statistics about how many bytes were copied, etc. You know how big a partition is, so you can guess how much longer dd will run. This is of course not as nice as a progress bar but will work out of the box.
 
Something different: I wouldn't make images, because they are inflexible (you cannot restore them on other partition layouts and sometimes even not on other physical disks).

ZFS has got snapshots and for this zfs send.

UFS has got one of the most advanced utilities called dump(8) which operates cross-filesystem-type, does not need a filesystem as restore destination (but a simple mounted directory) and is even cross-platform (mostly!). Every filesystem should have dump(8), really! The FreeBSD Handbook even told us earlier that you forget everything else ("Q: Which backup tool should I use? A: dump(8). Period." or similar).

The rest is to know how to create partitions and install a boot manager, which is trivial. The most difficult part is to do, verify and manage backups properly, in my opinion.
 
An "image" is usually a block-for-block copy of a drive or partition. These are created or restored with dd(1) (see https://forums.freebsd.org/threads/scan-hard-disk-for-bad-sectors.20292/#post-115413 for a discussion and example of how block size affects speed). It is usually not the best way to copy a filesystem, because many blocks are empty, and the image cannot be restored to a smaller area.

A backup tool that is aware of the filesystem can be faster and more versatile. dump(8) has already been mentioned for UFS. For NTFS, there is ntfsclone from sysutils/fusefs-ntfs.
 
You must log in or register to reply here.
Back
Top