Re: Backing up entire disk

["Robert G. (Doc) Savage" <dsavage@peaknet.net>]

On Mon, 2004-10-11 at 14:04, clangin@siu.edu wrote:
> I'm just learning about dd.
> 
> > well you could use dd and copy it bit for bit to another disk
> 
> If the first disk became unusable, would I be able to just physically
> swap disks and continue at the spot where the first disk was copied
> via dd?  (Assuming the jumper was changed to master on the replacement
> disk.)
> 
> > are you wanting something to use while the disk is "online" (ie, you
> > have booted off of it and are running the system currently) or do you
> > want something you can use offline?

Chet,

dd is the preferred utility for doing bit-for-bit disk copies. The best
way to do this is to first download and burn a Helix 1.5 CD, then boot
from it on the source machine. Helix is a forensic version of Knoppix
that will locate all partitions on your source machine for you. All of
its utilities (dd, netstat, ps, ...) are statically compiled and run
from the CD. Helix will allow you to create images of the whole disk, or
of each partition unmounted (the only safe and meaningful way).

If you lack space on your source machine to hold the images (very
likely), you can set up a netcat listener on a target machine that does.
Then start dd and pipe its output through a local netcat session to the
listener:

Listener machine:
# nc -l -p 40000 > /pathto/hda1_image.img
           ^^^^^ available high port number

Source machine:
# dd if=/dev/hda1 bs=2048 | nc listenerIPaddr 40000 -w 3
               ^^ partition to be imaged      ^^^^^ same port number
                  see 'fdisk -l /dev/hda'           as on listener

To capture the Master Boot Record (MBR) containing the partition table
and stage 1 of your GRUB boot loader, you would again set up a netcat
listener, then run:
# dd if=/dev/hda count=1 | nc listenerIPaddr 40000 -w 3

This will capture a single 512-byte block.

If you ever needed to restore from these images, boot from the Helix CD
again and set up a netcat listner on the system you want to restore to:

Listener machine (being restored)
# nc -l -p 40000 > /dev/hda

Source machine (containing backup images)
# cat MBR_image.img > nc listenerIPaddr 40000 -w 3

Once the MBR is done, restore the partition images:

Listener machine
# nc -l -p 40000 > /dev/hda1

Source machine
# cat hda1_image.img | nc listenerIPaddr 40000 -w 3

Repeat for hda2, hda3, and so on. Be patient. On a 100Mbps network you
can expect file transfer times on the order of 22 minutes for each 10
gigabytes.

And if you would rather image an entire disk rather than its individual
partitions or MBR, use 'if=/dev/hda' instead of 'if=/dev/hda1'.

Hope this helps...

-- Doc 
Robert G. (Doc) Savage, BSE(EE), CISSP, RHCE | Fairview Heights, IL
Fedora Core 1 kernel 2.4.22-1.2199.nptl on P-III/M IBM Thinkpad A22p
"Perfection is the enemy of good enough."
                         -- Admiral of the Fleet Sergei G. Gorshkov


-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.