Personally, I use ddrescue (a Linux utility) to write an exact sector by sector copy of a drive to an image file on a mounted partition located on an external drive.
For example, I'll boot into a SimplyMEPIS DVD (Mepis is a Linux distribution with ddrescue already installed), plug in an external drive, click on the NTFS partition from Dolphin (the file manager built in) to mount it read/write, and type this:
su
fdisk -l
mount
Those commands help me make sure I know how my drives and partitions are labeled. The first drive will show up as /dev/sda, the second as /dev/sdb, the third as
dev/sdc, etc. (note the a, b, c changing for each new drive) Partitions are represented by a number following the drive label. For example, /dev/sda1 is the first partition partition on the first drive, /dev/sda2 is the second partition on the first drive, etc..
When a partition is mounted, it will show up as a folder under either /mnt, or /media (depending on whether or not it was plugged in at the time the system was booted up).
Basically, after making sure I know how my drives and mounted partitions show up (using the comands above), I'd do something like this to create a disk image file:
su
ddrescue /dev/sda /mnt/sdb1/20110815.img
That would create an image file of the system's first drive (/dev/sda) and write it to the first mounted partition on /sdb (the second drive in a PC). I often use a date as the image file name (20110815.img in that example), but, it can be anything you want it to be). If I wanted to restore it to a new drive later, I'd reverse it. IOW, just replace the failed drive, boot into a Mepis DVD, click on the NTFS partition I backed up to in order to mount it, and do this to restore the original image file to /dev/sda (fhe first hard drive in the system).
su
ddrescue /mnt/sdb1/20110815.img /dev/sda
Downside... it takes up a lot of space doing it that way (the image file is going to be the same size as the drive you're backing up) . But, if you want to make sure you have an exact copy, that's the best way to approach it.
Note that you can pipe the output via gzip or a similar utility so that it's compressed. Personally, I do
not compress my backup images.
For one thing, if a compressed file has any issues (for example, bad sectors on the drive you're saving it to creating errors), it can be difficult to recover it. . For another thing, if it's uncompressed, I can mount the image file as a loop device in Linux, treating it just like a physical drive. Note that you do need to mount specific partitions using offsets when you have more than one partition on a drive (and the image you create). But, that's really not very hard to do.
Here's one article I found explaining that process (how to mount partitions inside of a disk image file as loop devices). Note that the article shows using dd versus ddrescue to create the backup images. But, the concept is the same (both create exact sector by sector copies of a source device).
http://wiki.edseek.com/guide:mount_loopback .
Note that the article also uses the standard mount command in linux to mount a partition read only. A better way to approach it is to use the ntfs-3g driver instead. That lets you mount an NTFS partition inside of a disk image file as read/write when treating it as a loop device (basically, giving you all of the benefits you'd have if it was a physical drive versus a disk image).
If you google for something like mount loop offset ntfs-3g, you should find some examples of doing it that way.
Note that I usually keep at least one full disk image backup of a drive that I can restore to a new drive. As long as the new drive is the same size or larger than the drive the image was made from, it will restore just fine. Note that if the new drive is larger, you won't see the extra space until using a partitioning tool to increase the size of any partitions. That's because your disk image file is an
exact sector by sector copy (including the first 512 bytes which includes the Master Boot Record and Partition Table), so the partition table on the drive you restore to is going to match the source drive, even if it's really larger. Just use something like GParted (a paritioining tool) if you want to increase a partition size after restoring from a disk image backup.
I usually keep backup images of individual partitions, too (so that I have more than one copy of what's on the drive). For example, this would be the command I would use to backup the third partition on the first drive in a system to an image file named 20110815_sda3.img located on the first mounted partition on the second drive in my system:
su
ddrescue /dev/sda3 /mnt/sdb1/20110815_sda3.img
Once you understand the linux naming conventions it's pretty simple, and you can use a simple command or two if you want backup or restore exact copies of entire drives or individual partitions (and you can also mount those backup images as loop devices so that you can treat them exactly like you'd treat a real physical drive).
--
JimC
