Full system backups
While I mentioned that I did not have a full system backup in my last notes, I did not explain further what I meant, and I was promptly asked what such backup is.
Ideally one should always do a full system backup to be able to restore a working system.
What is a full system backup?
I would define a full system backup as a backup that can be used for restoring a system to a previous state, it does not matter what the current state is.
Got infected by some malware? A full system backup should ensure there is no virus anymore.[1]
Deleted some critical files and folders? A full system backup would restore such components of the system.
Windows did install the update to a newer version even if you did not want to? A full system backup would restore the older Windows version.
Deleted the partition with the operating system? A full system backup would recreate the whole partition and its content.
Windows, and other systems, might provide some integrated tools for backing up the system. They might be easy to use and even do automatic backups in the background, but most of those solutions have at least a couple of issues.
The first, albeit only a minor one, is that such tools are strongly tied to the system. Thus if you handle different operating systems (or even versions of the same operating system), you might need to use different tools.
The second, which is not so minor, is that many professional solutions use proprietary formats, that are hard to inspect for correctness with external tools.
The third issue, and the most important one, is that if you are not able to start the operating system, then you might not be able to restore the data.
I’m using, for example, Timeshift as integrated backup solution on my Linux system. If something doing an update goes wrong, and I can still boot the system, then I can restore in a dozen of seconds an older version. In general, those integrated solutions can help in many situations, but they are not a replacement for a full system backup.
Thus, at least for my peace of mind, a full system backup is
-
saved somewhere else, often on an external drive
-
a full copy of the disk (or partition)
-
both the backup and restore processes do not depend on the installed system
Which tools to use
Any live CD is in general good enough. Just copy the disk to an image (cp /dev/sda my-pc.img), wait until the copy is done, and that’s it.
But this process might be very time and space-consuming.
If the drive has a capacity of 500GB an image of it will take 500GB, even if only 50GB are filled with actual data.
Clonezilla
Tools like Partclone do support multiple filesystems, can query where the drive holds the data, and copy only the relevant parts. It is a more complex process, but it can save a lot of space, and time.
For doing full system backups, I’ve mainly used Clonezilla, which uses Partclone internally, and falls back to a complete copy of the disk if the file system is not recognized.
There are many tutorials on how to use Clonezilla from a live CD or USB stick, for example on the project page 🗄️, there is little need to provide a whole step-by-step here.
When asked what type of backup to do, I would suggest doing device-image.
The option boot to ram is interesting if the iso is located on the disk you want to backup (and you did not have a spare USB drive or CD where to boot from), although I have never used or tested it.
Inspect backup
Being able to restore a backup is the most important part of the process, but it happens that one might want to restore, or extract, only some files.
If the backup was done three months ago, and you’ve just deleted a system file, doing a restore means losing three months of changes. If it were possible to just copy over the relevant files (assuming no further changes are necessary), it would be much more practical.
I found no way to inspect the content without recreating a whole image of the disk drive. Thus one needs to ensure to have enough space; it is a pity that it is currently not possible to mount the backup like an archive.
After extracting the archive (in case the backup has been compressed), use partclone to create an image file:
/sbin/partclone.ntfs --no_check --restore --source sda1.ntfs-ptcl-img --overwrite output.img --logfile partclone.logThe output might look similar to
Partclone v0.3.33 http://partclone.org
Starting to restore image (sda1.ntfs-ptcl-img) to device (output.img)
You are not logged as root. You may have "access denied" errors when working.
Calculating bitmap... Please wait...
done!
File system: NTFS
Device size: 53,7 GB = 13107192 Blocks
Space in use: 4,4 GB = 1066763 Blocks
Free Space: 49,3 GB = 12040429 Blocks
Block size: 4096 Byte
Elapsed: 00:00:28, Remaining: 00:00:00, Completed: 100.00%, Rate: 9,36GB/min,
Current block: 2565325, Total block: 13107192, Complete: 100.00%
Total Time: 00:00:28, Ave. Rate: 9,36GB/min, 100.00% completed!
Syncing... OK!
Partclone successfully restored the image (sda1.ntfs-ptcl-img) to the device (output.img)
Cloned successfully.There are some minor subtleties.
Without the parameter --logfile partclone.log, partclone requires admin rights because it tries to write the log file to /var/log/partclone.log. I guess this is the reason why it is located at /sbin on my system and is not in my PATH.
I’ve also used --no-check, because otherwise, I get the following error message:
Target partition size(0 MB) is smaller than source(53688 MB). Use option -C to disable size checking(Dangerous).In my case, the target partition had over 200GB of space available, so more than enough. It seems that partclone cannot query the size, even when executed as root. This might related to this bug report.
Once you have created the file output.img, you can view the output of file output.img:
output.img: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, hidden sectors 63, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors/track 63, sectors 104857536, $MFT start cluster 786432, $MFTMirror start cluster 1309293, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 0e2583b84583b568f; contains bootstrap NTLDRand in particular mount it, so that you can access the single files.
sudo mount -t ntfs-3g output.img /mnt/clonezilla
# inspect files as desired in /mnt/clonezilla
sudo umount /mnt/clonezillaMissing features
Apart from the missing functionality of extracting single files without creating a whole disk image file, there are also another couple of features that in my opinion would make Clonezilla/Partclone a better backup utility.
Clone on smaller drives
The first one would be being able to restore a backup of a bigger disk on a smaller one, if the smaller one is big enough to store all data. From what I’ve read online, Ghost supports (or at least used to support) that feature, but I’m not sure how well it worked, and under which conditions.
Did it "move" the files at the end of the partition, or should one hope that all files are at the beginning of the partition?
Personally, I’ve never needed a similar feature, so it does not affect me much, but it sounds like a nice feature.
It can be extremely useful if one wants to replace an HDD with an SSD on a computer, which has in general less capacity given the higher prices, or if one wants to "virtualize" an existing machine.
A possible workaround is the following approach:
-
create a system backup (just in case)
-
shrink the partition so that it should fit on the smaller drive
-
make a backup of the shrunk partition, and restore it on the new drive
Ignore user files
What I really miss, is being able to exclude files from the backup. Clonezilla can already ignore some files, like the hibernation file on NTFS partitions created by Windows.
I would really like to be able to exclude other things too; for example, my Video and Music folders, the folder containing my disk images, and so on.
They are big and take up a lot of space. I do not want to delete them before making a backup just to restore them shortly after, and I am already backing them up with other tools. They should not be part of a system backup. If I’m restoring a system image, I do not want to lose the work I’ve put in my documents; I’ll need either way to restore the most recent copy from somewhere else.
Bundling the backup of the operating system and user data together is generally not recommended, and in this case, it has a lot of drawbacks.
If Clonezilla would support such an option, I would also recommend not to skip the whole user directory!
Some user data, like configuration files, are not completely decoupled from the installed programs. Some programs can use configuration files created by previous versions without modifying them, while others update the configuration files to a new format, if necessary. Restoring an old version of the program, but keeping the configuration file in a new format, is most likely going to cause issues.
Thus, instead of skipping the whole user directory, it would be better to exclude only the big folders.
If such a feature would exist, one should obviously be aware that one could create a system image that is more or less useless, thus it should be an advanced option, just like it is an advanced option to skip the hibernation file on Windows.
Again, there are workarounds, like creating a separate partition for the user data and doing a backup only of the partition containing the operating system. I’m not a fan of creating separate partitions, I used to, but changed my mind; too much work for little gain, and has some disadvantages.
Other tools
Clonezilla might seem difficult to use as it can only be used from the command line.
In that case, one might want to give Rescuezilla a try, which provides a graphical interface.
I tested it and decided I’ll use it from now on, in particular, because it is still possible to start the cloning process from the command line, which means for someone coming from clonezilla, it provides the same interface.
But most importantly, it integrates other tools too, in particular:
-
gparted -
file manager
-
a web browser
This means that instead of having an image dedicated for backups, I can use it for other tasks too.
Granted, it does not happen that often that I need such things, I’ve never used in the last ten years most "rescue disks" I’ve collected, I guess some of them might not even boot on UEFI machines anymore.
But, in case I ever need it, it is good to have something that works available.
| Note 📝 | If you are wondering why I would ever need a browser.. in case something does not work, I would rather use the PC to search for a solution and be able to copy-paste proposed processes, instead of a separate device, like a phone, and copy manually the content from a small screen. |
Do you want to share your opinion? Or is there an error, some parts that are not clear enough?
You can contact me anytime.