Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've picked up an HP Simplesave external drive. It comes with some fancy software that is of no use to me because I don't use Windows. Like many current consumer-targeted backup drives, the backup software is actually contained on the drive itself. I'd like to save the drive's initial state so that I can restore it if I decide to sell it.

The backup box itself is somewhat customized: in addition to the hard drive device, it presents a CDROM-like device on /dev/sr0. I gather that the purpose of this cdrom device is to bootstrap via Windows autoplay the backup application which lives on the disk itself. I wouldn't suppose any guarantees about how it does this, so it seems important to preserve the exact state of the disk.

The drive is formatted with a single 500GB NTFS partition.

My initial thought was to use dd to dump the disk (/dev/sdb) itself, but this proved impractical, as the resulting file was not sparse. This seemed to be because the NTFS empty space is not filled with zeroes, but with a repeating series of 16 bytes.

I tried gzipping the output of dd. This reduced to the file to a manageable size — the first 18GB was compressed to 81MB, versus 47MB to tarball the contents of the mounted filesystem — but it was very slow on my admittedly somewhat derelict Pentium M processor. The time to do that first 18GB was about 30 minutes.

So I've resorted to dumping the disk state and partition data separately.

  • I've dumped the partition state with

    sfdisk -d /dev/sdb > sfdisk.-d.out
    
  • I've also created a compressed image of the NTFS partition (the only one on the disk) with

    ntfsclone --save-image --output - /dev/sdb1 | gzip -c > ntfsclone.img.gz
    

Is there anything else I should do to ensure that I can restore the precise original state of the drive?

share|improve this question
    
crossposted on superuser.com –  intuited Jan 1 '11 at 18:39
add comment

1 Answer

up vote 2 down vote accepted

sfdisk -d dumps the partition table but not the rest of the boot sector, so if there was a bootloader on the disk it won't be restored. You can save the boot sector with head -c 512 </dev/sdb >bootsector.img.

share|improve this answer
    
Thanks.. I had a feeling I was forgetting something.. –  intuited Jan 2 '11 at 5:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.