Taking and restoring an image of partition with dd

Question

I created a new partition on my server /dev/sda4 with a filesystem based on ext3.

I mounted the new partition /dev/sda4 on /mnt/sda4/ and created an image with dd of the partition /dev/sda3. sda3 is mounted on the root folder (cd /) so it contains the most important files.

Creation of the image:

dd if=/dev/sda3 of=/mnt/sda4/backup.img

Then I removed a file on /var/www/html/ which is on the partition sda3. I tried to restore the image and it worked, but the file which I removed earlier isn't in back in place.

restoring:

dd if=/mnt/sda4/backup.img of=/dev/sda3

Output:

[root@h9999 sda4]# dd if=backup.img of=/dev/sda3
982128+0 records in
982128+0 records out
502849536 bytes (503 MB) copied, 1.13645 s, 442 MB/s

So actually it should work, shouldn't it?

Answer 1

There are several reasons why this may have failed: /var/www/html could actually be a symlink to somewhere else in your filesystem (try ls -la /var/www/ to see if there is a line like html -> /foo/bar/html. If /dev/sda3 was mounted during either of your dd processes, the filesystem may have been corrupted so that you don't see that file any more.

Using dd is in most cases not the best way to make a backup image of a disk, because dd copies everything including empty sectors and can only restore to a disk/partition of exactly the same size. Try partimage instead, which will copy only used sectors.

In most cases, using tar is actually the best option to create a backup of linux filesystems because this gives you independence of the filesystem and partition size used in the original partition and thus make the restoring process much more flexible. If you are worried about loosing the boot loader, the link I gave above also explains how you can restore the boot loader during the restoration process using a live cd, which is just a few additional lines of code apart from creating the partitions.