How to create VHD disk image from a Linux live system?

Question

Once more, I have to resort at the experts here at SuperUser, as my other sources (mainly Google ;-)) didn't prove very helpful...

So basically, I would like to create a VHD image of a physical disk to be archived/accessed/maybe even mounted in a virtual machine. Now, there are dozens of articles and tutorials on how to do that on the web, but none that meets exactly the conditions I would like to achieve:

• I would like the destination file to be a VHD image, as Windows 7 can mount it natively, even over the network and many other programs can use it (VirtualBox, ...)
• The disk I'm trying to image contains a Windows XP install, so in theory, I could use the disk2vhd utility, but I would like to find a solution that doesn't require booting that Windows XP install (ie keep the disk read-only)
• Thus I was searching for a solution involving some sort of live system (running from a USB stic or the network)

However, all the solutions that I've came across either make use of disk2vhd or use the dd command under linux, which does a complete copy of the disk (ie even empty blocks) and does not output a VHD file. Is there a tool/program under Linux that can directly create a VHD file? Or is is possible to convert a raw disk image created using dd to a VHD file, without allocating space for the empty blocks? How would you proceed?

As always, any advice or comment is highly appreciated!!

Solution 1

For future reference, here is how I finally proceeded, with a few comments on the various issues or pitfalls encountered:

1. Boot the machine with a Linux live system

First step was to boot the machine containing the disk to image, using a Linux live system.

NOTE: My first idea was to use an Ubuntu Live USB disk, but the machine did not support booting from USB, so I found it easier to use an old Knoppix live CD.

2. Image the disk using dd and pipe the data through ssh

Then, I copied all the disk content to a file image on my local server using dd and piping the data through ssh:

$ dd if=/dev/hdX bs=4k conv=noerror,sync | ssh -c blowfish myuser@myserver 'dd of=myfile.dd'

A few comments here: this method will read all the disk contents, so it can take very long (it took me 5hrs for a 80Gb disk). The bottleneck isn't the network, but really the disk read speed. Before launching the copy, I advice to check the BIOS/disk/system parameters to ensure that the disk and the motherboard are working at their highest possible speed (this can be checked using the command hdparm -i and by running a test with hdparm -Tt /dev/hdX).

NOTE: dd does not output progress of the operation, but we can force it to do so by sending the USR1 signal to the dd process PID from another terminal:

$ kill -USR1 PIDofdd

Note: Newer versions of dd support the status=LEVEL option (man dd)

   status=LEVEL
          The  LEVEL of information to print to stderr; 'none' suppresses everything but error messages, 'noxfer' suppresses
          the final transfer statistics, 'progress' shows periodic transfer statistics

3. Reclaim the unused space

At this point, the source machine is no longer needed and we will work exclusively on the destination server (running Linux as well). VirtualBox will be used to convert the raw disk image to the VHD format, but before doing so, we can zero out the unused blocks, so that VirtualBox does not allocate space for them in the final file.

In order to do so, I mounted the images as a loopback device:

$ mount -o loop,rw,offset=26608813056 -t ntfs-3g /mnt/mydisk/myfile.dd /mnt/tmp_mnt
$ cat /dev/zero > zero.file
$ rm zero.file

NOTE: The offset indicating the beginning of the partition within the disk image can be obtained by using parted on the image file:

$ parted /mnt/mydisk/myfile.dd
(parted) unit
Unit?  [compact]? B
(parted) print
Model:  (file)
Disk /mnt/mydisk/myfile.dd: 80026361856B
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start         End           Size          Type      File system  Flags
 1      32256B        21936821759B  21936789504B  primary   ntfs         boot
 2      21936821760B  80023749119B  58086927360B  extended               lba
 5      26608813056B  80023749119B  53414936064B  logical   ntfs

NOTE2: The default Linux kernel NTFS driver provides read-only access, thus it is necessary to install and use the userspace ntfs-3g driver or writing to the disk will raise an error!

4. Create the VHD image using VBoxManage

At this point, we can use the VirtualBox utilities to convert the raw image to a VHD file:

VBoxManage convertfromraw myfile.dd myfile.vhd --format VHD

Solution 2

I was trying to do exactly the same thing as the OP (while rescuing a Windows installation) and ended up creating a new tool for it, ntfsclone2vhd.

You would then simply do something like this:

ntfsclone --save-image -o - /dev/sdXX | ntfsclone2vhd - /mnt/usb/output.vhd

Solution 3

One approach is to use a couple of handy technologies: VirtualBox, and the ntfsprogs package.

Recent versions of VirtualBox allow you to create VHD hard disk files, while ntfsprogs provides the ntfsclone utility. As its name suggests, ntfsclone clones NTFS filesystems, and I believe that it does it at the filesystem level, skipping over unused disk blocks.

So, to begin, create a new VM in VirtualBox, and provision a new, empty VHD-file drive for it. The VHD drive need only be as large as the size of data in use on the physical drive you want to clone (well actually, make it a little bit larger, to allow for some wiggle room).

Next, find a Linux live CD that contains the ntfsprogs package, as well as openssh-server. I like System Rescue CD for this, but pretty much any Debian- or Ubuntu-based live CD should work as well.

Boot the VirtualBox VM with the Linux live CD, and start sshd within the VM so that you will be able execute commands on it remotely. Partition the empty VHD drive approriately, using whatever partitioning tool you prefer (I like plain old fdisk, but I'm somewhat old school).

With another copy of the Linux live CD, boot the machine containing the physical disk you want to clone. I assume that the VirtualBox VM and this machine are accessible to each other over the network. On this machine, execute the following command (all on one line):

ntfsclone --save-image -o - /dev/sdXX |
    ssh root@VirtualBox-VM 'ntfsclone --restore-image --overwrite /dev/sdYY -'

where:

• /dev/sdXX is the device name (on the local machine) of the physical drive you want to clone, and
• /dev/sdYY is the device name (in the VM) of the VHD destination drive.

Explanation: The first ntfsclone command in the pipeline extracts an image of the source NTFS filesystem and sends it out through the ssh tunnel, while the second ntfsclone command receives the image and restores it to the VHD drive.

Once the operation completes, the VHD file should contain a file-for-file exact clone of the original physical disk (barring any hardware errors, like bad sectors, that might cause the process to abort prematurely).

One last thing you may want to do is to run a Windows chkdsk on the VHD drive, just to ensure the cloning didn't introduce any problems (it shouldn't have, but hey, I'm a bit paranoid about these things).

Solution 4

(I know this is an old post, but maybe this will at least help others.)

Do you really need to be able to create the image under Linux? I think you are trying to backup Windows hard drives to VHD. I don't think that Linux file systems can be encapsulated in a VHD container.

A free SysInternals utility called Disk2vhd will create VHDs of the currently running Windows XP or newer system. This should also work for imaging USB mounted drives.

View more solutions

Comments

[julian]

The BSDs have a tool called mkimg that can make a vhd image among other formats.

[NelsonT]

I won't try hot-copy because of this, wiki.r1soft.com/display/LTR1D/hcp-setup

[Federico]

Hi, thank you very much for your proposed solution! In the end, I used another method as I had several partitions on the disk to backup and could not easily use VirtualBox on the machine to backup (see my answer for details), but your suggestion to use VirtualBox and ssh proved very useful!

[Francesco]

you should be able to mount the vhd image using vdfuse or qemu-nbd or converting it to an .img files ( more info: askubuntu.com/questions/19430/… )

[Jeremy]

On a slow machine, the encryption of the ssh may be a bottleneck. Consider using netcat (man nc) instead if you don't need the encryption.

[user66001]

THIS SOLUTION NEEDS TO BE VOTED TO THE TOP. It is by far the easiest solution (bar having to make copies of Linux) I have found in many hours of searching. Bravo for taking the initiative Yirkha!

[Smeterlink]

You forgot to cd into the mounted disk before creating the zero file: mount -o loop,rw,offset=26608813056 -t ntfs-3g /mnt/mydisk/myfile.dd /mnt/tmp_mnt ; cd /mnt/tmp_mnt ; cat /dev/zero > zero.file ; rm zero.file ; Also you can use pv instead of dd to show instant progress.

[Fritz]

You should probably use a larger block size with dd, for instance bs=4M to speed up the process significantly.

[Scott - Слава Україні]

And then what do you do?

[Smeterlink]

@Scott what are you talking about? You boot from ANOTHER Windows or Linux to make a VHD from the current Windows installation. You can't do a VHD if the real Windows is running.