2
1
I need to clone a HDD to a network drive and then be able to extract files from the image (it should be faster than copying files from that HDD). It's highly preferrable if I could do it from a live cd, it should have drivers for an old PCMCIA network card STLAB 10/100.
This HDD can contain errors, so cloning software should be able to retry bad sectors.
Smit Johnth
Posted 2015-04-20T21:51:13.940
Reputation: 561
4
If you use a Linux live-CD, you can use ddrescue to create an image of the whole HDD and store this (probably large) file anywhere you like. ddrescue is similar to dd in the way that it will create a raw disk image. But it is designed specifically to work with slightly broken HDDs.
Many websites like ForensicsWiki suggest multiple passes of ddrescue to get fast and satisfying results (you need to use the same logfile every time, so it can know which sectors were already tried):
ddrescue -n /dev/sdX NETWORK/diskimage.img logfile.txt
ddrescue -r4 /dev/sdX NETWORK/diskimage.img logfile.txt
(For best results, you might want to have a good look at the manpage or other tutorials using ddrescue, depending on the damage on your HDD)
You can then mount this image (using the mount command from Linux/Cygwin or tools like OSFMount for Windows) so it is accessible like any other folder structure.
There is one caveat to your solution using the image: if you have a raw image, the empty space in the filesystem is also copied (so a 500GB HDD that is only filled with 300GB data will still have a 500GB image to copy over the network).
However, if you have enough local storage, you could first keep the image there and then resize it using tools like gparted
Slizzered
Posted 2015-04-20T21:51:13.940
Reputation: 1 256
Is there a way to mount it under Windows? There is almost no free space on the drive. – Smit Johnth – 2015-04-20T22:06:27.810
I'm not sure if newer versions of Windows can mount images natively. I found a tool called OSFMount that is freeware. Searching for "windows mount raw hdd image" might turn up other solutions
– Slizzered – 2015-04-20T22:16:36.0200
I would use clonezilla which is available as a live CD. See:
From what I understand it handles bad sectors. This understanding seems to be supported by the following post:
http://www.pchell.com/hardware/clone_drive_with_bad_sectors.shtml
Image can be copied to raw partition or smb or NFS. If smb or NFS, would need to later copy to open partition using clonezilla or uncompress it and create a disk image as outline in: http://ubuntuforums.org/showthread.php?t=872832
gzip and ntfsclone are available under cygwin so one might be able to create the image under Windows and then mount using either cygwin mount or OSFMount (http://www.osforensics.com/tools/mount-disk-images.html)
JonathanS
Posted 2015-04-20T21:51:13.940
Reputation: 499
1Can it save it to a SMB or NFS share? Is there a list of supported network cards? – Smit Johnth – 2015-04-20T22:04:58.103
Yes but it will be an image which you would then need to either mount to access the files or later copy to an open partition using clonezilla. – JonathanS – 2015-04-20T22:13:04.587
1Is there a way to mount it or extract files from it under windows? For example, there are tons of programs able to open ISO's. – Smit Johnth – 2015-04-20T22:14:11.967
Off hand I don't know of a Windows utility to do so. But you could install Cygwin and use it. The steps under linux are outline in this post: http://ubuntuforums.org/showthread.php?t=872832
– JonathanS – 2015-04-20T22:20:23.5671Is is possible to mount under cygwin?? It doesn't have any drivers. – Smit Johnth – 2015-04-20T22:21:29.967
cygwin has mount but it may not work. You could try: http://www.osforensics.com/tools/mount-disk-images.html once you've created the image.
– JonathanS – 2015-04-20T22:26:30.960
There are three layers of filesystems in your scheme: filesystem of the imaged drive, filesystem of the drive on which image is stored and virtual filesystem emulated by network. It won't be faster than reading directly from disk. Please see What is the XY problem? and ask for the solution to original problem.
– gronostaj – 2015-04-20T22:01:29.230@gronostaj I don't care as far as I can extract files later. – Smit Johnth – 2015-04-20T22:03:24.500
If you image the drive with a command, you get a VHD which you can mount (attach) via disk management > Action tab. The command is --> wbadmin start backup -backupTarget:X: -include:C: -AllCritical -quiet <-- You have to replace "X" with the volume letter of your backup device. Just copy/paste the command into an elevated command prompt window. Make sure to edit 'X' first. – whs – 2015-04-20T23:42:00.757
@whs Don't quite get what you are talking about. – Smit Johnth – 2015-04-20T23:48:54.647
I could not edit the above. I suggest you leave the -AllCritical parameter off. And if your volume that you want to image is not C:, change that volume letter too. Note: This is a cmd command that will create an image VHD that you mount with Disk Management as described above. No programs needed for that. If you have specific questions, please ask. And if you are really confused but are interested in the solution, I will make you a little video. – whs – 2015-04-21T00:10:03.593