|
HAVE I HELPED? |
FINALLY, SOME BACKUPs WORTH USING.....
The traditional way of doing backups is to use some software program utility which allows you to choose which directories, files to backup. This was fine in the old days when your OS never changed, and you didn't add new applications and utilities every other minute. When your Computer or especially your disk crashed, you had the terrible problem of reinstalling your OS, your applications, your data, and then updating the OS, the applications, including your antivirus. This tends to be very painful.
There are better ways to do this. You can perform an "image" backup, where you will take a snapshot of your entire disk drive, and store it away. Restoration in the case of a disk crash was as simple as reinstalling the image on your [presumably] new disk drive. The only drawback to the image backup technique is that the backup image tends to be very large, and takes longer than a plain old backup of a few data files, especially using incremental backup techniques.
Nevertheless, in many many cases, this type of backup fits many people's needs. If your PC is not used for business, and you may not be quite as fussy as to what is on it and how up to date it has to be, you can limit your image backups to once a week, or a few a month. Or you can still do the image backup every day of course.
It can be very useful also to store certain baseline images, for example you have just constructed a new PC for your aging parents, or your daughter. You save an image of the Disk drive, just in case they trash the PC, and you want to revert to a known good system. You will only have to perform probably Windows backup and antivirus updates when you do the image restore.
It can also be useful when you want to run different OS's on the same PC. Setting up dual booting is not needed. Just restore the imae of the OS you want to run.
Absolutely the best and cheapest way to do image backups is to use the live Linux Knoppix CD, using all the free included utilities. See below. Actually........ there may be an even better way using large external hard drives, especially if they are networked, and therefore reachable by all machines on your network. Simply run the image backup utility on your PC, and back up the file to the shared hard drive. See the discussion below.
You can perform image backups on Win9X, WinNT, Win2K, WinXP, Linux using one of the newer utilities available at your local computer store, such as:
Drive Image by Powerquest [ http://www.powerquest.com/driveimage/ ], or
Ghost by Symantec [ http://www.symantec.com/sabu/ghost/ghost_personal/ ].
Late 2004: I notice that Powerquest has been bought out by Symantec, so this will probably disappear.
There is also an open source image backup utility, called "partimage" [ www.partimage.org ], which works much like the above commercial products, but which runs under the Linux OS.
Win XP has a very similar technology embedded in the OS, called "system restore." HOWEVER be careful, this only does SYSTEM restore and will not restore your data, so you have to do a backup in addition to the system restore. Sounds like a good case of using drive image here as well...! I have not played with system restore yet, but I understand it does NOT touch the "My Documents" section, it only works to restore XP system resources. So you still need measures to backup your personal data.
I also discuss day to day techniques you can use to help protect your data.
Feb 2005:
I have heard good reports on Acronis Trueimage. Have not tried it yet, but I have tried Symantec Ghost 9, and this is a great improvement over previous products. It saves to network drives, does so within Windows, will allow a boot from CDROM to restore system. Stay tuned for some reports on this capability..
1. DriveImage
Drive Image will create an image of your disk [actually one or more partitions of your choice], with the OS and all applications and all your data, and write the image to wherever you want, in order to save it. This is called "create image." Ideally, it should be created on a second disk in the same PC, to protect the most likely problem of a disk crashing with your OS. It is also possible to put it on a separate PC using a network setup in the install of Drive Image. Whenever it is desired, you can perform a "restore image" operation, in order to take the previously created backup image and restore it to the working disk [which may be a new disk if your OS disk crashed]. Both the "create" and "restore" operations are performed by booting two special floppies, and going to a DOS level. You can perform these "create images" as often as you want to "backup" the data. For businesses, it may need to be done every night. This type of operation does not actually backup operations during the course of the day between "create image" operations, so the manner in which the data was created must be preserved until the "create image" operation is performed. Other more complete methods, such as the use of RAID are not discussed here.
When creating images, be careful of "diagnostic partitions" on your PC. You must backup these partitions as well at the same time so that they can be restored. Typically the BIOS will boot directly into the diagnostic partition, which will probably be the first partition on the IDE0 master disk, "hda"1 in Linux lingo, and then wait for user input as to whether to run diagnostics or not. If the user does not select diagnostics, or the operation times out, then the hda2 partition is booted. So if you only restore the hda2 partition, and do not restore the diagnostic partition on hda1, the BIOS will boot into "nothingness" and you will get the "invalid system disk" message. Driveimage handles this situation correctly, as long as you tell it to back up the diagnostic partition as well as the OS partition. It will backup two partitions simultaneously. Driveimage will also restore an image to an "unallocated" disk drive, which means you don't need to run fdisk to create partitions, much less format it. You can take the drive "out of the box (OOTB)" and restore to it. Very nice...
One of the most useful features of Drive Image is to create multiple OS images, complete with applications and program subscriptions, all on a single PC. This is kinda similar to dual/multiple booting of OS's, except that I think you can use, like one copy of the anti-virus software under all the OS's, since they all run on the same exact machine.
I find it very useful to fully setup a PC, complete with windows updating, applications, antivirus subscription. I then use Drive Image to save this image to a second disk. I can then ship this PC to my daughter in Denver, or my mother in KS, and if they wreck the PC, I can have them restore the original setup that I created for them. They just need to boot the Drive Image disks and enter a few commands. It is the ultimate backup tool for this situation. It is exactly like a "system restore" CD that you get from the manufacturer, EXCEPT that you get to restore all the installed applications and settings! It is great! All you need is an extra disk drive in the PC [or you can actually use an extra partition on the original disk drive - but beware this won't protect you if you lose that drive!].
The last version of Driveimage I have, Driveimage 2002 does NOT support the ext3 file system of recent versions of linux, so be careful. DriveImage 7, which has just come out in the fall of 2003, has additional capabilities, such as making it easier to save images to other machines on the network, and save images while you are in Windows.
2. Partimage
"Partimage," at www.partimage.org is an open source image backup utility which does much the same job as DriveImage and Ghost. It will run directly on a Linux machine and do an image backup to another "mounted" drive partition. This would be accomplished from within Linux by issuing the mount command, such as "mount -t vfat /dev/hdb3 /mnt." This takes the partition on the second IDE drive (hdb) and the 3rd partition on that drive and "mounts" it on the /mnt drive point. You can then run partimage and give the image name as /mnt/Imagename. Thus, we now have a way to backup Linux images using the ext2 and ext3 file systems. Partimage is also capable of booting from a floppy (it runs a reduced Linux image OF COURSE!) and creating images of Windows OS partitions on other partitions.
For Redhat Linux, just install the partimage rpm. You can then run partimage by "/usr/sbin/partimage." You will be able to save your / partition to a spare partition on another disk drive. Linux is installed with two partitions minimum: / and swap. So you would be backing up the / partition onto another partition on another disk. The swap partition doesn't need to be backed up. The partition where you want to save the image must be created beforehand. The format is normally ext3 for Linux Redhat, but ext2 or vfat is also acceptable. In more complex Linux environments, which use multiple partitions, these tools that do partition backup are less useful.
To restore the saved image to the / partition, you cannot do it from within Linux, you must boot two floppies, much like DriveImage. These floppy images are downloaded, and then written to the floppies. They can be created from either Linux or Windows OS environments. The floppies contain a small version of Linux to do the actual work. You can also create a bootable CDROM to do the same work. Very nice.
For Windows OS, of course you must boot the floppies to do either a save or a restore operation. The trick is to know the partitions in your PC before you do all this, specifically which partition is to be backed up or restored, and the partition where the image file will be stored. For example, I have a Windows 98 on IDE controller 0, master, partition 2, which works out to be hda2. I have my spare disk drive on IDE controller 1, slave, partition 1 which works out to be hdd1. The essential thing you need to do in partimage at the command prompt (before you run partimage) is to MOUNT the file system where the image will be created/restored. So in my case I would issue the command "mount -t vfat /dev/hdd1 /mnt." This will mount the disk drive where I will be storing the image as fat32 (having already been partitioned and formatted as a fat32 drive), onto the mount point /mnt. I then run partimage and select the partition to be backed up, give the image a name [make SURE that you specify the entire name, such as "/mnt/Win98image.bz"], select the compression desired [don't bother with compression if you have lots of disk space], and select no split, since we are dealing with large disks here in general. If you want to save the images to CD-R later, you must "split" the image, and then go back, when you are in the OS, and write the images to CD-R in the normal way tht you would create a data CD-R. There is no way that you can use partimage to write directly to the CD-R currently. Since the size of hard drives is so large now, and the cost is so reasonable, there is little reason not to use a hard disk as your backup.
We also have to save the partition entries. We will do this by creating a directory on the same disk where we are saving the backup image, and do a little Linux magic. This is from the partimage document. We will NOT be concerned with extended partitions right now, so we won't need the extra tool.
Even if you have only one volume, your hard disk is divided into partitions. The standard MSDOS volume label allows to have up to 4 primary partitions. The partition table is stored in the MBR (Master Boot Record). This area is the first 512 bytes of the physical hard drive. It also contain some code which will start the operating system, which can be the bootloader (LILO, grub, ...). If your hard disk is hda, primary partitions are hda1, hda2, hda3 and hda4. It's easy to save the primary partitions table, by copying the MBR. To get past this limitation of 4 primary partitions, you can create an extended partition. An extended partition is a primary partition which contains a lot of partitions. For example, if hda2 is an extended partition, its logical partitions will appear as hda5, hda6, hda7, ... even if you don't use 4 primary partitions. That's why you can have an hda5 device, with no hda4. The problem with extended partition is there is no table we can easily save. The extended partition contains a linked list. hda5 will point to hda6, hda6 will point to hda7 and so on. This makes it difficult to save the partition table of the extended partition. Partimage can save the data of one partition, but it won't save your partition table. If you have a major problem with your hard drive, you may have to restore both the partition table and the data - having the images of the partitions won't be a lot of help on there own. Which is why we'll show you how to save the partition image now. Making a backup of the partition entries We will save all the partitions entries (both primary and logicial ones which appear in the extended partition). In this example, we'll be assuming that hda (the first IDE hard disk) is to be backed up. First, we will save the MBR with DD (GNU convert and copy)
a.. cd /root [I would cd to /mnt - the new disk drive you are
saving TO]
b.. mkdir partition-backup [in the /mnt directory]
c.. cd partition-backup
d.. dd if=/dev/hda of=backup-hda.mbr count=1 bs=512
It will produce a very small, but very important file: 512 bytes of data. This will be on the same disk that we will be saving the image to. Now, we will save entries of the extended partitions:
a.. sfdisk -d /dev/hda > backup-hda.sf
sfdisk is a tool provided with the util-linux package. IMPORTANT! You should now put these files somewhere safe - copy them to a floppy disk (and take a copy of it!), or burn them onto a CD. Keep these files safe. Do not leave them on your hard drive - if there is a problem with the drive, you may not be able to access these files, and while your partition images won't be worthless, it will certainly be a lot harder to restore your data.
Restoring partition entries from the backup. Be careful, restoring is a dangerous action - it can destroy data! First, we will restore the Master Boot Record [you must first mount the disk drive by "mount -t vfat /dev/hdd1 /mnt" and then "cd /mnt/partition-backup]
a.. dd if=backup-hda.mbr of=/dev/hda
Then, here is how to restore extended partitions entries:
a.. sfdisk /dev/hda < backup-hda.sf
To finish, you will have to reboot your computer. Of course the relevant partition defined in the newly restored partition table must be formatted in order for partimage to use it. So we have to go back to our Win98 startup disk and format the partition, typically "format c:". This is a disadvantage compared to Driveimage! Using a Win98 startup disk and fdisk is the normal way to create partitions. Being a Microsoft/DOS creation, fdisk only lets you create a single primary partition, so just create the one if you have XP. Then boot XP and you can create additional partitions [up to 4 total partitions], and format them as FAT32 or NTFS. partimage will write to both FAT32 or NTFS. In addition, in XP, you have the option of NOT assigning a drive letter, so the drive is actually hidden from normal use :-). This discusses some more on partitions on your PC.
As of this writing, I cannot get partimage to write to an NTFS formatted partition. It mounts the drive as "read only." Still investigating this, but it probably doesn't matter much which format the backup partition is. The only real advantage of using NTFS for the backup image, is that you could encrypt the image file [after the fact of course using the encrypting file system tools]. Otherwise, without this technique, the only way you could read the image file would be to run partimage and restore it on a new disk drive, so it is not secure in the grand scheme of things.
For the restore operation, pretty much the same options apply, you can tell partimage to zero out all unused data blocks as well.
The biggest problem with partimage is that it does not appear capable of reading FAT12 formats, and that it needs pre-partitioned drives and formatted partitions in order to restore images. The situation with one of my PCs [HP BRIO] is probably typical. I actually have a diagnostic partition on hda1, which the BIOS apparently boots to initially, before jumping to the hda2 partition which contains the OS. This diagnostic partition is a FAT12 format, actually a floppy disk format, and partimage is not currently able to read FAT12 formats. So If I cannot save and restore the hda1 FAT12 partition, or I cannot tell the BIOS to jump to hda2 instead of hda1, I cannot do a drive swap using partimage.
Here is a great reference for the "DD" command.
3. XP System Restore
To access System Restore, goto Control Panel -> Performance and Maintenance -> System Restore. This runs the system restore wizard, which seems to be all that there is? I can't even find a route to this in the normal (classic) control panel.
4. Day to day backup
If you do not want to go thru the image backup procedures, you should at least take your "My Documents" folder on your desktop and copy it to a second disk drive every week. Just make sure you save all your work documents to the "My Documents" folder. This technique certainly doesn't preserve your applications and their settings in case of a main disk crash [you would have to reinstall and configure these], but it would save all your term papers that you have on the PC.
5. Using Knoppix to do an image backup of your system, or to switch to a second disk. <<<<< GREAT TECHNIQUE
This technique is similar to section 2 above, where you use partimage. But it can potentially be much simpler if it fits your situation. The general idea is to add a second disk to your machine, create a partition on it which matches exactly your main boot partition, boot knoppix, and run the "dd" utility to copy the image over to the other disk drive! Very simple. Follow these steps:
- Acquire a second IDE (or SCSI if appropriate) drive, which is at least as large as your main drive. Install this drive in your PC, using some of the techniques presented here. Make note of which drive is your main drive, most likely /dev/hda, and which partition is used for booting, most likely /dev/hda1. If this is not the case, you will have to do some investigation. If you have logical partitions, the procedure is a little more complicated.
- Acquire Knoppix, and make sure your PC will boot the CD. You may have to go into the BIOS to change the boot order to check the CD as well as the floppy, before it checks the hard drive. Boot Knoppix. It might help if you have a little unix experience.
- Open a terminal window, switch to root via "su." Issue the command "cfdisk /dev/hda" assuming /dev/hda is your original, main drive which contains the boot partition. You should see your boot partition listed there. Make note of the boot partition, its exact size and type. You will duplicate this partition on the new disk drive. If you see a logical partition listed, you are going to have to duplicate the disk partitions exactly in order to restore the logical partition on the new disk. The simpler situation is to have no logical partitions on /dev/hda.
- Open a second terminal window, switch to root via "su." Issue the command "cfdisk /dev/hdc" if hdc is your new disk drive. You will make a "new" partition of the same type as on the main boot partition, and the exact same size. If you have a logical partition on the main disk, you will have to recreate the second disk exactly as the first one. "Write" the partition table to disk with the "write" command.
- Make sure the main boot partition is mounted via the "mount /dev/hda1 /mnt/hda1" command. Or simply right click on the partition listed on the left, and select "mount."
- Open a third terminal window, and switch to root. Issue the command "dd if=/dev/hda1 of=/dev/hdc1." This will make an exact copy of the main boot image in the new disk drive and image on /dev/hdc1 partition.
- Now we need to copy over the MBR. In a terminal window, cd to the /mnt/hda1 directory - so we will have someplace to write our data. Issue the command "dd if=/dev/hda of=hda.mbr count=1 bs=512." This will read the first sector of the disk, which is the MBR, which contains the partition table.
- If you have a logical partition, use the command "sfdisk -d /dev/hda > hda.sf." Again, make sure you are in the /mnt/hda1 directory so you can perform the write operation.
- Now we can write the MBR to the new disk via "dd if=hda.mbr of=/dev/hdc."
- Restore the logical partition via " sfdisk /dev/hdc < hda.sf.
- New info November 1: Once you setup the new disk and he new partition, you will NOT have to mount the partitions before you do the dd command to copy the disk. I also believe that the MBR is copied as well, with everything else. I am currently investigating these details, so be careful out there. In all my experience so far, I do believe that booting Knoppix and doing a "dd" is the simplest way to perform a complete backup!!! If you are copying a Windows partition, such as XP, and the resulting XP will not boot, boot the XP CD, go into recovery console via "R,", select eh OS, most likely "1," enter your administrator passwd, and try the "FIXMBR" command. XP should boot after this.
Here is a good description of using Knoppix for system recovery efforts!
The simplest, cheapest backup of all..... A summary...
1. Acquire Knoppix as before.
2. Acquire a second hard drive and install on the second IDE controller as master. The new disk drive is /dev/hdc
3. Boot knoppix.
Open a terminal window, and enter "cfdisk /dev/hda." Note the partition size.
Open a second terminal window and enter "cfdisk /dev/hdc." Create the new partition exactly the same size as the one above, and set the type the same. Make it bootable. Write the partition table.
In a third terminal window, switch to root via "su." Issue the command "dd if=/dev/hda of=/dev/hdc" This command will duplicate your main disk drive onto the hdc disk drive. It takes about an hour for every 10- 20 GBytes of disk size. Keep in mind that this duplicates the entire disk drive partition, including all the empty sectors.
Disconnect the disk from the IDE cable to prevent any possible modification to it.
To switch to the new disk drive, simply switch the IDE cables on the motherboard! That is it!!
You now have the second disk created exactly like the first disk. You can even change the IDE cables inside the PC, and the PC should boot from the new disk drive. You should go into the BIOS and make sure the BIOS rereads and sets the disks correctly, since I doubt your disks are identical. Many modern BIOS's will detect a hardware change and adjust, or ask you to go into setup and check things out. Just find the IDE drive section and make it rediscover if necessary. Save and exit the BIOS. Once XP starts, it will detect the new hardware, and will probably ask you to reboot the PC. Windows XP will have to recognize the new disk drive hardware, if not the same. It may take it a while, and will ask you to reboot when it figures out new driver. Until then it is probably operating in minimal compatibility mode, maybe PIO mode!
This is a great way to get a new hard disk into your system. Even though you had to create the new disk with the exact same partition sizes, you can use "parted" or partition magic tools to resize the partition to a larger size.
6. Some clarifications on MBR and boot sectors...
When you do a "dd if=/dev/hdc of=/dev/hda4" for example, the operation copies the MBR as the absolute first sector of the hdc drive, independent of any partitioning - it copies the entire drive hdc, sector by sector into the partition hda5. The MBR contains the partition table. When you copy /dev/hda4 back to a new drive, the new partition table will be copied onto the new drive. Is this what you really want? You may really want to just copy the partition /dev/hdc1 so that you do not overwrite the partition table [and the MBR] when you copy the partition onto a new destination partition.
For example, I want to upgrade my 3GB drive on my IBM thinkpad to a 20GB drive. I first place the 20GB drive into an existing PC on the /dev/hdc position, and partition the drive into two 10GB partitions. I then plug in my old, existing 3GB drive on an IBM thinkpad. I want to copy the partition - /dev/hdc1 in this case because I have the drive in a second PC to /dev/hda4 - a spare partition on my system.
Now I place the 20GB drive back into the /dev/hdc position, and do a "dd if=/dev/hda4 of=/dev/hdc1." This operation does not overwrite the partition table I created on the new 20GB drive, thus maintaining the new partitioning. If I were to overwrite the partition via "dd if=/dev/hda4 of=/dev/hdc" - I would overwrite the MBR and the partition table on the new drive. This is NOT what I want.
7. A Windows live CD!!
Now there is even a Windows live CD. This is worth investigating.
8. An emerging new alternative: Using external hard drives, networked to your PCs to backup your files. This looks like an improving situation. I am now trying ghost 9, with an external Maxtor USB drive connected to a Linksys Network storage unit, NSLU2. No software needs to be installed. You simply browse to the NSLU2 and set it up. It does require a proprietary file system be used on the USB disk, but since it has to be used behind the NSLU2, I don't see that as a big problem. You can then run ghost 9, and backup your drive to the Maxtor USB drive. Stay tuned for some more details...
You will most likely need Windows tools such as ghost. I have had some trouble with Knoppix - Linux partimage copying NTFS partitions.
9. AN increasingly cost effective technique is to use RAID 1. Since PCs and disk drives are getting so cheap, the cost of a RAID 1 motherboard and an extra disk drive is slightly more expensive than a single disk drive. RAID 1 actually mirrors data from one disk onto another. So if one disk drive dies, you can "merely" replace the failing disk and the data will be copied over to it.