Image Your Hard Drive using dd

I have backed up my system to an external ximeta drive using "dd" and the well-known linux live cd distribution, Knoppix to boot from. Below are the steps in brief:

1. Boot from the live cdrom distribution.
   
2. Switch to root.
   
3. Make sure NO partitions are mounted from the source hard drive.
   
4. Mount the external HD.
   

     # mount -t vfat /dev/sda1 /mnt/sda1
     

5. Backup the drive.

     # dd if=/dev/hda conv=sync,noerror bs=64K | gzip -c  > /mnt/sda1/hda.img.gz
     

   "dd" is the command to make a bit-by-bit copy of "if=/dev/hda" as the "Input File" to "of=/mnt/sda1/hda.img.gz" as the "Output File". Everything from the partition will go into an "Output File" named "hda.img.gz". "conv=sync,noerror" tells dd that if it can't read a block due to a read error, then it should at least write something to its output of the correct length. Even if your hard disk exhibits no errors, remember that dd will read every single block, including any blocks which the OS avoids using because it has marked them as bad. "bs=64K" is the block size of 64x1024 Bytes. Using this large of block size speeds up the copying process. The output of dd is then piped through gzip to compress it.

6. To restore your system:
   

     # gunzip -c /mnt/sda1/hda.img.gz | dd of=/dev/hda conv=sync,noerror bs=64K 
     

7. Store extra information about the drive geometry necessary in order to interpret the partition table stored within the image. The most important of which is the cylinder size.

     # fdisk -l /dev/hda > /mnt/sda1/hda_fdisk.info
     

Notes:

One of the disadvantages of the dd method over software specifically designed for the job such as Ghost or partimage is that dd will store the entire partition, including blocks not currently used to store files, whereas the likes of Ghost understand the filesystem and don't store these unallocated blocks. The overhead isn't too bad as long as you compress the image and the unallocated blocks have low entropy. In general this will not be the case because the emtpy blocks contain random junk from bygone files. To rectify this, it's best to blank all unused blocks before making the image. After doing that, the unallocated blocks will contain mostly zeros and will therefore compress down to almost nothing.

Mount the partition, then create a file of zeros which fills the entire disk, then delete it again.

# dd if=/dev/zero of=/tmp/delete.me bs=8M; rm delete.me

References:

1. backup-hard-disk-partitions
   
2. linux_loopback
   
3. imagedrive