disk image with knoppix

7/29/2019 Disk Image With Knoppix

1/23

Disk Imaging with Knoppix

Introduction

This document explains how to use the CD-ROM bootable version of Linux, named Knoppix, to makeand restore images of computer hard drives.

Knoppix makes a very good system recovery tool for these reasons:

It boots a graphical environment in as little as 128 MB of RAM and works with almost any PChardware. Smaller configurations down to 64 MB can use command line mode if necessary (howeverwe won't cover command line imaging).

Even if you don't have an image, it is good at recovery of damaged hard drives allowing you to copythe data to another network drive.

It is free open source software.

Knoppix has the following drawbacks:

It is somewhat intimidating to use because most operations are from the command line.

You must shut the computer down to perform an image. It is not very easy to write an image to a CD-R drive unless you do it later from the networked drive

where it was saved.

The Windows NTFS file system support is experimental, but this is not a real problem because theexperimental part is the ability to write files and not the image. Thepartimage program giveswarnings that are not really as serious as they sound.

The new Norton Ghost Version 9 imaging program offers these advantages over Knoppix:

Images can be made while the computer is running Windows.

There are more options for making images and the interface is easier to use.

However, Norton Ghost has the following disadvantages:

Recovery requires a computer with at least 256 MB of RAM and supported hardware.

The .NET environment, used by the runtime Ghost program, requires at least 512 MB of RAM to runsmoothly.

If the computer won't run Windows, an image can't be made and files can't be recovered.

While open files can be imaged, their copy on the image may contain corrupt data. It is necessary toshut down database servers and other applications with open files when making the image to avoidcorruption of data. This is also a problem when using other backup software that supports open filebackups and is a limitation of Windows.

01/20/05 Copyright 2005, Ventek, Inc. Page 1 of 23


2/23


Creating an Image with Knoppix

Boot the Knoppix CD-ROMon your computer. You mayneed to adjust the boot

priority in the BIOS so theCD is booted before thehard drive. Just pressENTER to start Knoppix oruseF2 orF3 for moreoptions if you need to dosomething special.

Knoppix will boot the KDEGUI if you have at least 128MB of RAM. Get rid of thewelcome web page and startthe Terminal Program bypressing the icon at thebottom of the screen. Do notdouble click items like youdo in Windows or you willget two copies. Linuxnormally uses only a singleclick to open items.



3/23


You can use the ifconfigcommand to see if thenetwork is up and running.You should see yourassigned network address on

the eth0 interface. If youdon't see the eth0 interfaceyou may need to manuallyconfigure an address.

If you need to manuallyconfigure the network, justclick the Knoppix bird asshown below to start aconfiguration wizard.



4/23


If you only need to copysome files off of a damagedhard drive, you can rightclick it and perform a mountcommand. This will make it

available for use. If you aregoing to make an image ofthe drive skip this step. Thedrive must be in the un-mounted state to make animage.

Once the disk is mounted,the icon will show a smalltriangle in the lower rightcorner. You can share it onthe network by starting theSamba Server as shownhere. Just remember the user

and password you setup. Goto a windows machine andyou should be able toconnect to the shared driveand copy files off of it. Skipthis step if you are makingan image.



5/23


If we are making an image,we need somewhere to storeit. We could use a USB harddrive to store the image, butnormally we will use a

network drive. To connectto a network drive we willuseLinNeighborhood. Youcan start it by using the mainmenu selection as shownhere.

Press thePrefs button andset yourWorkgroup (myworkgroup is VT_VISION),then press Save and Close.



6/23


Right click the Knoppixitem and select rescangroups.

This should open yourgroup. Right click it andagain select rescan group.



7/23


This should show thecomputers in yourworkgroup. If you haveproblems getting this far,you can press theLogbutton

to show the actualcommands being issued andany errors they return.

Right click the computeryou want to store the imagefile on and selectscan asuser.

You will need to enter yourWindows user name andpassword or you will not beable to access the shares.



8/23


This will open the shares onthe computer. You can nowselect the share to use andpress theMountbutton.

This opens the mount dialogwhere you can setup thesettings for mounting thedrive. We normally want tochange theMount Pointsetting. LinNeighborhoodnormally creates a long

mount point string that ishard to enter into thecommands we will be usinglater. Replace the part after

/home/knoppix/mnt/

with something easy toremember. In our case weused

/home/knoppix/mnt/itest/



9/23


The drive is now mounted.We can click thePersonalFiles button to open a fileexplorer to see if thenetwork drive is working.

This puts you in your homeuserknoppix folder.



10/23


Open the mntfolder and youcan see your network drive.

If we mounted our harddrive as shown before, wecould now copy files to thenetwork drive. You need toopen up the hard drive inanother file explorerwindow or press theRoot

Folderbutton on the lowerleft to get at the files. Yournetwork drive is now in thehome folder. The Linux filestructure can be a littleconfusing at first, butshouldn't be too hard tofigure out. Just forget aboutthe DOS drives used inWindows.



11/23


To perform a disk image, wewill use the consolewindow. Press the Terminalbutton below to get into aconsole. Use thesu

command to obtain rootprivileges. We can usefdiskto check our partitionssimilar to using it underDOS. However, be carefulas the commands areslightly different. It is bestto image the drive before wetry to mess it up.

We will use the commandline version of partimagebecause it is easy to type thesetup parameters on thecommand line. Theparameters are explainedbelow.

partimage Starts thepartimage program.

-z1 Specifies gzip compression of the image.

-d Avoids having to enter a description.

save Specifies to save an image.



12/23


/dev/hda1 The partition to save. The following should help explain the Linux disk names:

/dev/hda1 First primary partition, primary disk, first controller.

/dev/hda5 First extended partition, primary disk, first controller.

/dev/hdb5 First extended partition, secondary disk, first controller.

/dev/hdc1 First primary partition, primary disk, second controller.

All your disk partitions will usually be listed on the desktop if you areconfused by the Linux names.

/home/knoppix/mnt/itest/hda1.img

The path and file name of the image file to save the image in. Theextension is not needed, but helps explain what the file is.

Thepartimage programshows you the first setupscreen. We have selected

Gzip with the -z1 parameter.It will normally split thefiles at 2 GB because this isthe normal limit for olderLinux versions and DOSsystems. PressF5 to go tothe next setup screen.



13/23


The program warns you ifyou are saving a NTFSpartition used by WindowsNT, 2000 and XP. Linuxfully supports NTFS for

read operations so thismessage is nothing to worryabout.

It will next tell you aboutthe structure of the disk.



14/23


As the program works, itkeeps statistics on theoperation to let you knowhow soon it will finish.

When everything is doneyou will get this message.



15/23


If you need furtherinformation onpartimage,look at the manual page.Type: man partimage

Use page up/down to readthe manual and press the qkey to exit.

We can also optionally savethe MBR (Master BootRecord) of the disk driveusing the ddcommand. Bevery careful with thiscommand because it canquickly erase a hard drive.The parameters are

explained below:

dd Starts the ddprogram.

bs=512 Sets the sector block size.

count=63 Sets the number of sectors to copy.

if=/dev/hda Copies from the first hard drive.

of=/home/knoppix/mnt/itest/mbr.img

Sets the output file for the MBR image.



16/23


We can also use the fdiskcommand to list thepartition setup for the drive.We normally don't need todo this becausepartimage

can restore the MBR.



17/23


Restore the Image with Knoppix

To restore the image, put ina new hard drive of the samesize or larger than the one

that failed and bootKnoppix. Mount yournetwork drive and open aterminal and entersu tobecome the root user. Wenow use partimage to restorethe MBR. This is necessaryto allow us to restore thepartitions and be able toboot them. If the disk islarger than the one you

replaced, you will have extraspace at the end of it. Whenyou are back up andrunning, use Windows toturn that extra space intoanother drive to reclaim thespace.

The parameters areexplained below:

partimage Starts thepartimage program.

restmbr Restores the MBR and partition table./home/knoppix/mnt/itest/hda1.img.000

The name of the primary partition image file. We need to add .000because the first file will have this added to it.



18/23


The program will start withthis setup screen. PressF5to restore the MBR.

Make sure you don't haveother data partitions on thehard drive before youcontinue with this.



19/23


If the hard drive is largerthan the original, you willget this warning.

If everything goes well, youwill get this message. Youmay need to reboot Knoppixbefore you can restore thepartition image in the nextstep.



20/23


To restore the partitionhda1, make sure you arerunning as root (typesu) andthen startpartimage withthese parameters:

partimage Start thepartimage program.

restore Restores the specified partition.

/dev/hda1 The partition to restore to.

/home/knoppix/mnt/itest/hda1.img.000

The path and file name of the image file. We need to add .000 becausethe first split file is given this name.

PressF5 to select the

standard options.



21/23


You will again get thiswarning if the partition is oftype NTFS. Don't worryabout it.

A status dialog will showthe statistics for thepartition.



22/23


Your last chance to abort.

The program providesprogress on how it is doing.



23/23


Copy Your Disk to USB Flash Drive with Knoppix

Here is a simple guide for using a USB Flash Drive to copy data from a damaged hard drive:

1. Make sure the USB Flash Drive is formatted as FAT or FAT32. Knoppix will not write correctly toNTFS partitions.

2. Insert the USB Flash Drive into the problem computer.

3. Boot the problem computer with the Knoppix CD-ROM.

4. Your desktop should show at least two disk drives: hda1 is your Windows disk,sda1 is the USBFlash Drive. Adjust the following commands if they are different. If you can't find the USB FlashDrive it is possible that your version of Knoppix doesn't support it.

5. Right-clickhda1 and select theMountcommand.

6. Right-clicksda1 and select theMountcommand.

7. Right-clicksda1 and select theActions->Change read/write mode command. Knoppix always

mounts drives in the read-only mode so we must enable write mode to write the USB Flash Drive.8. You can now left-click both drives and copy files from hda1 tosda1.

9. Logoff Knoppix and you now have the files on your USB Flash Drive.

10.You can also use thesda1 device to make disk images with thepartimage program. Write your imagefile to the /mnt/sda1/ path.

disk image with knoppix

Documents