Jump to content


Disk drive image notes (also for USB thumb, flash, stick)

  • Please log in to reply
1 reply to this topic

#1 junksmi



  • Members
  • 22 posts

Posted 10 February 2009 - 07:42 AM

Hi all,

I was supposed to image my USB thumb recently, and I realized I had forgotten most of the programs that can be used for the purpose. That is why, I'd like to post some of the notes related to imaging software - and I hope the community will make the list better.

First remark we can make is:
  • To image a disk drive, means saving the drive's MBR (master boot record, which contains partitioning information also), and saving each and every partition on the drive as an image. [this may be important, since certain tools listed in here can only image partitions.]
Second remark:
  • under Windows, you get partitions (not whole disks) listed as drives C:, D:, E:, etc that become parts of the filesystem...
  • Under Linux, it is partitions that get mounted and become parts of the filesystem. Disks drives are usually listed as /dev/hda, /dev/hdb (usually for hard-disks connected via IDE), or /dev/sda, /dev/sdb etc (usually for hard-disks connected via USB - that is serial drives). If a disk is listed as say /dev/hda, then it's partitions will be listed as /dev/hda1, /dev/hda2 etc - correspondingly is a disk is listed as /dev/sdb, then it's partitions will be listed as /dev/sda1, /dev/sda2 etc

First and foremost, there is the list of imaging software list on Wikipedia:

List of disk imaging software - Wikipedia, the free encyclopedia

Comparison of disk cloning software - Wikipedia, the free encyclopedia

however, I'd imagine most of us here don't really care about Norton Ghost and such, so let us proceed with the list of free solutions. So this list contains:
- dd (+ testdisk)
- ddrescue
- partimage
- clonezilla
- ODIN for windows

1. dd - is a standard Linux tool that can image both disks and partitions; typical usage is
# to back up the hda drive, use /dev/hda:

dd if=/dev/hda of=/path/to/backup-hda.img

#&#59; to backup a partition use /dev/hda1 (or whichever partition you want) instead of /dev/hda

for backup; dd can be also used to recover/restore such an image back to a drive as well. dd can also save the MBR of a drive:
dd if=/dev/hda of=/path/to/backup-hda.mbr count=1 bs=512

dd doesn't care about how the disk may be formatted (FAT32, EXT3, NTFS..) - as it simply reads sector by sector. However, it has some drawbacks - it cannot handle potentilal bad/corrupt sectors on the drive, and it copies all sectors, even unused ones (so images size can be big). A workaround around copying all sectors is first writing zeroes to all unused parts of the drive, and then using gzip to compress the dd output (see Image Your Hard Drive using dd | LinuxWebLog.com http://www.linuxweblog.com/dd-image)

For Windows, there are native ports of dd like:

CoreUtils for Windows (dd is part of it)

chrysocome.net - dd for windows (v 0.5)

dd for windows (v 0.3)

Under Windows, dd can also be used using Cygwin - either entire Cygwin has to be installed, along with dd; or you can also download the dd .exe binary (part of Cygwin coreutils, http://ftp.uni-kl.de...ase/coreutils/) and the cygwin1.dll, and use it without Cygwin installation. However, it will still used the Linux /dev/hda etc. syntax - or so-called POSIX paths - to adress disk drives, and it may be difficult to enumerate the drives in this format under Windows without using a Cygwin command shell (alternatively try testdisk under Windows - it will enumerate all drives along with their Unix names, as Cygwin sees them). See Re: dd under CygWin http://www.cygwin.co...8/msg00885.html and

1a. TestDisk - a cross-platform tool, excellent for recovering corrupt partition data. Not an imaging program per se, but it has an option internally to image a partition - but not an entire drive. It seems that is uses dd for that purpose, and it seems no further options regarding imaging can be set through the TestDisk interface. It seems to be based on Cygwin. For more, check:

Running TestDisk - CGSecurity

It doesn't offer options to image an entire drive - but at least it offers a simple and single way to image partitions from different OS, which remain compatible.

2. dd_rescue - again a Linux tool, a more advanced version of dd. Note that there are two different programs sharing almost the same name, which may be slightly confusing (see [http://freshmeat.net...cts/addrescue/] for discussion between the authors):

ddrescue by Antonio Diaz - [http://www.gnu.org/s.../ddrescue.html], [http://ftp.uni-kl.de...ease/ddrescue/]
dd_rescue by Kurt Garloff - [http://www.garloff.d...inux/ddrescue/]

The idea with these is that they should be able to recover (or ignore and skip) also bad sectors on the drive (hence the rescue part). I am not sure whether they also ignore unused sectors. Typical usage is
# to back up the hda drive, use /dev/hda:

ddrescue -B -n /dev/hda /path/to/rescued.ima /path/to/rescued.log

#&#59; to backup a partition use /dev/hda1 (or whichever partition you want) instead of /dev/hda

For Windows, it seems that only Cygwin is an option, a Cygwin binary can be found at, for instance, http://ftp.uni-kl.de...lease/ddrescue/. Same notes as dd under Cygwin above apply.

3. partimage - again a Linux tool. It has it's own command-line GUI interface, but can also be used in a standard command-line way, with options. I believe it doesn't have a problem with imaging FAT, NTFS or Unix formats. Typical command line usage:
# partitions only - /dev/hda1

partimage -z1 -c -d -o -b  save /dev/hda1 /path/to/hda1.partimg.gz
The main page for partimage is

Main Page - Partimage

Partimage can only image partitions, so if you want to image the whole drive, you must save the MBR separately, and then using partimage, image all of the partitions separately - a Linux bash script to do exactly that is given in:

Disk Cloning and Partimage : partimage, disk, clone

It doesn't seem there is a native port of Partimage for Windows - additionally, it seems it cannot run under Cygwin either (see PartImage not compiling under cygwin: msg#00001 sysutils.partimage.user http://osdir.com/ml/.../msg00001.html). However, there is a bootable CD project called PING (Partimage Is Not Ghost)
which may help with usage of Partimage on a Windows machine.

4. Clonezilla - a Linux based tool, packaged as bootable media, and has its own command-line GUI. Can image both drives and partitions, and additionally supports cloning over a network. Main page is

Clonezilla (OpenSource clone system)

The only thing is, I find it mildly irritating having to reboot and boot into this environment every time I just want to image a USB thumb drive. It should be possible to boot the ISO image under QEMU in either Windows or Linux - however, it is extremely slow without qemu acceleration (kqemu), and plus I'm not sure how healthy it is (in the sense of the emulated system knowing or not which partitions are mounted, or being under read/write operations - and possible problems due to this during imaging).


Windows only GUI program, can be found at:

ODIN - Open Disk Imager for Windows

I doubt it can image Linux formats. Otherwise it can image both partitions and whole drives - however, it saves a MBR in a file of some 1.2 Kb - since a raw MBR should be 512 bytes, this probably means uses its own format for saving the MBR.

Personally, I use Clonezilla for big backups (i.e. master OS hard disks and such), and it works quite well. However, I'd also like to have a cross-platform option to image a USB drive directly from an OS without rebooting - possibly testdisk would be excellent, if it would have used a more practical format than dd.

Some other references:

Drive Image utilities

Using ddrescue for reading corrupted DVDs under Windows ? [Archive] - Doom9's Forum

Re: dd.exe

Free Imaging software - CloneZilla & PartImage - Tutorial

#2 was_jaclaz



  • Advanced user
  • 7100 posts
  • Location:Gone in the mist

Posted 10 February 2009 - 08:40 AM

  • under Windows, you get partitions (not whole disks) listed as drives C:, D:, E:, etc that become parts of the filesystem...

But you can access "whole" hard disks allright by connecting to the \\.\PHYSICALDRIVEn :poke: what you get a letter assigned to are LOGICALVOLUMEs, which you can also (on NTFS) mount as mountpoints, in a very similar way to what Linux does.

What you may have missed the apps listed here:

(yes, we know more that Wikipedia :poke:)
The latter thread on MSFN, though the actuall testing/comparison was never actually carried out, gives a nice list, pretty much complete.

(talking of ODIN)

I doubt it can image Linux formats. Otherwise it can image both partitions and whole drives - however, it saves a MBR in a file of some 1.2 Kb - since a raw MBR should be 512 bytes, this probably means uses its own format for saving the MBR.

Sure it can, it depends on what options you use with it. :poke:
There are basically two kinds of imaging programs:
  • "forensically sound"
  • "optimized"

A "forensical sound" imaging program accesses the RAW device and makes a byte-by-byte copy of it. It is COMPLETELY filesystem independent.
An "optimized" imaging program may want to interpret the contents of the drive in order to speed operation/better compress output/whatever, this kind needs to understand the filesystem.

ODIN AFAIK can do both, though it is still very experimental, currently at 0.2 Beta.

FYI, there is also another version of dd for windows, the FAU edition:
that while being "forensical sound" has great compressing capabilities for the output.


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users