Experiences w/ Drive Imaging Software?

Futurepower(R) asks: "Microsoft Windows 2000 and Windows XP have crippled file systems. The file system cannot copy some of the files that are necessary to the operating system. If you don't have experience with Microsoft operating systems, you may find this amazing, but it is true; Microsoft supplies no method of backing up and restoring fully operational copies of Windows 2000 and Windows XP. Microsoft's advice is to reinstall the operating system and all programs every time you want to move to a new or backup computer. For confirmation of this, see the 'Microsoft Policy Statement' in the article, The Microsoft Policy Concerning Disk Duplication of Windows XP Installations. Many industries use numerous programs; installing them all may take a week or even more. All of the disk image duplication programs I've used have problems, in my experience. What program do you use? What has been your experience with it? Can you recommend a program, or recommend staying away from one?"

"This policy of providing no way to backup and restore a fully installed system is impossible for corporations, of course. So Microsoft technical support representatives recommend sector-by-sector disk image duplication, even though it is against Microsoft policy. Copying each sector of a hard drive bypasses Microsoft's copy protection by which Microsoft punishes all users, even if they are honest.

Sometimes Microsoft technical support recommends using 'third-party' disk image programs. For example, sometimes support representatives recommend using Symantec Ghost.

All of the disk image duplication programs I've used have problems, in my experience. So, here's a question: What program do you use? What has been your experience with it? Can you recommend a program, or recommend staying away from one?

Here are my experiences:

Symantec Ghost sometimes fails with non-specific error messages. Uninstalling Ghost does not uninstall all the Ghost software. Symantec is one of the companies using copy protection, so using Symantec products may be a case of jumping from the Microsoft frying pan to the Symantec copy protection fire; also, you have no assurance that the copy protection will not become worse in the future.

PowerQuest DriveImage and DeployCenter have an uncertain future. PowerQuest was bought by Symantec. This was after PowerQuest released DriveImage 7 with problems. The sale cannot be a happy event for those who spent hundreds of dollars on DeployCenter.

I've tried Acronis True Image. I've had better luck with it than with Symantec or PowerQuest products. However, like the others, it sometime gives non-specific error messages that say something like, 'I've failed, and I'm not going to tell you how to troubleshoot the problem.'

Fred Langa, publisher of LangaList, recommends BootIt. I have no experience with it.

I haven't tried g4u, free, open source software provided under the BSD license g4u has the drawback that it writes only through FTP. There is no way to write to a network drive or a CD-R.

It's disgusting; people just want to make functional backups, but to do it they are dragged over the coals."

Has always worked for me ...

dd if=/dev/hda1 of=/dev/hdb1

If you want to encrypt after the copy you can do

dd if=/dev/random of=/dev/hdb1

Re:Has always worked for me ...

For backups partimage is much better than dd. This is because partimage only copies the used blocks, whereas dd copies every block.

Partimage can compress data by a factor of 2. I have used it to backup/restore windows boxes on many occations and works great.

from winblows box:
1. boot off knoppix 2. nfs mount an export that has enough room to hold the backups. 3. use partimage to backup patition(s) to nfs mounted frive.

There are option on partimage to break the backup into managable sizes (say 600MB chuncks) for easy CD archiving.

Re:Has always worked for me ...

dd if=/dev/zero of=zeroes

Or, if you don't want to mess with scripts and installing cygwin:

1. Download Eraser from here [tolvanen.com]. (A very nice privacy tool for Windows, BTW.)
2. Install
3. Go to erasing prefs (Ctrl+E) and click New
4. Enter description: All Zeros
5. Click Add
6. Click Save
7. Select new "All Zeros", go to Unused Disk Space tab and do the same.
8. Click Ok
9. File - New Task (Ctrl+N)
10. Set up tasks for the drive(s) you want to zero out and then run them.
11. Profit! (Sorry.. couldn't resist.)

This has the added advantage of zeroing out the slack space in most files which should improve compression a bit.

BTW.. if you want to use this for privacy, you probably *don't* want to use the All Zeros overwriting option. If you son't know why, read this interesting article [usenix.org].

Re:Has always worked for me ...

Parent was modded funny, but the reality of the situation is that ZD Mag did a study of every disk imaging utility they could get their hands on.

Their pick for best disk imaging utility on the planet was none other than GNU dd. I've used dd several times to back up a Windows installation to a different disk and restored it with no problem. The host OS doesn't even have to support the filesystem of the target filesystem since it works at a lower level.

LNX-BBC [lnx-bbc.com] is the perfect backup utility. It's self contained, aproximately 50M, and it can read/write to many types of network storage, and of course comes with GNU dd.

Experiences with Norton Ghost

As far as a new machine goes, I always recommend installing a fresh copy of 2000 or XP if you are installing to just a single machine. This way everything is nice and clean, no old drivers can crud up the system, any and all resident spyware and viruses are gone. XP even has the Files & Settings Transfer Wizard to move everything over to a new machine and it has always been a good tool in my experience.

As for multiple machines, I've always gone with Norton Ghost Enterprise [symantec.com]. Where I work, we recently got a new shipment of 120 Dell Dimension GX270 desktops, P4 2.8Ghz, 120GB disks, top of the line machines. However since we are a government agency we have certain security policies that must be in place on each machine regarding user logins, domains, file permissions and network access. Setting this up on 120 machines would be an impossible chore. So I set up a spare Dell server running Windows 2000 Advance Server with Norton Ghost Enterprise. We then took one of the new Dells, reinstalled Windows XP from scratch and began applying all security measures and end-user programs to the install. Next, a Microsoft program called System Preparation Tool [microsoft.com] was run to prepare the system for the end-user, and the machine was shut down and booted off a Norton Ghost rescue disk with drivers for the onboard ethernet. Then the machine was conencted to the Ghost server and an image of the hard disk was dumped. From there the only remaining work was to boot a dozen or so new machines at a time and point them to our Ghost server and have them image the drives, then we repackaged them and delivered them to the users. The whole process took about 2 weeks from when we got the first machine to when the last one was delivered to the user.

Norton Ghost is great for rolling out images to identical machines, but it's hit-or-miss with machines that differ on hardware. And it certainly helps to have coprorate editions of the Microsoft software to avoid activation issues.

Re:Experiences with Norton Ghost

It's your switches being set incorrectly; I had a similar situation. Get into the switch management and turn on the multicasting friendly features. If you've got simple unmanaged switches then you're out of luck.

Re:Experiences with Ed Norton Ghost

Personally, I like Ed Norton Ghost - It beats the crap out of itself and then starts fights between the other filesystems installed in the system.

dd

dd bs=8192 if=/dev/sda of=/dev/sdb

It's worked for me.

Other than that, I've used ghost.

Re:What he said

If you've got a linux box, dd's the way to go
If you don't, you can use a Linux LiveCD [knopper.net]

Re:dd

I'd suggest a related method using netcat, sometimes called Ghetto Ghost [real-time.com].

using dd to clone over the network

dd bs=8192 if=/dev/sda of=/dev/sdb

I'm not sure if this was a serious suggestion or not, but this is exactly how I do it! I use this method to clone linux cluster nodes, but it would work for windows as well.

I use a boot floppy, with the grub [gnu.org] bootloader (you could skip the floppy entirely if your hardware supports PXE booting, and you feel like messing with it). The bootloader grabs a kernel and ramdisk image from a tftp server. Then, a shell script creates a fifo, connect it to the tftp server, uses dd to copy to/from the image.

Here's an example of the shell script to make a backup (just do the reverse to restore):

tftp_server=192.168.0.253
mknod img0001 p
tftp ${tftp_server} <<-EOT &
binary
put img0001
EOT
dd if=/dev/sda1 > img0001

This method was adapted from the clone [tldp.org] HOWTO, which has more in-depth instructions.

Re:using dd to clone over the network

Be careful transferring large amounts of data without application-layer error detection. It's possible to get undetected CRC errors, as Stone and Partridge describe [nec.com]

Ssh may be a better idea than netcat.

Remember to strip the SIDs first!

You need to strip the security identifiers from NTFS before making an image... I suspect this is what the (obviously ignorant) author of the article didn't do and instead chose to write up this little FUD escapade. Microsoft has a little tool called "sysprep" that does just this.

From the article: Microsoft Windows 2000 and Windows XP have crippled file systems

Bullshit! That one statement shows that the article writer has a serious case of rectal-cranial inversion... For the uninformed, here is MS's definition of SIDs: "A security identifier (SID) is a unique value of variable length that is used to identify a security principal or security group in Microsoft(R) Windows(R) 2000 and Microsoft(R) Windows NT(R)." They are almost like *nix UIDs/GIDs, but a little bit more complex... NTFS is more complex in general. They actually contain information specific to the machine/domain/etc in the permission. To be more clear, an NT machine on a domain is treated as a leaf node in a tree... and each file in the filesystem of that leaf node can be assigned specific permissions relating to any user on any machine in that tree (domain). This allows very complex definition of file/registry/system permissions! Unix works in a similar way, but lacks those extra capabilities. What you need to do is strip the machine-specific parts of the SIDs out before you image the machine! (Here's a thought question for ya... ever tar a set of files on one unix machine, move them to another, untar and notice that the UIDs/GIDs are, as Strong Bad would say, "weirded out?")

Obviously the article writer is an amateur and knows nothing about how Windows or NTFS work... which makes me suspect he is not qualified to do his job. Assuming you can't image Windows machines based on the premise that Windows and NTFS are "fundamentally broken" is the most ludicrous thing I've ever heard. My university must have > 10,000 shiny brand new Dell computers, all running an identical version of Windows XP... and someone means to tell me they didn't image them, instead installing XP from scratch on each one? Please!

dd is great for quick-and-dirty imaging, but I'd be wary writing that image to a disk of a different size, etc... unless you hacked the partition table to make the new disk "think" it's smaller than the image, if the new disk is indeed bigger.

dd

if you boot from a linux CD, you can use dd to ghost from one XP drive to another blank harddrive. or you can even use dd and netcat together to dd over the net -- there is a google page describing how to do this

Modboot + ghost

I've used Modboot along with Ghost 2002 to perfectly copy Windows XP systems. Drive Image Pro somewhat works, but not always. Ghost has never given me issue.

Modboot [nu2.nu] is really nice in that you can make a network boot disk for pretty much any network card that was or is in production without much hassle.

Two functional methods...

Two things you can do are to customise an OS install using the "OEM" section to do the installs for you, or use a deployment system like Tivoli, Unicenter, or Vision64...

Re:must use sysprep

One important note regarding sysprep; don't sysprep a machine more than once. If you do, you'll likely not be able to boot a second time. As a result, we've always kept two images of each production load; one before sysprep and one after. That way, we can return to the non syspreped image if we need to make changes and still be able to run sysprep.

Ghost worked fine for us

Well at the place I used to work IT at we used an older version of Norton Ghost and had no problems with it. I can't check what version it was because it won't run under Windows and I don't have a machine I can reboot right now. 7.0? Something like that.

Either way, just whip the top off the box, stick in your drive with the image on and use Ghost on a boot disk. Never had a problem with Windows 95, 98 or 2k, including NTFS.

Pulling images down off the network was a bit of a chore, as it'd fail if the lag got too high . . .

dd and knoppix

I've had a lot of success using Knoppix [knoppix.net] and dd. Knoppix is a full linux distro on a CD.

I image a lot of identical laptops. With Knoppix, I can pop in a boot CD along with a pcmcia firewire card attached to a big external drive. Everything (even sound!) is detected on boot up and I can mount the external drive and dd an image to or from. I can write a 20 gig image to the laptop in just over 12 minutes. Going the other way takes a bit longer... haven't figured that one out.

I was using ghost, but its a royal pain. Limited support for external devices (no pcmcia support). Network backups involve making DOS/Windows for Workgroup (!) boot disks. Ick all around. Knoppix works much better. Network interfaces are also detected and configured via dhcp, so I could do net backups as well.

My recommendation

Chassis your Windows drive into a Mac and image/clone it via CarbonCopy Cloner [versiontracker.com], Retrospect [dantz.com], etc. 100% mirror, no problem.

use the software mirror

use the software mirror that has been included in windows since at least NT4.0.

1. put in an identical drive, and make a mirror
2. run the machine for a few hours while it syncs up.
3. reboot and take out the fully mirrored drive.

that takes a while, but it should provide a decent solution to backup all of the files on a windows machine. You can even run the system while the backup is running. You still have to reboot at least twice, and have a drive that is equal or greater in size, but it should work flawlessly if you know what you're doing.

Sorta

"Microsoft supplies no method of backing up and restoring fully operational copies of Windows 2000 and Windows XP. "

Mostly true, but not entirely. NTBackup.exe will save your system state (registry, drivers, etc) plus you can backup Program Files and Documents and Settings etc too. In theory (meaning: I've never done this) you could do one install of Windows, install your apps, then use NTBackup to save your system state and your Program Files/Docs and Sets folders. Then, you could go to the other machines, first do a vanilla install of Windows, copy the .BKF file to each machine, and use it to extract the system state and program files into the right spot.

I will say again I have never done specifically this. but I have saved a mucked up registry using this techique before. In your position, it's a method I'd explore. Expect limitations. For example, I don't know if XP'll shit itself over it's activation process. I suggest this as a direction to explore, not as a solution I'd stand behind.

Oh, one other thing, XP doesn't install NTBackup.exe by default, you have to extract it from the XP CD. Google has plenty of help here.

Did you actually READ the policy statement?

That statement says Microsoft supports imaged copies of specific versions of Windows that also use the Sysprep utility.

It also has the side effect of making sure you have all of your OS licenses. Or is that a problem? :-p

Sysprep is your friend if you have a pile of apps and want to reinstall multiple copies of them quickly. I use Symantec Ghost myself, and the image in question has Win2K, Office 2K, a bunch of 16-bit apps, Acrobat Reader, a bunch of 32-bit apps to go with said 16-bit apps, IE6, and other stuff I forget or don't want to disclose at this time, and Sysprep makes these all imageable.

In that sense it doesn't matter WHAT imaging software you use to make a mass copy of Windows, as long as you Sysprep it before the fact.

As for disaster recovery backups of a single workstation, the included NTBACKUP still is tried and true. Though I liked the NT4 version better than the Win2K version.

Everybody uses Ghost.

Maybe Symantec has copy protection bullshit, but I've never once seen Ghost carp about licenses. And I can't imagine it was because the IT dept was doing their job properly (at a former place of work).

There are a few things that you don't want to duplicate exactly when you're installing on a bunch of machines, even with identical hardware. If I understand correctly, that's the whole point of Ghost. dd doesn't always cut it if you're doing 400 installs on separate machines.

"week or even more?"

"installing them all may take a week or even more?"
Sorry. If it takes you a week to install replication software, you shouldn't be in IT.

One word. Ghost. It works. If you see limitations with the normal version, grab the enterprise edition which offers Ghost servers and network system replication, with just a floppy on the client machine.

Sounds like.... Debian net-intstall floppies!

Novell ZenWorks Imaging

Working for computer services for my university, we have recently dropped Ghost for Novell ZenWorks imaging. This is a linux based imaging software, that I think is fairly simple, if you don't mind typing. example:

For a image residing on a server that you want to bring down:
img restorep server //server/path/to/image/file

The only issue that I have ran acrossed is that sometimes it will give the wrong error. I've received the error that it couldn't find the server, but it was a hard drive issue. I think though this is an easy imaging software, and if you are up for fun, its seems that you can edit some of the config files to automatically image stuff, but I'm not for certain.

Here's a solution

Backburner [kilgallonfamily.com] will backup anything you throw at it. It's a collection of Perl scripts, thus very small. It can backup and restore partitions or raw disks, with or without compression. It can write the backup to multiple CDs. You can even send it over the network to a NFS mounted volume. Been using it for over 3 years with no problem whatsoever.

Dantz Retrospect for Windows

While this isn't drive imaging software per se, it does handle the restore a system to an operating state feature. Dantz Retrospect has an add-on [dantz.com] which they say can make a bootable disaster-recovery CD which will regenerate any client of the Retrospect backup server. AFTER the client has failed.

I've never used that feature, as my primary use of Retrospect is on Macintosh; I have a Windows client, but have not had to try to regenerate it following a total system loss. (And I don't have the add-on to do it anyway.)

But the rest of Retrospect is common across Windows and Mac. (Disaster recovery on Mac seems to be a lot easier.) The important part for this discussion, in addition to the 'disaster recovery CD' add-on, is the way it does a so-called 'snapshot' when it takes an incremental backup. This lets you get both the speed of doing incremental backups, plus the ability to restore a system to precisely the contents it had at that time. (So basically, it can handle deletes too, so it doesn't need to restore files from the full backup which were deleted when a later backup took place.)

I bought Retrospect for Macintosh after Norton 'Crash Gaurd Causes Crashes' Utilities removed their backup/restore software in a newer version. (Fortunately, the id10ts at Symantec offered a satisfaction guarantee on software. The store didn't believe it, they had to place a toll call to Symantec to find out they weren't kidding.)

I've been using Retrospect for Macintosh since System 8 came out, through OS X, and now with a Windows 98 client. It's my very favourite backup program, and what's more, the restores work.

Just need to get the upgrade to 5.1 for Mac so I don't need a separate backup system for my Linux box.

One mans ease of use is anothers security flaw

The author of the "story" is wining and bitching about how hard it is to make a functional copy of a Windows installation and how supposedly this is some kind of "license enforcement" issue when anyone with half-a-brain can read the KB article themselves that the reason it's not supported and will cause problems is that you're violating the internal security policy of your own network by having duplicate machine SID's on your network. To make it work you have to change the SID, but since MS obviously feel it's not reliable enough they're recommending it as a workaround (since, hey, if anyone could just change the SID no questions asked we'd get another Slashdot article about how Windows is fatally flawed). Had they simply put in a safety that stops the image from working completely, I'm sure the crap would have flown even further.

Not to mention that there are perfectly fine methods for doing large-scale Windows roll-outs for those who need them, which don't involve 3rd party software kluges like Ghost.

Mod Parent...How?

Hello. I'm fairly new to slashdot, and I have all of these moderator points I don't know what to do with. I would like to mod down the post I just read as -1 Troll. It was posted by Cliff [mailto] and titled "Experiences w/ Drive Imaging Software?" [slashdot.org]. Thanks for the help.

Acronis TrueImage saved my ass

About 6 months ago, I bought a new HD. I decided to split it into separate partitions, one for OS, a big one for Data. I cleaned off my old HD so that I could put images on it.

Once I got XP running and set up the way I liked it, I made an image. I installed a firewall and some other necessary programs, made another image. Added all the accessory programs I like, made an image.

Then I tried to install a major IDE. The installation hosed up at 99%. After a reboot, the machine was F'd up big time. I restored the image I had made just before starting the installation. Then I tried installing the IDE again and it worked perfectly. My machine has been running great ever since, and the IDE works just fine. Needless to say I also have an image with the IDE installed :)

TrueImage certainly saved me loads of time reinstalling my OS, configuring it, and installing all the programs I like. Not only that, but since I can cut an image of the OS while running it, making new images is a piece of cake. Booting from a disk to make an image now feels practically prehistoric. But the greatest thing about it is that its cheap, unlike certain other image software.

So I vote for Acronis.

It may not be an ideal corporate solution - I think Ghost is probably still the best for that. Its got automation, networking, pretty much everything you could want in image software. Except, perhaps, ease of use and low cost.

For personal use though, I'd argue Acronis is the way to go for MS OS.

Personal Soapbox section:
When you set up a new machine, make a separate partition for data and OS! It'll save you a lot of time because making OS images is fast and easy, and you can restore your OS without having to worry about losing data. The data partition can be backed up via more conventional means. Copy important data to CD or tape, or whatever other backup solution you want to pursue - but image your OS. I'd never set up a new machine any other way.

*sigh*.. PLEASE READ

Hi.

I work for Microsoft. i designed an automated deployment system that over 2000 computers at MS used for 24/7 automated testing. (a follow on technology by some of my co-workers has taken this approach to the next step, so only a little of my code is still running out there, but i digress)

there is nothing crippled about NTFS on XP or otherwise. Imaging works just how you expect it to. we've used Ghost (multiple version) PQDI (multiple versions, including the 16 bit dos version) and some internal-to-MS only stuff even. All of these make and restore images of XP machines perfeclty fine.

Not only is imaging a windows machine not broken, it is a supported and tested product scenario with its own feature and test teams.

enter: SYSPREP

Sysprep is the 100% microsoft supported way of bulk deploying machines and setting them up for imaging. sysprep is fully scriptable as of XP and the same sysprepped image can be restored on hardware of nearly any type. It can automaticly configure the box, set a hostname, join a domain, setup local users/groups, etc etc etc.

I know this because if it doesn't work, nobody in the world can test visual studio.

Please look at microsoft.com and read about sysprep. It's your friend.

Incidentically, before sysprep-XP, when sysprep wasn't quite the cat's meow, you could still image and restore NTFS OSes (even XP, with WPA), even across different hardware. You just had to know what things to change/tweak. (which i found out WITHOUT special MS-only knowledge)

Sysprep for XP also works great with WPA, letting you seal/reseal an image so that the WPA activation bomb goes away.

Honestly people, ask slashdot stories should be ASKING, not presuming. because the presumptions are often wrong, and the meat of the "question" is an uninformed bash as opposed to a legitmate request for help or comments...

Knoppix

Knoppix has at least 3 tools that come to mind that can easyly be used for the purpose you need and have never failed me.
And it's free and can help you do other rescue and recovery stuff as well.
In case you don't know: Knoppix is the leading Live CD Linux distribution. A perfect chance to test it as well.

Use SYSPREP then follow the procedure

In the System Admin tools for Windows there is a little utility called SYSPREP that prepares a drive image for the imaging process. The reason that most images fail is due to SID's in teh wnidows architecture. SYSPREP removes these allowing them to be recreated on the machines first boot. Programs like GHOST then have no problems at all.

We use GHOST and Microsoft's SYSPREP to roll out the images on our 300 desktops as needed.

I wish we could get sysprep... :(

I help admin a largish Win98 installation... we have no intention of going any further on the upgrade treadmill. It has been very frustrating -- there seems to be a windows 98 sysprep tool out there, but it isn't available anymore, as they want people using 2000/XP. We of course only realized how useful the tool would be _after_ they decided to stop distributing it... we do without, but it would save hours of work.

Re:Become a switcher

lol. external firewire drive?? Then you only have to worry about your data-retention issues!