ntfsclone

You can efficiently back up a Windows virtual domain (or, just a Windows server) from unix using the ntfsclone command. This only copies the used parts of an NTFS file system but, it only works on file systems (not block devices), so you have to go through some additional steps if you want the entire disk backed up. The following is an example of backing up everything you need for recovery.

It assumes we are shutting down a Windows 10 workstation, using Xen. The Windows 10 machine is named 'win_test', and uses one LVM2 Logical volume, /dev/vg0/win_test.disk. We will be putting the output on a USB drive mounted on /mnt.

# shut down win_test
xl shutdown win_test
# wait until it actually goes away (press q to exit xl top)
xl top
# ok, it is gone, now create snapshots
lvcreate -s -L 10G -n snap.win_test.disk /dev/vg0/win_test.disk
# we have our snapshot, so we can start win_test back up
xl create /etc/xen/win_test.hvm
# create a directory for all our stuff
mkdir -p /mnt/win_test
# get disk size
lvs | grep win_test.disk > /mnt/win_test/lvs.disks
# get partitioning
sfdisk -d /dev/vg0/snap.win_test.disk > /mnt/win_test/win_test.disk.sfdisk
# get MBR and bootloader
dd if=/dev/vg0/snap.win_test.disk of=/mnt/win_test/win_test.disk.mbr+bootloader bs=512 count=63
# get domain configuration
cp -av /etc/xen/win_test.hvm /mnt/win_test/
# break apart the image. kpartx will create a separate entry in /dev/mapper for each
# partition on the image. The '-v' parameter ensures it tells us what the name is
# so we can use it below
kpartx -av /dev/vg0/snap.win_test.disk
# do this for each partition defined by kpartx. Replace the pound sign with the partition name
ntfsclone --save-image --output - /dev/mapper/name_for_each_from_above | pbzip2 -c > /mnt/win_test/win_test_disk#.img.bz2
# redo the ntfsclone for each partition, changing the name on input
# and partition number on the output file.
#
# we're done, so clean up
# remove the kpartx entries in /dev/mapper
kpartx -dv /dev/vg0/snap.win_test.disk
lvremove -f /dev/vg0/snap.win_test.disk

Some points on the process

• If you don't know how much space is going to be used, ntfsresize will give it to you if you just use the –info flag. The number will be off by about 2%, but it helps.

  ntfsresize --info /dev/mapper/name_of_partition

• You do not have to use pbzip2. I like it because it uses all processors, and the syntax is easier than xz (which may give you better compression), it uses all processors (unlike bzip2) and gives better compression than gzip.
• kpartx is really, really useful. Instead of manually doing offsets into an image, kpartx will simply create multiple entries in /dev/mapper. However, it is likely Linux specific; I haven't tried to do this on a FreeBSD system yet.
• If you're running Linux, it is very possible to script this. kpartx has a specific name it uses for its mappings, and xl or virsh can give you the full paths to the block devices.

* https://edoceo.com/dev/ntfsclone-transfer-windows