Section 11.1. How It Works

11.1. How It Works

Most system administrators are familiar with the typical bare-metal recovery answer: install a minimal operating system and recover on top of it. However, this procedure presents several problems. It takes too long, you could run into open-file conflicts, and it is difficult to document and recover operating system customizations.

Like the other bare-metal recovery procedures in this book, this procedure does not require a reinstallation of the operating system in order to recover it. It breaks down into six major steps:

1. Back up the important metadata.

2. Back up the operating system with a native utility.

3. Boot from alternate media.

4. Prepare the new root drive.

5. Restore the boot block to the new root disk.

6. Restore the operating system information.

We'll start with some background and then describe the general aspects of each step. Ultimately, we will provide a detailed procedure for each method described. Before you can choose a backup and recovery method, though, you have some decisions to make, as outlined in the next section.

Booting from Alternative Media

In order to easily recover your operating system, you need a limited root shell (also known as a mini-root) where you can run fdisk, mkfs, gzip, pax/tar/cpio, dd, ntsfclone, and so on. You also need support for whatever backup media you have chosen. This functionality is provided via rescue floppies or a bootable Linux distribution on CD, also known as a LiveCD. Rescue floppies, such as TomsRtBt, contain a minimal version of Linux and usually contain the recovery utilities listed previously. They also have several drivers for popular backup media, such as parallel-port ZIP drives, SCSI tape drives, NFS, and SMB/CIFS. LiveCDs are more complete versions of Linux and come in a variety of flavors. They typically have support for more drivers and utilities than the rescue floppies. This expanded support and flexibility combined with the now ubiquitous nature of CD-Rs is what caused us to select a LiveCD for our examples.

A list of Intel rescue floppies may be found at http://metalab.unc.edu/pub/Linux/system/recovery/index.html. A list of LiveCDs may be found at http://www.frozentech.com/content/livecd.php. The Linux LiveCD that we chose to use is Knoppix (http://www.knoppix.org).

11.1.1. If Then GOTO

This chapter spends the next several pages explaining a lot of the theory and manual steps behind a bare-metal recovery of an Intel system. Just like a lot of manuals, the good stuff is at the end. If you want to jump right to the method that applies to you, this section should give you just enough detail to know which section to jump to.

If you're running Windows and have never typed anything at a Linux prompt, you should probably proceed to the section "Automate Bare-Metal Recovery with G4L." It describes a menu-driven method of bare-metal recovery. (If you want a menu-driven method, this is the only one we discuss.)

If any of the following apply to you, you must use either G4L or the alt-boot full image method:

• If you're running the Linux Volume Manager (LVM) or other software RAID system

• If you're using an IA64 system

• If your partition tables contain references to an extended partition table

If any of the previous conditions apply to you, the following conditions do not apply to you:

• For a manual method, see the section "Alt-Boot Full Image Method"; for an automated method, check out the "Automate Bare-Metal Recovery with G4L" section.

• If you're running Linux and want to try to create live bare-metal backups, you should jump right to the section "Live Method" later in this chapter.

• If you're using a dual-boot Linux/Windows system, and you don't mind a little downtime to get a bare-metal backup, you should probably check out the alt-boot filesystem or alt-boot partition image method. These methods can also be automated using the tool discussed in the section "Automate Bare-Metal Recovery with G4L," later in this chapter.

11.1.2. Choosing Backup Methods

Our goal was to perform a bare-metal backup of an Intel system without using commercial tools. To use the procedures we developed, you have to make three decisions:

• Will you back up while the system is running (live) or while it is booted from an alternate boot disk?

• If using an alternate boot disk, will you back up at the block/image level or the filesystem level?

• If backing up at the image level, will you back up the entire drive as one image or as separate partitions?

Partition Your OS Drive

Many people have one large partition for their operating system, applications, and data. Partitioning your hard drive in this manner limits your bare-metal recovery options. A better idea would be to partition your hard drive with one partition just big enough to hold your operating system and its applications and a second partition to hold all your data. Having partitions like this also allows you to back up the data drive using standard filesystem backup techniques (such as Amanda, BackupPC, Bacula, rsnapshot, and rdiff-backup), and use bare-metal recovery procedures only for the operating system partition.

If this idea interests you, you can use tools such as Partition Magic in Windows or QTParted for Linux to repartition your drive with multiple partitions. (If you haven't seen QTParted, it's great; it works almost exactly like Partition Magic, but it's Linux-based and free!)

11.1.2.1. Live or alternate boot?

The first choice to make is whether you will back up your system while it's running (live) or back it up while it's booted from alternate media. Backing it up live involves using filesystem-level backup commands to back up the files on your running system.

If you're running Windows, this choice is already made for you. You need to use the alternate boot method because, as of this writing, there is no backup format that can be written in Windows and read in Linux that also supports ACLs. There are rays of hope, though. We can now easily mount and create NTFS filesystems in Linux, the mtftar command can read NTBACKUP tapes, and the community developing the pax utility says that pax is starting to support ACLs.

The biggest advantage to backing up your system live is that it does not require downtime for the backup. Depending on your operating system, though, there may be issues with open files or system configuration databases. If it's important that you back up your system live, just make sure you test the procedure well to make sure that you've dealt with all the issues specific to your operating system and platform.

If you cannot take your system down for an occasional bare-metal backup, and you can't make the live backup method work for you, read the section "Commercial Solutions" at the end of this chapter.

If you cannot take your system down for an occasional bare-metal backup, the other option is to back up your system while it is booted from an alternate boot disk, such as a LiveCD Linux distribution, during backup. (A LiveCD is a Linux distribution designed to give you a fully functional Linux operating system by simply booting from a CD.) The alt-boot method, as this is called, also offers a number of advantages, such as not having to worry about filesystem formats. It does this by backing up at the block (or image) level, which is not possible when backing up live. It's only disadvantage is that it requires your system to be unavailable during the entire backup. This shouldn't be a problem for home users and some small businesses, but others may find this limitation unacceptable.

We use the terms live and alt-boot as shorthand for these two backup options.

11.1.2.2. Image level or filesystem level?

If you're using the alt-boot method, you can access your data as filesystems or raw disk devices. If you back up the data using the raw disk device (for example, /dev/hda or /dev/hda1), we say that you're backing up at the image level. The other option is to back up the data as filesystems by mounting them and using a tool such as tar. (You cannot perform a filesystem backup and restore of NTFS partitions.)

We'll use the terms image or filesystem as shorthand for these two backup options.

Backing up at the image level gives you the advantage of not having to care about the operating system that's using the drive. As long as you back up all the bytes that are on the hard drive and restore them back to the same partition, everything will work fine. This is how we can easily back up a Windows system using Linux.

The biggest disadvantage of image-level backups is that they back up every byte on the drive whether it's being used or not. If you've got a 10 GB partition, you're going to get a 10 GB backup, even if there's only 1 GB of files on that partition. (Compression should help get rid of those empty blocks but will probably lengthen the backup time.) Another disadvantage of image-level backups is that they are all-or-nothing. You cannot restore individual files from an image-level backup.

11.1.2.3. Complete disk or separate partitions?

If you're using the alt-boot method and have decided to back up at the image level, you have another decision to make. Will you back up the operating system drive as one large image (/dev/hda) or as separate partitions (/dev/hda1, /dev/hda2, and so on)? In order to back up at the partition level, you need to have multiple partitions on your hard drive. Read the sidebar "Partition Your OS Drive" later in this chapter.

We'll use the terms full or partition as shorthand terms for these two backup options.

Backing up the entire OS drive as one large partition has one major advantage: recovery is incredibly simple. You don't have to worry about repartitioning the hard drive for recovery, and you don't have to worry about the boot block (the master boot record, or MBR). Just back up the entire drive as one large image, and you're done.

The disadvantage of this method is the size of today's hard drives. If you back up the entire hard drive as one image, you may need to create a single image that's hundreds of gigabytesor even a terabyte. Wow! Besides the space required to store such an image, backing up hundreds of gigabytes with one backup command could take an extremely long timeand your system is down the entire time.

The other method would be to create multiple partitions and back up each partition separately. This allows you to use the bare-metal procedure only for the partitions that contain the operating system, and use filesystem backup techniques (such as Amanda, BackupPC, Bacula, rsnapshot, and rdiff-backup) for the rest of the system. It also allows you to run backups of all partitions simultaneously, speeding up the whole process.

There are disadvantages to the partition method when compared to the full disk method, all of which are about complexity. You'll need to understand more about how your drive is partitioned, and you'll need to worry about backing up and recovering the partition table and MBR. When you partition your hard drive for recovery, you have to create partitions of the right size to recover to. If you make them too small, the recovery won't work; if you make them too large, you'll be wasting disk.

11.1.2.4. Four backup options

The three decisions just described translate into four backup methods. Using the shorthand terms described earlier, those methods are alt-boot full image, alt-boot partition image, alt-boot filesystem, and live.

Alt-boot full image

This method consists of booting to a LiveCD and creating an image of the entire OS disk. This is the simplest of all the tasks and the one that works for the most people, but it requires enough downtime to back up the entire OS driveand enough space to hold that backup.

Alt-boot partition image

This is similar to the alt-boot full image method, but you make an image of just the partitions you need to back up. This method can save a lot of time and space if your hard drive is properly partitioned, but it requires downtime and a more extensive knowledge of your hard drive contents.

Alt-boot filesystem

This method consists of booting to a LiveCD such as Knoppix and then using filesystem-aware utilities to back up the hard drives. tar and cpio are available in Knoppix. This can save you a lot of space if your filesystems aren't very full, but it's the most complicated of all the tasks and still requires downtime.

If you're going to use the alt-boot filesystem or live backup method, you need to use utilities that are available in the LiveCD that you're using. We've chosen Knoppix because of its popularity and great device support. Knoppix also gives you a wide variety of utilities: tar, cpio, dd, and ntfsclone are all available. (ntfsclone, also available in Knoppix, is really an image utility, but it is NTFS filesystem-aware, so it enables you to back up only the part of the image that contains files.)

Live

If you're running Linux and are not running LVM, software RAID, or using an IA64, you can back up the operating system while it is being used, then use alternate boot media just for the restore. You can use whichever filesystem level backup utility you wish. Remember that this method does not easily support dual-boot systems because they don't have a common filesystem. It also won't support Windows-only users because the commands that they use to back up their system won't be available from the media used for restore. However, if you can't take your system down for an occasional OS-level backup, this may be your preferred method. (With a dual-boot system, you can back up your Windows partitions while you're booted into Linux, of course.)

All the examples in this chapter use the directory /backups as the backup target. This can be an NFS- or CIFS-mount or a local removable hard drive. The drive must be writable as root, so add the option -o rw,root to any NFS shares.