Section 11.2. The Steps in Theory

11.2. The Steps in Theory

Later in this chapter, you'll find specific procedures for each of the four methods we've described. This next section takes a closer look at the six general steps involved in our bare-metal backup and recovery process.

11.2.1. Step 1: Back Up Important Metadata

The first data that you need to save is the metadata. Metadata is the data about that data, that is, the information about how the system is physically configured. In this case, it's how the operating system disk is partitioned. This information is not typically included in a normal backup. Making a copy of the MBR and partition table is a way to maintain this information in a format that can be used to recreate the root disk partition.

The MBR and partition table are contained in the first 512 bytes of your hard drive. An MBR has three parts: the boot block is stored in the first 446 bytes, the paritition table is stored in the next 64 bytes, and the boot code signature takes up the remaining 2 bytes.

11.2.1.1. Linux, FreeBSD, and Solaris x86

If you're running Linux, FreeBSD, Solaris x86, or any other Unix-like operating system, you can easily back up your important metadata live.

If you are using Linux LVM, software RAID, extended partitions, or IA64 systems, you need to use the alt-boot full image method, which allows you to skip this step.

To save the disk partition information, run these commands:

# fdisk -l >/backups/fdisk.txt # cp /etc/fstab /backups/fstab.txt

To back up the MBR and partition table, run the following command. It creates a backup to a file called /backups/mbr.

# dd if=/dev/hda of=/backups/mbr bs=512 count=1

This can be used later to restore the MBR and the partition table.

11.2.1.2. Windows

Unfortunately, there are no Windows equivalents to the commands just shown. You have two choices. If you use the alt-boot full image method, you can skip this step. If you want to use the alt-boot partition image method, save this information before backing up your partitions.

After booting into Knoppix, you are automatically logged in as user knoppix. This example assumes you are booting into a DHCP environment and have an NFS server called nfsserver with a share called /data08/curtis. Obviously, you need to substitute the appropriate values for your environment. In addition, if you're using a USB drive for this procedure, you need to mount it instead of the NFS drive. Run these commands to proceed:

$ su - # mkdir /backups

While Knoppix is booted from read-only media, it's an entire OS running from RAM, so you can indeed make directories or even install software into this RAM environment. Of course, everything goes away when you reboot.

Now run one of the following two commands depending on whether you are running NFS or SAMBA:

# mount nfsserver:/data08/curtis /backups # mount -t smbfs -o username=administrator,password=PASSWORD //servername/share /backups

Finally, save the partition information:

# fdisk -l >/backups/fdisk.txt # dd if=/dev/hda of=/backups/mbr bs=512 count=1

This procedure assumes you are not using Windows dynamic disks for your operating system drive.

11.2.2. Step 2: Back Up the OS with a Native Utility

If you are going to restore the operating system without reinstalling it, you need to use a utility that is always available.

11.2.2.1. Linux, FreeBSD, Solaris X86

If you're using the live method, you'll want to use tar or cpio. tar is easily the most popular choice here because it's more portable than cpio. If you're going to use the alt-boot filesystem method, you need to understand the filesystem types, mount the filesystems, then use tar or cpio to back them up. If you're going to use the alt-boot full image or alt-boot partition image methods, you need to use dd.

11.2.2.2. Windows

If you're going to back up a Windows system using the alt-boot full image or alt-boot partition image methods, you'll need to use dd. We'll cover the syntax that you'll need to know. If you're going to use the alt-boot filesystem method, you'll need to use the ntfsclone utility that's available on the Knoppix CD. ntfsclone efficiently clones (or copies) an NTFS filesystem to a file, copying only the used data. (Unused blocks are represented by zeros in a sparse file, so they don't take up space.)

You can't back up a Windows system using the live method. While you can easily download a Windows version of tar, and tar is available on the Knoppix CD, tar does not preserve Windows ACLs.

11.2.3. Step 3: Boot the System from Alternate Media

In order to easily recover your operating system, you need a limited root shell, which you get when you boot into Knoppix.

Once you boot into Knoppix, you can perform the rest of this procedure from a fully functional root shell.

11.2.4. Step 4: Restore the Boot Block Information

The boot block is a special part of the disk that loads the operating system by its "bootstraps," hence the name. It contains just enough executable code to locate and load the kernel. On the Intel platform, this boot block is referred to as the master boot record, and you can restore it with dd, using the backup we created in the previous step.

If you are using the alt-boot full image method, you can skip this step because the MBR is included in your image.

If you previously backed up the MBR and partition table using dd, as explained earlier, you can now use dd to restore the MBR and partition table by running the following command. Since the file /backups/mbr contains the MBR, partition table, and MBR signature, restoring this file to the hard drive partitions it just like the one you backed up and makes it bootable. Once this is done, you're ready to restore the operating system.

# dd if=/backups/mbr of=/dev/hda bs=512 count=1

In order to get Knoppix to recognize without a reboot that we had recovered the MBR, we found it necessary to actually run fdisk /dev/hda and then choose w to write the partition to disk. A reboot works as well but takes longer.

Restoring to Larger Hard Drives

The following procedure can be used to restore a smaller hard drive to a larger hard drive; you simply end up with a large unused section at the end of the drive. You can then extend or reorganize your partitions to use the extra space inside the Knoppix environment. QTParted is available in Knoppix, and it works a lot like the well-known Partition Magic, automatically expanding and contracting partitions and filesystems as needed. At writing, QTParted does not support NTFS, so you need to expand any NTFS partitions manually. (You still need to do it inside Knoppix because you cannot expand a drive in Windows if it contains the swap file.) It's relatively simple, though.

This procedure works only if the partition you need to expand is the last (or only) partition on the hard drive. If there are any partitions after it, you will need to use a commercial solution such as Partition Magic (that is, until QTParted fully supports NTFS).

Use fdisk on the Knoppix CD to access the partition table on the new hard drive. Display the current partition table using the P key. Take note of the starting and ending cylinders of the partition you plan to extend, whether or not it is bootable, and the partition type. Also take note of the total number of cylinders in this hard drive and whether there are any partitions after the one you want to expand. If the partition you want to expand is not the last partition on the drive, you cannot use this procedure.

Delete the partition you plan to expand using the D key.

Use the N key to create a new partition starting with the same starting cylinder as the original cylinder and ending with the last cylinder on the drive, which you noted in Step 1.

If the partition in question was bootable, you'll need to make it bootable again. Do this by pressing the A key and entering the number of the partition in question.

You also need to set the partition type using the T key followed by the L key to list the partition types, and locate the hex code for the partition type you saw in Step 1. Specify the partition type using its hex code.

If you're sure you did all those steps correctly, write the partition table using the W key and exit fdisk. (If you're not sure, you can quit fdisk at this point without doing any damage.)

Run the ntfsresize command against the partition (for example, ntfsresize/dev/hda1). If you confirm you want it to do so, it will automatically grow the NTFS partition to the end of the drive. You're done!

11.2.5. Step 5: Partition and Format the New Root Drive

The steps in the previous section restore both the MBR and the partition table, so there's no need to repartition the drive. All the partitions will already be created for you.

If you're using the live or alt-boot filesystem methods, you can also restore from a smaller drive to a larger drive. Additionally, you can rearrange partitions as you see fit.

11.2.5.1. Linux, FreeBSD, and Solaris X86

If you're using either the live or alt-boot filesystem methods, you now need to create filesystems on the drive using the mkfs command. You need the backed up fstab file to know which filesystem types each partition is supposed to have.

If you're using the alt-boot full image or alt-boot partition image methods, you don't need to worry about formatting the drive; it happens automatically when you restore from the image.

11.2.5.2. Windows

If you're using the alt-boot full image or alt-boot partition image methods, you don't need to worry about formatting the drive; it happens automatically when you restore from the image. If you're using the alt-boot filesystem method, the drive is automatically formatted when you restore using ntfsclone.

11.2.6. Step 6: Restore the OS to the New Root Drive

First, you must have access to the backed-up data. Our examples use an NFS directory. You may have to do one of the following:

• Mount a ZIP or Jaz drive as a filesystem.

• Install a second hard drive of equal or greater size.

• Load network and NFS drivers, configure your network interface, and mount an NFS filesystem.

• Load network and SMB/CIFS drivers, configure your network interface, and mount an SMB/CIFS filesystem.

Our example backups were sent to an NFS filesystem. The drivers and tools that were needed to do this are all available on Knoppix.