Actions

Full Raw Disk Backup

From Whonix



Backupraw123123.jpg

Introduction[edit]

TODO: what is a full raw disk backup

It is not possible to backup an operating system installed on an internal disk such as for example Qubes OS while that operating system is running from that operating system.

The advantage of a full raw disk backup is that it should be bootable either by:

  • disconnecting the internal disk and booting from the external backup disk, OR
  • changing the disk ids (undocumented) (of either the internal disk or external disk after the backup), OR
  • using a different computer with compatible hardware to boot from the external disk.

Unfortunately without either above method any attempt to boot the external drive after the backup might likely lead to actually boot the internal drive because these share the same disk ids after the raw disk backup.

Prerequisite Knowledge[edit]

  • How to install an operating system (Debian) on a external USB drive.

Prerequisites[edit]

  • An installed operating system (such as for example Qubes OS) on an (internal) disk.
  • An operating system installed on an external disk, most likely USB such as for example Debian.
  • A separate external backup disk where the backup should be stored.

Information Gathering[edit]

Qubes Users Recommendations[edit]

For educational purposes, it is useful to run gparted from the Qubes installation which should backed up as full raw disk backup.

Tested in Qubes R4.0 only. In later Qubes versions with untrusted storage domain, these instructions might need changes.

gparted is a disk partitioning tool which will be used as an easy way to find out how many hard drives the system has and what size they have.

In dom0, install gparted.

sudo qubes-dom0-update gparted

In dom0, run gparted.

sudo --set-home gparted

Make notes. For example.

Note: Modify these notes according to what can be seen in gparted.

/dev/sda (476.91 GiB)

Check the button below the X (which would close the window) if there are multiple disks.

Obviously easiest if there is only 1 disk. Assuming there is only 1 disk.

Disconnect any unneeded storage devices.

Recommendations[edit]

1. Exercise with completely different test hardware.

It is recommended against to apply this procedure with production hardware if doing this procedure for the first time.

Since data loss is possible if making a mistake during the raw disk backup procedure, it is recommended to exercise the procedure with completely different hardware. Such as a second computer as well as an external boot drive and backup disk that does not contain any important data.

2. Creating a backup date note file.

After booting from the internal disk (which should be backed up).

Create a text file with a small explanation for yourself "Today is day x with date y and time z prior backup number 1."

This will later be handy when doing a restoration test.

3. USB boot operating system should have a graphical diff viewer such as meld installed.

After booting the operating system from USB.

Install meld lxqt-sudo gparted.

1. Update the package lists.

sudo apt-get update

2. Upgrade the system.

sudo apt-get dist-upgrade

3. Install the meld lxqt-sudo gparted package.

Using apt-get command line parameter --no-install-recommends is in most cases optional.

sudo apt-get install --no-install-recommends meld lxqt-sudo gparted

The procedure of installing meld lxqt-sudo gparted is complete.

Backup High Level Overview[edit]

1. Boot from external USB drive.

2. Find out the device paths of the internal drive and the USB boot drive.

3. Find out the device path of the USB backup drive.

4. Use dd to read from the internal drive and to write to the USB backup drive.

5. Restoration test. (Optional but highly recommended.)

Backup Instructions[edit]

In Linux, unfortunately device names and device paths are non-deterministic, unpredictable, might change with kernel versions and operating system upgrades.

A raw backup with the dd can lead to data loss if used incorrectly as dd is a very powerful tool.

For example, sda is a device name and /dev/sda is a device path. Other device path examples are dev/sdb, dev/sdc.

The actual dd command is not very difficult but the device paths need to be carefully determined before starting the backup, otherwise data loss is at risk.

1. Boot from external USB disk.

2. Do not attach any other disks at this time.

If any other disks are already attached, remove them for now for simplicity.

3. Write output of fdisk to file "old".

sudo fdisk -l > old

4. Check with gparted.

See what disks are currently attached with an alternative tool such as gparted as well.

Try:

  • Start gparted from start menu if it can be found there.
  • Try with pkexec if that works:
    /usr/sbin/gparted

  • Or try with lxsudo if that works:
    lxsudo /usr/sbin/gparted

4. Attach another disk, the external USB disk which should be used for the backup.

5. Write output of disk to file "new".

sudo fdisk -l > new

6. Compare file "old" with file "new" using "diff".

diff old new

7. Compare file "old" with file "new" using "diff".

meld old new

8. View contents of file /etc/fstab.

cat /etc/fstab

Example printout.

# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/debian--vg-root /               ext4    errors=remount-ro 0       1

# /boot was on /dev/sdb1 during installation
UUID=86983f37-38db-401f-889a-bc93d83a3be4 /boot           ext2    defaults        0       2

#/dev/mapper/debian--vg-swap_1 none            swap    sw              0       0

Watch out for the UUID= field. In above example it is 86983f37-38db-401f-889a-bc93d83a3be4.

8. View output of the blkid.

For informational purposes only.

sudo blkid

9. Confirm the device path of the boot device.

Compare output of file /etc/fstab with blkid command.

For example. Note: replace UUID with the actual UUID from /etc/fstab.

sudo blkid | grep 86983f37-38db-401f-889a-bc93d83a3be4

Sample printout.

/dev/sdb1: UUID="86983f37-38db-401f-889a-bc93d83a3be4" TYPE="ext4" PARTUUID="decf0fe9-01"

In above example, the device path of the boot disk is /dev/sdb. Not /dev/sdb1. The 1 means partition number 1. When making raw disk backups of the full disk, partition numbers must be omitted. Otherwise it would just be a partition backup. In this case,

10. Make some notes such as.

Qubes internal disk 476.91 GiB
Debian external boot disk 931.42 GiB
Backup external disk 931.41 GiB

11. Note the device paths.

Write down the device paths of the internal disk, the external USB boot disk and the external USB backup disk with help according the above instructions.

For the author of this wiki page, /dev/sda was the (Qubes) internal disk, /dev/sdb the (Debian) USB boot disk and /dev/sdc the USB backup drive. This might be different for readers!

12. Backup.

Explanation:

  • if= means the input device to read from
  • of= means the output device to write to.
  • The time command is optional, just handy to measure how long it takes to have a good estimate how much time will be required for the next backup.

Syntax:

  • Replace if=/dev/xxx with the actual device path of the drive which should be backed up.
  • Replace of=/dev/yyy with the actual device path of the drive where the backup should be stored.

sudo time dd bs=64K conv=noerror,sync status=progress if=/dev/xxx of=/dev/yyy

Example:

Note: DATA LOSS POSSIBLE if used incorrectly! Do not use this without prior verification of the device paths!

sudo time dd bs=64K conv=noerror,sync status=progress if=/dev/sda of=/dev/sdc

[1]

The backup might take a long time.

13. Check exit code.

echo $?

Expected output if success.

0

14. Done.

Backup is complete.

15. Restoration test.

Without restoration test, it's unclear if the backup could be restored in case needed.


Restoration Test High Level Overview[edit]

1. Boot from internal USB drive.

2. Create a (or update) a backup date note file.

Create a text file with a small explanation for yourself "This is prior restoration test. This note should be gone after the restoration test."

3. Boot from external USB drive.

4. Find out the device paths of the internal drive and the USB boot drive.

5. Find out the device path of the USB backup drive.

6. Use dd to read from the USB backup drive and to write to the internal drive. (Vice versa backup procedure.)

7. Boot from internal disk to test if the restoration was successful.

Footnotes[edit]

  1. It is unfortunately not possible to compare. Running diff /dev/sda /dev/sdc for backup verification is not possible because of different partition table and disk id.


Fosshost is sponsors Kicksecure ™ stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki


Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: Discourse logo.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png link=mailto:?subject=Raw Disk Backup&body=https://www.whonix.org/wiki/Raw_Disk_Backup link=https://reddit.com/submit?url=https://www.whonix.org/wiki/Raw_Disk_Backup&title=Raw Disk Backup link=https://news.ycombinator.com/submitlink?u=https://www.whonix.org/wiki/Raw_Disk_Backup&t=Raw Disk Backup link=https://mastodon.technology/share?message=Raw Disk Backup%20https://www.whonix.org/wiki/Raw_Disk_Backup&t=Raw Disk Backup

Please help us to improve the Whonix ™ Wikipedia Page. Also see the feedback thread.

https link onion link Priority Support | Investors | Professional Support

Whonix | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.