ntfsclone

ntfsclone [OPTIONS] SOURCE [DESTINATION]

Examples:
ntfsclone /dev/sda1 image.img
ntfsclone image.img /dev/sdb1
ntfsclone /dev/sda1 /dev/sdb1

-o, --output-file FILE
    Specify the output file to write the image to when cloning from a device.

-r, --restore-image
    Restore the image from SOURCE (a file) to DESTINATION (a device or file). This is the default if SOURCE is a file and DESTINATION is a device.

-s, --rescue
    Ignore read errors and continue cloning. Useful for damaged partitions or forensic imaging.

-f, --force
    Force the operation, e.g., overwrite an existing destination file or partition without prompting.

-q, --quiet
    Suppress verbose output and show only critical messages.

-p, --percent
    Display a progress bar showing the percentage of the cloning process completed.

-L, --label NEW_LABEL
    Set a new volume label for the NTFS filesystem during restoration.

-h, --help
    Display a help message and exit.

-V, --version
    Display version information and exit.

ntfsclone is a powerful and efficient command-line utility for cloning or restoring NTFS partitions. Unlike generic block-level cloning tools like dd, ntfsclone intelligently copies only the allocated blocks of an NTFS filesystem, including all metadata, making it significantly faster and more space-efficient, especially for partitions with a lot of free space. It can create an exact image of an NTFS partition into a file or directly clone it to another partition. This tool is part of the ntfs-3g project, which provides robust NTFS filesystem support for Linux. It is widely used for creating backups of Windows partitions, migrating systems to new drives, or for forensic imaging, all without requiring a Windows environment.

The source NTFS partition must be unmounted before cloning to ensure data consistency.
The destination partition or file system must be large enough to accommodate all allocated blocks of the source NTFS partition. While ntfsclone copies only used blocks, it does not inherently resize partitions. Resizing usually needs to be done with tools like ntfsresize or GParted after restoration.
It is specifically designed for NTFS filesystems; it cannot be used with other filesystem types.

ntfsclone originated as part of the ntfsprogs project, a suite of utilities for manipulating NTFS filesystems from Linux. This project later merged with NTFS-3G, an open-source driver providing read-write NTFS support. The development focused on creating robust, reliable, and efficient tools that could safely interact with NTFS, filling a critical gap in Linux's capabilities for Windows-compatible disk management. Its design, specifically copying only used blocks, was a significant advancement over generic sector-by-sector copying for NTFS.

ntfs-3g(8), ntfsfix(8), ntfsresize(8), dd(1), partclone(8)