Disk cloning

Disk cloning is the process of duplicating all data on a digital storage drive, such as a hard disk or solid state drive, using hardware or software techniques.^[1] Unlike file copying, disk cloning also duplicates the filesystems, partitions, drive meta data and slack space on the drive.^[2] Common reasons for cloning a drive include; data backup and recovery; duplicating a computer's configuration for mass deployment and for preserving data for digital forensics purposes.^[1][3][4] Drive cloning can be used in conjunction with drive imaging where the cloned data is saved to one or more files on another drive rather than copied directly to another drive.

Background

Figure 1: An illustration of connecting two drives to a computer to clone one drive (the source drive) to another (the destination) drive.

Disk cloning occurs by copying the contents of a drive called the source drive. While called "disk cloning", any type of storage medium that connects to the computer via USB, NVMe or SATA can be cloned. A small amount of data is read and then held in the computer's memory. The data is then either written directly to another (destination) drive or to a disk image.

Typically, the destination drive is connected to a computer (Fig. 1). Once connected, a disk cloner is used to perform the clone itself. A hardware-based drive cloner can be used which does not require a computer.^[5] However, software cloners tend to allow for greater flexibility because they can exclude unwanted data from being duplicated reducing cloning time. For example, the filesystem and partitions can be resized by the software allowing data to be cloned to a drive equal to or greater than the total used space. Most hardware-based cloners typically require for the destination drive to be the same size as the source drive even if only a fraction of the space is used.^[5] Some hardware cloners can clone only the used space but tend to be much more expensive.

Applications

Deployment

A common use of disk cloning is for deployment. For example, a group of computers with similar hardware can be set up much quicker by cloning the configuration. In educational institutions, students are typically expected to experiment with computers to learn. Disk cloning can be used to help keep computers clean and configured correctly.^[6] Further, while installing the operating system is quick, installation of programs and ensuring a consistent configuration is time consuming. Thus, disk cloning seeks to mitigate this administrative challenge.

Digital forensics

One of the most common applications of disk cloning is for digital forensics purposes.^[7] This aims to ensure that data is preserved at the time it was acquired for later analysis.^[8] Techniques for cloning a disk for forensic purposes differ from cloning a drive for other purposes. Typically, the cloning process itself must not interfere with the data. Because software cannot be installed on the system, a hardware-based cloner is generally used to duplicate the data to another drive or image.^[1] Further, the hardware-based cloner also has write-blocking capabilities which intercepts write commands to prevent data being written to the drive.^[8]

Backup

Disk cloning can be used as a backup solution by creating a duplicate of data as it existed when the clone was started.^[9] The clone can be used to restore corrupted files such as corrupted databases. In modern software solutions, it is not uncommon for disk cloning techniques to be combined with disk imaging techniques to create a backup solution.

Drive upgrade

Upgrading to a larger or faster drive can be facilitated by cloning the old drive to the new drive once it is installed into the system. This reduces the need to having to manually reinstall applications, drivers and the operating system.^[10] The procedure can be used when migrating from mechanical hard disk drives to solid state drives.^[11] Modern cloning software tends to communicate with storage devices through a common interface, which means, that any storage device can be cloned and migrated. Sometimes, booting from the destination drive can fail and require adjustments in the computer's UEFI or BIOS to make the new clone bootable.^[12]

Technical challenges

There are several technical challenges that need to be considered when planning to clone a drive.

Drive in use

Often, cloning software runs within the operating system which is running off of one of the drives being cloned. As a result, any attempt to clone the contents of the drive, even to a file, would result in data corruption. Consequently, the drive cloner must ensure that the data on the source drive remains in a consistent state at the time of reading. Further, in the case, that the user desires to clone to the computer's system drive, this generally cannot be done while the operating system is running.

A common solution to cloning a drive that is in use, which is utilized by software such as CloneZilla, is to boot from a Linux-based operating system so the drive can be copied and/or overwritten.^[6][13] This approach is not suitable for servers that need to be running all the time and cannot be shutdown routinely to perform the backup (or cloning) operation.^[14] Further, the Linux-based operating system must provide appropriate drivers for the system's hardware. Drivers are also required for the source and destination drives and for any attached storage involved in facilitating the cloning operation such as USB, tape device and networking drivers.

Some server-based operating system incorporate mechanisms to allow the drive to be safely backed up while the system is running to overcome these challenges. For example, Windows Server 2003 (and later) includes volume shadow service (VSS).^[14][15] VSS takes a snapshot of the drive so that any changes are not written to the snapshot.^[16] The snapshot creates a virtual drive called a shadow volume that is backed up (or cloned) by the software.

Slow

Disk cloning can be time consuming, especially, for large disks because a true clone needs to copy all the data on the disk even if most data resides in unallocated drive space.^[1] Software solutions can determine the space in use and only copy the used data reducing the time needed to clone the drive. Some drive cloners make use of multithreading to further speed up the cloning operation.^[1]

See also

• Comparison of disk cloning software
• Disk mirroring
• Disk image
• List of backup software
• List of data recovery software
• List of disk partitioning software
• Live USB
• Recovery disc
• Security Identifier

References

1. Panichprecha, S.; Pongsawatkul, N.; Mitrpant, C.; Ketprom, U.; Kovintavewat, P. (2011). "Multi-threading in disk cloner". The 8th Electrical Engineering/ Electronics, Computer, Telecommunications and Information Technology (ECTI) Association of Thailand - Conference 2011. pp. 512–515. doi:10.1109/ECTICON.2011.5947887. ISBN 978-1-4577-0425-3. S2CID 15754588.
2. Turriza, José Luis Lira; Huh, Yaqueline Pech; Lira, Jose Manuel (2018). "Comparative study of restoration tools by cloning using LSP me-thod". Revista Ingeniantes. 5 (1): 1.
3. Hayes, Darren R. (2014). A Practical Guide to Computer Forensics Investigations. Pearson Education. pp. 86–87. ISBN 9780132756150.
4. Jeanvoine, Emmanuel; Sarzyniec, Luc; Nussbaum, Lucas (2013-02-01). "Kadeploy3: Efficient and Scalable Operating System Provisioning for Clusters". USENIX Association. 38 (1): 38.
5. "Everything You Should Know About Hard Drive Duplicators". MiniTool. 2021-12-28. Retrieved 2023-01-09.
6. Bălan, T.C.; Robu, D.N.; Sandu, F. (2015). "Ad-hoc lab computer network configuration using remote resources". 2015 IEEE 21st International Symposium for Design and Technology in Electronic Packaging (SIITME). pp. 393–396. doi:10.1109/SIITME.2015.7342360. ISBN 978-1-5090-0332-7. S2CID 39545275.
7. Manson, Dan; Carlin, Anna; Ramos, Steve; Gyger, Alain; Kaufman, Matthew; Treichelt, Jeremy (2007). "Is the Open Way a Better Way? Digital Forensics Using Open Source Tools". 2007 40th Annual Hawaii International Conference on System Sciences (HICSS'07). pp. 266b. doi:10.1109/HICSS.2007.301. S2CID 15273267.
8. Meffert, Christopher S.; Baggili, Ibrahim; Breitinger, Frank (2016-08-07). "Deleting collected digital evidence by exploiting a widely adopted hardware write blocker" (PDF). Digital Investigation. 18: S87 – S96. doi:10.1016/j.diin.2016.04.004. ISSN 1742-2876.
9. Babalola, Olawunmi (2018-03-02). "BEST PRACTICE FOR COMPUTER IMAGING AND MAINTAINING A DATABASE". Student Scholarship – Computer Science.
10. "How to Clone Hard Drive on Windows 10 without Reinstalling". www.diskpart.com. Retrieved 2023-01-09.
11. "How to Upgrade HDD to SSD without Reinstalling Windows". www.diskpart.com. Retrieved 2023-01-09.
12. "Fixed: Cloned Hard Drive or SSD Won't Boot". www.diskpart.com. Retrieved 2023-01-09.
13. Yao, J. F. J., & Carlisle, J. (2011). Self-support computer science lab. Journal of Computing Sciences in Colleges, 26(4), 64-70.
14. Grasdal, Martin; Hunter, Laura E.; Cross, Michael; Hunter, Laura; Shinder, Debra Littlejohn; Shinder, Thomas W. (2003-01-01), Grasdal, Martin; Hunter, Laura E.; Cross, Michael; Hunter, Laura (eds.), "Chapter 8 - MCSE 70-293: Planning, Implementing, and Maintaining a High-Availability Strategy", MCSE (Exam 70-293) Study Guide, Rockland: Syngress, pp. 559–638, ISBN 978-1-931836-93-7, retrieved 2023-01-09
15. JasonGerend (7 December 2022). "Volume Shadow Copy Service". learn.microsoft.com. Retrieved 2023-01-09.
16. Leschke, T. R. (2010). Shadow volume trash: $ Recycle. Bin forensics for Windows 7 and Windows Vista shadow volumes.