Fetch a file from a Clonezilla image without restoring to disk

Dinosaurs are cute

I thought this was neat, but I got the info from a site that presented it in a way that was a bit difficult to decipher, so I wanted to pass it on in a presentation that is easier to understand.

If you’re not using CloneZilla, you’re definitely missing out. It’s a super easy way to clone hard drives, USB thumb drives, etc. into a format that’s easy to restore. It does disk-to-image, disk-to-disk, disk-to-network supporting ssh, nfs and cifs, and even has a p2p cloning framework for two networked computers using CloneZilla live USBs (!)

Needless to say, that’s definitely cool. But what if you want to grab a file out of an archive you’ve already created?

I had made a backup of a client’s computer I wanted to have in case something went south, but I needed to make sure I could get to the files in case I was asked to deliver files while the computer was in a state of (dis)repair.

Well, thankfully that’s pretty easy, since CloneZilla’s default image format is just some gzipped archives. You basically just unzip them into another file, which appears as the raw image file (e.g. .img), which at that point you can mount and traverse like any other mounted drive.

The basic structure of an image is contained inside a directory created by CloneZilla. It looks like this:

$ ls -la
total 55474810
drwxr-xr-x 2 avery avery                  43 May  5 18:57 .
drwxrwxrwx 9 avery administrators         16 May  5 21:36 ..
-rw-r--r-- 1 avery avery                 874 May  5 17:28 blkdev.list
-rw-r--r-- 1 avery avery                 706 May  5 17:28 blkid.list
-rw-r--r-- 1 avery avery               10068 May  5 18:57 clonezilla-img
-rw-r--r-- 1 avery avery                 235 May  5 18:56 dev-fs.list
-rw-r--r-- 1 avery avery                   4 May  5 18:57 disk
-rw-r--r-- 1 avery avery                 482 May  5 18:57 efi-nvram.dat
-rw-r--r-- 1 avery avery                7354 May  5 18:57 Info-dmi.txt
-rw-r--r-- 1 avery avery                 236 May  5 18:57 Info-img-id.txt
-rw-r--r-- 1 avery avery               19252 May  5 18:57 Info-lshw.txt
-rw-r--r-- 1 avery avery                2401 May  5 18:57 Info-lspci.txt
-rw-r--r-- 1 avery avery                 313 May  5 18:57 Info-OS-prober.txt
-rw-r--r-- 1 avery avery                 211 May  5 18:57 Info-packages.txt
-rw-r--r-- 1 avery avery                 114 May  5 18:57 Info-saved-by-cmd.txt
-rw-r--r-- 1 avery avery               10192 May  5 18:57 Info-smart.txt
-rw-r--r-- 1 avery avery                  20 May  5 18:57 parts
-rw------- 1 avery avery            13784650 May  5 17:28 sda1.vfat-ptcl-img.gz.aa
-rw------- 1 avery avery             7477849 May  5 17:28 sda2.dd-ptcl-img.gz.aa
-rw------- 1 avery avery          4096000000 May  5 17:36 sda3.ntfs-ptcl-img.gz.aa
-rw------- 1 avery avery          4096000000 May  5 17:42 sda3.ntfs-ptcl-img.gz.ab
-rw------- 1 avery avery          4096000000 May  5 17:48 sda3.ntfs-ptcl-img.gz.ac
-rw------- 1 avery avery          4096000000 May  5 17:54 sda3.ntfs-ptcl-img.gz.ad
-rw------- 1 avery avery          4096000000 May  5 18:00 sda3.ntfs-ptcl-img.gz.ae
-rw------- 1 avery avery          4096000000 May  5 18:07 sda3.ntfs-ptcl-img.gz.af
-rw------- 1 avery avery          4096000000 May  5 18:13 sda3.ntfs-ptcl-img.gz.ag
-rw------- 1 avery avery          4096000000 May  5 18:19 sda3.ntfs-ptcl-img.gz.ah
-rw------- 1 avery avery          4096000000 May  5 18:25 sda3.ntfs-ptcl-img.gz.ai
-rw------- 1 avery avery          4096000000 May  5 18:32 sda3.ntfs-ptcl-img.gz.aj
-rw-r--r-- 1 avery avery               16384 May  5 17:28 sda-gpt-2nd
-rw-r--r-- 1 avery avery               17920 May  5 17:28 sda-gpt.gdisk
-rw-r--r-- 1 avery avery                 790 May  5 17:28 sda-gpt.sgdisk
-rw-r--r-- 1 avery avery                 512 May  5 17:28 sda-mbr
-rw-r--r-- 1 avery avery                 621 May  5 17:28 sda-pt.parted
-rw-r--r-- 1 avery avery                 551 May  5 17:28 sda-pt.parted.compact
-rw-r--r-- 1 avery avery                 849 May  5 17:28 sda-pt.sf

They’re logically named with tags for partitions, like sda1, sda2, etc. You can see the super huge files are .gz.* files – gzip archives (or zstd, depending on what option you chose) that have to be re-combined to decompress properly, but that’s no big deal.

If you want to save a partition to an image file, make sure you have a copy of partclone installed on your system (e.g. # apt install partclone -y if on a debian-based distro). That’ll automate the restructuring of the partition from the gzip archives.

Make sure you have enough room on whatever drive you’re doing it on for the entire partition (and then some) – might want to du and df first just to be safe.

Note: if you used zstd instead of gzip for the archives, you’ll have to look up the zstd command switches and adapt the one-liner to accommodate the differences in their APIs. I haven’t tried it, but I assume the result should be the same.

Here’s a quick run-down of how the process goes:

# These instructions assume you're in a dir containing the backup dir
$ ls -la
drwxrwxrwx  9 avery                       administrators           16 May  5 21:36  .
drwxr-xr-x  6 root                        root                      7 Mar 23 00:21  ..
-rw-------  1 root                        root               14196736 
drwxr-xr-x  2 avery                       avery                    43 May  5 18:57  laptop-drive-backup 

# create the file that will be your raw image - any name will do
$ touch laptopPartition.img

# pipe the archives to gzip and use partclone to construct the .img 
$ cat ./laptop-drive-backup/sda3.ntfs-ptcl-img.gz.* | gzip -d -c | partclone.restore -C -s - -O ./laptopPartition.img

# then you can mount your .img file as a loop
$ sudo mount -o loop -t ntfs ./laptopPartition.img /mnt/someEmptyDir

# and browse it like anywhere else
$ ls -la /mnt/someEmptyDir # which is now loop-mounted .img file

Another thing to note is that loop mounts are read-only, kind of like mounting an .iso file, or more recently, a snap container. So you can copy stuff off, but you can’t put stuff on. But this is just a copy of your original .gz.* backup, so there’s really no chance in harming the original’s integrity anyway.

It’s always important to conduct yourself with the utmost (file) integrity!

Author: averyfreeman

Recovering zfs evangelist. Random tech tip disseminator. React/Next.JS site developer, but currently only in spare time. Previously resided: Oakland, SF, Tokyo. Now near Seattle, loving vote by mail.

4 thoughts on “Fetch a file from a Clonezilla image without restoring to disk”

  1. Hi, Avery Freeman. I found that the partclone.restore command needs to run as root to write to /var/log/partclone.log, and needed a “-W” switch to produce a raw file for ‘loop’ purposes, before the mount command would work for me. Here’s the two command lines I used :

    cat /path/to/sda3.ext2-pttcl-img.gz.* | gzip -d -c | sudo partclone.restore -W -C -s – -O ./sda3.img

    sudo mount -o loop -t ext2 ./sda3.img /mnt/whatever

    Omitting the -W option to partclone.restore program and then trying to mount would result in this error message from mount:

    mount: wrong fs type, bad option, bad superblock on /dev/loopX (‘X’ will be some number, depending upon how many filesystems you have mounted via the loop device.

    Hopefully this information about passing -W to partclone.restore will be useful to someone else.
    jdr

    1. Thanks, John, a very helpful, prescient update to the process! This must be “new” relative to the version I was using when I wrote the article. Indeed, my Arch linux system says:


      -W --restore_raw_file create special raw file for loop device

      --version: Partclone : v0.3.27 (0882b2de94f05d3ad81304872cbd3dff02105239)

      I have dug into the source code (since I can’t remember) to see why I didn’t have option -W at the time. Interestingly, the man page on their official website doesn’t even list it: https://partclone.org/usage/partclone.php

      The version in Ubuntu 20.04 was pretty antiquated (I think I may have even written that using 19.10 — the Ubuntu packages site doesn’t go back that far): https://packages.ubuntu.com/search?keywords=partclone

      focal (20.04LTS) (admin): Utility to clone and restore a partition [universe]
      0.3.13+dfsg-4: amd64 arm64 armhf ppc64el riscv64 s390x

      Oddly, the 0.3.13 version isn’t even a release listed in the repo: https://github.com/Thomas-Tsai/partclone/tags?after=0.3.18

      Eoan (19.10) would have been 3.11: https://launchpad.net/ubuntu/+source/partclone/0.3.11-1build3

      Full publishing history is listed here: https://launchpad.net/ubuntu/+source/partclone/+publishinghistory

      Release version weirdness aside, if you’d like to avoid privileged usage for partclone, you could probably pass the log to a user-owned location on the filesystem: https://partclone.org/usage/partclone.php

      -L FILE, --logfile FILE
      put special path to record partclone log information.(default /var/log/partclone.log)

      But one still has to be root to mount filesystems, etc. so probably a moot point. Thanks again for the update!

  2. CloneZilla supports encryption while creating disk image using ecryptfs. What is the command if image is also encrypted?

Leave a Reply

Your email address will not be published. Required fields are marked *