From 2363284b217a01beda5329aa915cc423e546583d Mon Sep 17 00:00:00 2001
From: Milkey Mouse <milkeymouse@meme.institute>
Date: Sun, 5 Nov 2017 20:42:44 -0800
Subject: [PATCH] Add instructions for ntfsclone (fixes #81)

---
 docs/faq.rst | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/docs/faq.rst b/docs/faq.rst
index f4d7fe5c268..5130d9fe2c3 100644
--- a/docs/faq.rst
+++ b/docs/faq.rst
@@ -48,6 +48,44 @@ and platform/software dependency. Combining Borg with the mechanisms provided
 by the platform (snapshots, hypervisor features) will be the best approach
 to start tackling them.
 
+How can I decrease the size of disk image backups?
+--------------------------------------------------
+
+Full disk images are as large as the full disk when uncompressed and don't get much
+smaller post-deduplication after heavy use. This is because virtually all file systems
+don't actually delete the data on disk (that is the place of so-called "secure delete")
+but instead delete the filesystem entries referring to the data. This leaves the random
+data on disk until the FS eventually claims it for another file. Therefore, if a hard
+drive nears capacity and files are deleted again, the change will barely decrease the
+space it takes up when compressed and deduplicated. Depending on the filesystem of the
+VM (or physical computer, if for some reason a normal filesystem backup can't be taken),
+there are several ways to decrease the size of a full image:
+
+Using ntfsclone (NTFS, i.e. Windows VMs)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+ntfsclone can only operate on filesystems with the journal cleared (i.e. turned-off
+machines) which somewhat limits its utility in the case of VM snapshots. However,
+when it can be used, its special image format is even more efficient than just zeroing
+and deduplicating. For backup, save the MBR and the contents of each partition::
+
+    sfdisk -d /dev/sdX > sfdisk.txt
+    dd if=/dev/sdX of=mbr_gap count=2048  # all sectors until 1st partiton
+    borg create repo::hostname-partinfo-mbr-gap sfdisk.txt mbr_gap
+    sfdisk -l -o Device,Type /dev/sdX | grep NTFS | cut -d' ' -f1 | while read x; do
+        ntfsclone -s -o - $x | borg create repo::hostname-part$(echo $x | grep -Eo "[0-9]+$") -
+    done
+
+Restoration is essentially the same process done in reverse::
+
+    borg extract repo::hostname-partinfo-mbr-gap
+    sfdisk /dev/sdX < sfdisk.txt
+    dd if=mbr_gap of=/dev/sdX bs=1M
+    sfdisk -l -o Device,Type /dev/sdX | grep NTFS | cut -d' ' -f1 | while read x; do
+        borg extract --stdout repo::hostname-part$(echo $x | grep -Eo "[0-9]+$") | ntfsclone -r -O $x -
+        ntfsclone -s -o - $x | borg create repo::hostname-part -
+    done
+
 Can I backup from multiple servers into a single repository?
 ------------------------------------------------------------