Clonezilla

What It Does

Clonezilla operates in two modes. Device-to-image saves a compressed snapshot of a disk or partition to a file (stored on an external drive, NFS share, or SSH server). Device-to-device clones one disk directly to another. It only copies used blocks, so a 500GB drive with 40GB of data produces a ~40GB image, not a 500GB one. It supports ext2/3/4, NTFS, FAT, HFS+, and other filesystems.

Why You Need It

Disk imaging is a core IT and forensic skill. You need Clonezilla for bare-metal backups before risky operations (OS upgrades, partition resizing), mass deployment (image one lab machine, clone it to 30), disaster recovery, and forensic acquisition (imaging a suspect drive before analysis). It is the free equivalent of commercial tools like Acronis or Ghost. Referenced in SG-31: Build a Bootable USB Drive as a critical utility to keep on your bootable toolkit USB.

How to Install It

Clonezilla is a live environment -- you boot from it, you do not install it on top of an existing OS.

1. Go to https://clonezilla.org/downloads.php
2. Select Clonezilla Live (not Clonezilla SE, which is for server-based mass deployment)
3. Choose your architecture: amd64 for modern 64-bit machines
4. Choose file type: iso for burning to USB, zip for manual extraction to a FAT32 USB
5. Write the ISO to a USB drive using Rufus, balenaEtcher, or Ventoy
6. Boot the target machine from the USB drive

If using Ventoy, just drop the Clonezilla ISO onto the Ventoy data partition -- no separate flash needed.

How to Use It

1. Boot into Clonezilla Live. Select "Clonezilla live (VGA with large font)" from the boot menu. Choose your language and keyboard layout. Select Start_Clonezilla.
2. Choose your mode. Select device-image (backup to/from image file) or device-device (direct clone). For most backup scenarios, choose device-image.
3. Select the image repository. Tell Clonezilla where to save (or read) the image. Options include:
   • local_dev -- an external USB drive or second internal drive
   • ssh_server -- save over SSH to a remote machine
   • nfs_server -- save to an NFS share
   • samba_server -- save to a Windows/Samba share
   For local_dev, plug in the destination drive before selecting this option. Clonezilla will scan for it.
4. Run the operation. For a backup: select savedisk (entire disk) or saveparts (specific partitions). Name the image. Select the source disk. Clonezilla compresses and saves it. For a restore: select restoredisk or restoreparts, choose the image, choose the target disk.
5. Verify after restore. Clonezilla can optionally check the image integrity before and after restore. Enable this for critical operations -- it adds time but catches corruption.

Common Gotchas

• Destination must be equal or larger. When restoring an image, the destination disk must be the same size or larger than the source. Clonezilla cannot shrink partitions during restore. If you need to restore to a smaller disk, use the expert mode option -icds (skip checking destination size) and manually resize partitions with GParted afterward -- but only if the actual data fits.
• The interface is text-based. Clonezilla uses a curses-based menu system, not a graphical UI. Navigate with arrow keys and Enter. It looks intimidating at first, but every step is clearly labeled. Read each screen carefully before pressing Enter.
• Source and destination drives must not be the same. This sounds obvious, but when a machine has multiple drives of the same size, it is easy to mix up /dev/sda and /dev/sdb. Use the model name and serial number shown in the selection screen, not just the size.
• Encrypted partitions need special handling. Clonezilla can clone LUKS-encrypted partitions at the block level, but it cannot image them as filesystem-aware snapshots. Use dd-mode cloning for encrypted volumes, which copies every block (including unused space) and produces larger images.
• Network-based saves need correct credentials. When saving to SSH/NFS/Samba, have the server IP, path, and credentials ready before starting. There is no "go back" once the operation is running. Test connectivity before starting the clone.