I have two copies of an ntfs partition on a linux server (old backups). If I mount them as loop device, and compare the content file by file, there is no difference between them. But comparing these images with cmp or vbindiff there are many differences. How can I find out what are these? Possibly the original fs was used in windows (only for reading) between making the two copies, but I don't remember and the "find . -ls" gives the same result on the mounted images, so the file dates/times are looking unchanged. I'd like to delete one of them, but I'd like to be sure if they are containing the same data, and the differences are unnecessary junk.
You shouldn't compare two images directly if the other one hasn't been made as a direct image of the other one.
If you copy files from a read-only image to a new image, the images will be different on the byte-level, because meta-data on the filesystems are generated in a different order.
This happens because files are created in a different order. there might be some deleted files on the volume. When files are deleted, only the filesystem metadata is updated so that the files' blocks are marked as free, but they will still contain the data of the files.
The only valid comparison is to compare file system contents is via file-level comparison. One good tool for such purpose is
rsync with the
--dry-run option, which only shows what
rsync would do in case differences are found.
Another useful tool for finding differences is
I think, I have found a possible solution. There are some tools in the package ntfs-3g: ntfscmp, ntfsinfo, ntfscat etc.
With ntfscmp I could compare the ntfs images and it shows the different inodes.
With ntfsinfo -i image_name I could determine the type of that inodes and many other information about them. The inodes with different content are named as "$LogFile" - this is the ntfs's own journal AFAIK.
The solution: there are no real differences between images, perhaps I've mounted them as r/w and ... and I don't know what other happened to them, but the content is the same on both images.