ntfsclone
Clone an NTFS volume to a non-existent file:
ntfsclone –output ntfs-clone.img /dev/hda1