2

Does anyone have any insights into how to read files from a tape created using NTBackup?

The situation is as follows. Several months ago, my office migrated a key piece of software from a local server to a vendor hosted solution. The old box had run Windows Server 2003. Every night we used NTBackup to write important files to tape. These were full, not incremental backups. The drive was a DAT72 model. I can't remember if we used compression or not.

Now we need to retrieve a file off the old server. Naturally we've already reprovisioned it and wiped the hard drives leaving only the backups. Currently the box runs Debian 7.8. While we have other computers around, the one in question is a Dell PowerEdge 2800 and the tape drive has a SCSI connection. No other machines in our office has such a slot so I can't just hook the drive up elsewhere. The only good news is read/write to and from a blank tapes works.

Tar won't read the tape saying it's not a tar archive. I managed to find a utility which will read the MTF format NTBackup used. Unfortunately it only reads the metadata such as media name, description, etc. I can't seem to list the files, much less extract them. Does anyone have any insights? My goal is to list the files on the tape and ensure they can be retrieved.

UPDATE: I was able to dd something from the tape to a file. It was only 64Kb so the command probably only read one block. Combined with the realization I can use /dev/nst0 instead of /dev/st0 this feels like a progress.

| improve this question | |
  • At the risk of nitpicking tar will happily read the tape. It just does not understand what is written on it. Similar to the way I can read spanish. I succesfully read the letters, I just do not speak the language and do not know what the words mean. – Hennes Jun 30 '15 at 20:08
  • True, although the result is the same for me. I did get something off of the tape using the dd command. Unfortunately when I opened it in a text editor the contents were gibberish. – Mike P Jun 30 '15 at 20:20
  • Can you dd the contents of the tapes to a windows PC with ntbackup? (Disclaimer: Just a wild ass guess. No idea if NTbackup will read those files and it feels hackish. But possibly an emergency solution). – Hennes Jun 30 '15 at 20:26
  • Not sure. I don't have access to a computer with NTBackup. Windows Server 2012 will not recognize the file created in Linux using dd as a backup. We have two old trial disks of Server 2003 so the option remains on the table. – Mike P Jun 30 '15 at 21:04
  • 1
    A similar question on serverfault has an answer that says to use software called mfttar. – Mark Plotnick Jun 30 '15 at 21:44
1

I've managed to extract about 21GB of data (and counting) from the tape using the dd command. This tutorial here is very helpful although the parts about appending files and looping are more challenging. The data still requires interpretation, but I am more confident in my abilities to find a way to do so.

| improve this answer | |
  • Could you please write a fully working solution here? – Jonas Stein Dec 30 '19 at 12:30
  • Unfortunately I don't have one and am no longer working at the same job. If I recall correctly, the data was still unreadable even after I copied it. We ended up having a conversation with the vendor and decided the data was probably not important enough to spend money recovering. – Mike P Feb 19 at 16:55
1

I am on a similar situation. Have an old DDS4 tape that we want to resuscitate some code from.

Doing dd three times got first a 32Kb file, and the next file was also 32Kb. The third time in a row that the command was issued a 1.2Gb file came out. I can read the text parts of it and see that it was written with NTBACKUP, which I didn't know before.

dd if=/dev/st0 of=file1 bs=32k count=1 dd if=/dev/st0 of=file2 bs=32k count=1 dd if=/dev/st0 of=file3 bs=32k count=1

grepping has to be done with --binary-files=text or use the string command to convert the binary format first into a readable format. Also, having such large file makes it difficult for text editors, vi, emacs, and nano can't handle it. less and more can, but it might be better to split it into chunks.

Now, have you had any success in going from NTbackup format to something linux can make sense of?

I'm using fedora 21.

| improve this answer | |
  • I haven't tried. The tutorial I linked to mentioned adding ".bkf" to the end and using a BKF recovery tool in Windows from there. I usually get far enough to see the files before the programs ask for money. Since the situation which led to my post was the fault of one of our vendors, I've been pestering them to finish the job. – Mike P Jul 17 '15 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.