Restoring from NTBackup Tape

Question

Does anyone have any insights into how to read files from a tape created using NTBackup?

The situation is as follows. Several months ago, my office migrated a key piece of software from a local server to a vendor hosted solution. The old box had run Windows Server 2003. Every night we used NTBackup to write important files to tape. These were full, not incremental backups. The drive was a DAT72 model. I can't remember if we used compression or not.

Now we need to retrieve a file off the old server. Naturally we've already reprovisioned it and wiped the hard drives leaving only the backups. Currently the box runs Debian 7.8. While we have other computers around, the one in question is a Dell PowerEdge 2800 and the tape drive has a SCSI connection. No other machines in our office has such a slot so I can't just hook the drive up elsewhere. The only good news is read/write to and from a blank tapes works.

Tar won't read the tape saying it's not a tar archive. I managed to find a utility which will read the MTF format NTBackup used. Unfortunately it only reads the metadata such as media name, description, etc. I can't seem to list the files, much less extract them. Does anyone have any insights? My goal is to list the files on the tape and ensure they can be retrieved.

UPDATE: I was able to dd something from the tape to a file. It was only 64Kb so the command probably only read one block. Combined with the realization I can use /dev/nst0 instead of /dev/st0 this feels like a progress.

Answer 1

I've managed to extract about 21GB of data (and counting) from the tape using the dd command. This tutorial here is very helpful although the parts about appending files and looping are more challenging. The data still requires interpretation, but I am more confident in my abilities to find a way to do so.

Answer 2

I am on a similar situation. Have an old DDS4 tape that we want to resuscitate some code from.

Doing dd three times got first a 32Kb file, and the next file was also 32Kb. The third time in a row that the command was issued a 1.2Gb file came out. I can read the text parts of it and see that it was written with NTBACKUP, which I didn't know before.

dd if=/dev/st0 of=file1 bs=32k count=1 dd if=/dev/st0 of=file2 bs=32k count=1 dd if=/dev/st0 of=file3 bs=32k count=1

grepping has to be done with --binary-files=text or use the string command to convert the binary format first into a readable format. Also, having such large file makes it difficult for text editors, vi, emacs, and nano can't handle it. less and more can, but it might be better to split it into chunks.

Now, have you had any success in going from NTbackup format to something linux can make sense of?

I'm using fedora 21.