Link to home
Start Free TrialLog in
Avatar of carlsmethurst
carlsmethurst

asked on

Backup Exec tape partially overwritten (a few Mb) - can I recover data from previous backup?

We have a Data Server running Win 2k Server, with Backup Exec v.8.6 backing up files stored locally on the server on a nightly basis (assuming someone remembers to swap tapes when I'm not around).  Our tape rotation system is very simple and we use 'overwrite media without prompting' to simplify unattended backups.  ('Bad idea' someone will probably tell me).

Having lost a number of important files from the data server (user error - not me I hasten to add!) I was attempting to restore from the most recent backup tape.  Unfortunately, I didn't realise a previously scheduled backup had not happened, and when I inserted the tape, the scheduled backup immediately started.  I cancelled the operation as soon as I realised, but around 40Mb of data had been written to the tape.

I have attempted to rebuild the catalog on the tape using the Device: Inventory: Catalog option, but this simply gives me the catalog of the new, aborted backup.  Is there any way of recovering files from the previous backup, which presumably still exist in some form?  The original backup was around 20Gb of data - the files we need are just a few Mb of Excel spreadsheets.

TIA,

Carl
Avatar of CrazyOne
CrazyOne
Flag of United States of America image

Quite honestly I don't know if the following work with tape of not

Take look at these.

FREE TOOLS

PC INSPECTOR
http://www.pcinspector.de/file_recovery/UK/welcome.htm 
File Recovery is a data recovery program that supports the FAT 12/16/32 and NTFS file systems. The current version 3.x replaces the previous version 2.x, which is now over 6 years old.

Restoration
http://hccweb1.bai.ne.jp/~hcj58401/REST2514.EXE
For 9x/NT/2K/XP. Restore deleted files that are no longer in the Recycle Bin!

Tool to check and undelete partition
Works with the following partitions:
- FAT12 FAT16 FAT32
- Linux
- Linux SWAP (version 1 and 2)
- NTFS (Windows NT)
- BeFS (BeOS)
- UFS (BSD)
- Netware
- RaiserFS
http://www.cgsecurity.org//testdisk.html
-------------------------------

NOT FREE

EasyRecovery DataRecovery is a simple, yet powerful tool that recovers data that is lost, inaccessible or deleted. It's the ultimate do-it-yourself solution for nearly all causes of data loss (except physical hardware or system problems) where your hard drive and system are fully functional.
http://www.ontrack.com/easyrecoverydatarecovery/

File Rescue 2.5
Web:http://www.file-rescue.com/

GetDataBack for FAT
GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, FAT, or root directory have been damaged by a virus, formatting, fdisk or power failure. GetDataBack can even recover your data when the drive is no longer recognized by Windows.

GetDataBack for NTFS
Recover your files when the data is no longer accessible due to formatting, fdisk, virus attack, power or software failure. Get everything back even when the drive's partition table, boot record, Master File Table or root directory is lost or corrupt.
Hard Drives
Partitions
Floppy Drives
Drive Images
Zip/Jaz Drives
http://www.runtime.org/

Norton Utilities/SystemWorks
The Norton Protected Recycle Bin helps you recover deleted and overwritten files.
The UnErase wizard helps you retrieve files you've accidentally deleted.
http://www.symantec.com/nu/nu_9x/features.html

For NTFS
http://www.restorer2000.com/r2k.htm

Data Recovery
http://www.dtidata.com/
Fast File Undelete
http://www.dtidata.com/products_ff_undelete.asp

Undelete
http://www.quantumsoft.co.uk/undelete.stm

File Recover 2000
http://www.filerecover.com/

R-Tools
http://www.r-tt.com/

File Restore
If you've deleted your data and you want to get it back, you need FileRestore.
FileRestore is a simple, easy-to-use tool for recovering files that have been lost or deleted from your Windows system. Designed for Windows XP, 2000, NT, Me, and 9x
http://www.winternals.com/products/repairandrecovery/filerestore.asp.

Hard Disk and Data Recovery Related Tools:
The DiskPatch tool supposedly can rebuild the File System structure depening on the damage to the structure.
http://www.diydatarecovery.nl/

ERD Commander
Key features:
Boots dead systems directly from CD
Easy, familiar Windows-like interface
Includes the Locksmith utility to reset lost Administrator passwords
Includes FileRestore so that you can quickly find and recover deleted files
Provides access to XP Restore Points on unbootable Windows XP systems
Compares key info on unbootable systems with that of a working system for diagnosis and trouble-shooting
Allows for formatting and partitioning of disks
Built-in network access to safely copy data to/from dead systems
Repair and diagnostic tools located on Start menu
Repair tools include Service and Driver Manager, Locksmith, FileRestore, Registry Editor, Explorer, Disk Management, and Command Prompt
Diagnostic tools include the System Compare, Event Log Viewer, System Information, TCP/IP Configuration, and Logical volumes utilities
Compatible with Windows NT, 2000, XP, and Server 2003  
http://www.winternals.com/products/repairandrecovery/diskcommander.asp

DFSee
http://www.dfsee.com/
As a tool to 'UNDELETE' files that have been accidentaly deleted.
This feature is implemented for HPFS and NTFS only.

MRECOVER
http://kristenonline.com/lain/cih/mrecintro.htm

Emergency Undelete
I believe this is free
For Win2000 and NT may work on XP
http://www.c2000.com/software/#win2000

Back2Life
http://www.simtel.net/pub/pd/57588.html

Hard Drive Mechanic
http://www.highergroundsoftware.com/6.html
It's true. Even if you just re-formatted your entire hard drive, you can still get all of your data back because, unlike what most people believe, formatting does NOT erase your files! With Hard Drive Mechanic's Unformat Feature, you can restore all of your valuable data in about 10 minutes!
demo version:
http://www.highergroundsoftware.com/downloads2.htm

Filerecovery for Windows
http://www.lc-tech.com/filerecovery.asp
Filerecovery for Windows® is a safe and affordable do-it-yourself data recovery solution that is designed to recover deleted files from all types of media such as Hard Drives, Floppy Drives, SmartMedia, CompactFlash, Memory Sticks, and other types of removable media.

Undelete
http://www.executive.com/consumer/undelete/undelete.asp
You know how upsetting it is to accidentally delete a file that you need—it takes just a moment to lose hours of work. Undelete file-recovery utility captures ALL deleted files including those that typically bypass the Recycle Bin. You can even recover files you purged from our Recovery Bin. With our Emergency Undelete feature, you can recover files deleted prior to Undelete being installed on your system (provided they have not been written over). Buy Undelete and you'll never again be at the mercy of lost data.

Fast File Recovery
http://savemyfiles.com/fastfile.htm
A definite must for the PC guru! It will allow the user to perform all data recovery tasks associated with disks which are not physically damaged.

File Scavenge
http://www.quetek.com/prod01.htm
File Scavenge is the most comprehensive, award-winning file undelete and data recovery for NTFS volumes on Windows NT, Windows 2000 and Windows XP.

Active UNERASER
http://www.uneraser.com/undelete.htm
Active UNERASER is a compact and powerful undelete utility that can recover deleted files and folders on FAT12, FAT16, FAT32 and NTFS systems. It can even restore files from deleted and re-formatted partitions.

Undelete 3.0
http://www.pcconnection.com/scripts/productdetail.asp?product_id=309884
Undelete 3.0 restores accidentally deleted files within seconds from anywhere on your system. Version 3.0 includes new SecureDelete, full Windows XP support and expanded search options.

FinalData Data Recovery
http://www.finaldata.com/
FinalData Data Recovery Solution will recover files that have been lost by   quick formatting, FDISK, FAT damage, MBR damage or directory   destruction. It recovers data from FAT12/16/32, NTFS, and EXT2, EXT3.

File Rescue Plus
http://www.file-rescue.com/
Recover Accidentally Deleted Files and Pictures Quickly and Easily — Even from Quick Formatted or Virus Damaged Drives!  
Runs on Windows 95-98-ME-XP-NT-2000-2003 Server or Workstation
Scans FAT 12/16/32/NTFS, Flash, Compact, Smart, Secure Digital, Memory Stick
Recognizes: Hard Drives, Floppy, Zip, Syquest, Ditto, Digital Cameras, etc...

Oops — you've accidentally deleted the file that contains key data that you need right away! You've lost all the pictures you just downloaded from your digital camera!

What do you do?

Just run File Rescue Plus! Simply scan the disk and choose the files you want to recover. It's that simple!

Your computer contains a lot of key information — financial data, addresses, phone numbers, legal documents, important photographs and much more. And face it, mistakes do happen!
 


BadCopy Pro
http://www.jufsoft.com/badcopy/
BadCopy Pro is a leading data recovery tool for floppy disk, CD-ROM, CD-R/W and other storage media. It can effectively recover and rescue corrupted or lost data from damaged, unreadable or defective disks. Various damage situations and all file types are supported.

Directory Snoop
http://www.briggsoft.com/dsnoop.htm
Directory Snoop is a low-level forensic utility that can recover erased files in an emergency, wipe sensitive data, and search for hidden data at the cluster level. Step through your File Allocation Table (FAT) and map individual clusters back to the file that owns them. Purge orphaned (and possibly sensitive) file names right out of the directory structure. $29 shareware for Windows 95 through XP (NTFS drives not supported).

others
Active@ UNDELETE will help you to restore data residing drives formatted in FAT12, FAT16, FAT32, NTFS, NTFS5 file systems and it works under all Windows family operating systems: Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000 and Windows XP.
http://www.active-undelete.com/

http://ssl.oosoft.de/en/products/ooue/

Undelete & Recover deleted files from your FAT 12/16/32 Hardisks
http://www.tipsdr.com/recover-data-recovery.html

http://www.recovermyfiles.com/

------------------------------------
Or Data Recovery Services

http://www.ontrack.com/datarecovery/
Ontrack offers a full range of data recovery solutions to address your data loss needs. Unlike other data recovery companies, Ontrack provides exclusive and patented solutions that do not require you to send in your media for recovery. In situations where the hardware is functioning normally, our patented Remote Data Recovery service and EasyRecovery software solutions can solve your data loss needs safely and effectively in a matter of hours. If another company claims that there is no alternative to shipping your drive, it's because they don't offer an alternative. For situations in which the hardware is physically failing, our In-Lab services will utilize our Class 100 clean-rooms to retrieve your mission critical data.

or

FLAT RATE DATA RECOVERY PRICING INCLUDES!
http://www.i-t-s.com/datarec/datarec_pricing.htm 

or

Total Recall
http://www.recallusa.com/
Our recovery and forensic technology is used by support and call centers as well as data recovery providers world-wide.

ESS Data Recovery
http://www.savemyfiles.com/
ESS Data Recovery, Inc. has been removing barriers in the data recovery and computer forensics market ever since its inception
ASKER CERTIFIED SOLUTION
Avatar of dovidmichel
dovidmichel
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of hindmost
hindmost

You have got two problems to deal with, the first is that the catalog on the tape is basicly stuffed. This AFAIR is fairly simple to fix as a copy is stored on the server as well. The killer is if an eod was written to the tape. If it has then you are going to have to use a data recovery service to get anything after the eod on the tape. They use special tape drives that will ignore the eod and allow them to hoover off the remaining bytes and reconstruct the data. A standard drive will stop at the eod marker. You can find out if the eod was written using mtfcheck.exe from the windows 2000 resource kit. Further info can be found here: http://support.microsoft.com/default.aspx?scid=kb;en-us;256065
The vogon website also has an article which clearly explains the problem. http://www.vogon-international.us/tape-recovery-common-problems.htm

I've experimented a bit with a couple of different tape drives here and it's the drive itself not the software which stops at the eod. I had thought that using something like dd might have at least let you read the bits at a low level into a file and let you reconstruct it from that but no joy I'm afraid.
Hindmost,

I'm afraid that I don't fully understand you update.

This is my understanding of how it works:

EOD End Of Data should always be written to mark the end of the session. It is the EOD filemark that is used to append to tape. When appending to tape the application will have the drive space to the end of data and from there write a new session header.

EOM End Of Media on the other hand is the physical end of the tape and the drive can not read past that. Which is why there is a special trailer on the tape which will signal and Early Warning to the drive so the drive can tell the application the EOM is coming up soon and so that a continuation block can be written and the backup continue on the next tape.  

What I don't understand is how is it possible to ever append to tape if the drive does not have the capacity to read past the EOD filemark.

I'm not entirely sure I grok this either. I thought that was how they worked as well.

At the moment all I can say is that I can't get it to work. What appears to happen is that, as you have said, the tape drive seeks to the end of data in order to append further data. It then erases the eod and writes a new header. It can then add data and later read it but what I can't get it to do is space past an end of data and then read from the tape. From looking at the code involved it would seem to be a limitation (feature) of the drive firmware, I don't fully understand it (I'm looking through the source for linux drivers) but writing or erasure of eod seems to be hardwired into the firmware, as does the assumption that reads will complete at eod. Writes can erase an eod and the creation of a new header then allows appending. (I think the assumption is that spacing PAST the eod is nonsensical cos then you may end up with two eod's on the one tape) What is neccesary here however is that we don't create a new header in order to recover the data. Otherwise we are back at the same situation with a catalog which doesn't allow the recovery of files beyond the fried data.
regarding the assumption about the logic of spacing paste eod on reads I'm glarking that this is the case in order to prevent chaos when using non rewinding devices. You seem to not be able to space past an eod on either read or write, what the write operation at eod's first operation glarks as is erasing the eod. The design logic for having this hardwired into the drive(again an assumption at the moment) is that it's not subject to vagaries of OS or backup software design. However if anybody can correct me on this, as I may be dissapearing down a blind alley (up my own a***<g>) I'd be happy to be proved wrong.