Solved

Backup Exec tape partially overwritten (a few Mb) - can I recover data from previous backup?

Posted on 2004-03-30
8
3,140 Views
Last Modified: 2013-12-01
We have a Data Server running Win 2k Server, with Backup Exec v.8.6 backing up files stored locally on the server on a nightly basis (assuming someone remembers to swap tapes when I'm not around).  Our tape rotation system is very simple and we use 'overwrite media without prompting' to simplify unattended backups.  ('Bad idea' someone will probably tell me).

Having lost a number of important files from the data server (user error - not me I hasten to add!) I was attempting to restore from the most recent backup tape.  Unfortunately, I didn't realise a previously scheduled backup had not happened, and when I inserted the tape, the scheduled backup immediately started.  I cancelled the operation as soon as I realised, but around 40Mb of data had been written to the tape.

I have attempted to rebuild the catalog on the tape using the Device: Inventory: Catalog option, but this simply gives me the catalog of the new, aborted backup.  Is there any way of recovering files from the previous backup, which presumably still exist in some form?  The original backup was around 20Gb of data - the files we need are just a few Mb of Excel spreadsheets.

TIA,

Carl
0
Comment
Question by:carlsmethurst
  • 3
  • 2
8 Comments
 
LVL 44

Expert Comment

by:CrazyOne
ID: 10714417
Quite honestly I don't know if the following work with tape of not

Take look at these.

FREE TOOLS

PC INSPECTOR
http://www.pcinspector.de/file_recovery/UK/welcome.htm
File Recovery is a data recovery program that supports the FAT 12/16/32 and NTFS file systems. The current version 3.x replaces the previous version 2.x, which is now over 6 years old.

Restoration
http://hccweb1.bai.ne.jp/~hcj58401/REST2514.EXE
For 9x/NT/2K/XP. Restore deleted files that are no longer in the Recycle Bin!

Tool to check and undelete partition
Works with the following partitions:
- FAT12 FAT16 FAT32
- Linux
- Linux SWAP (version 1 and 2)
- NTFS (Windows NT)
- BeFS (BeOS)
- UFS (BSD)
- Netware
- RaiserFS
http://www.cgsecurity.org//testdisk.html
-------------------------------

NOT FREE

EasyRecovery DataRecovery is a simple, yet powerful tool that recovers data that is lost, inaccessible or deleted. It's the ultimate do-it-yourself solution for nearly all causes of data loss (except physical hardware or system problems) where your hard drive and system are fully functional.
http://www.ontrack.com/easyrecoverydatarecovery/

File Rescue 2.5
Web:http://www.file-rescue.com/

GetDataBack for FAT
GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, FAT, or root directory have been damaged by a virus, formatting, fdisk or power failure. GetDataBack can even recover your data when the drive is no longer recognized by Windows.

GetDataBack for NTFS
Recover your files when the data is no longer accessible due to formatting, fdisk, virus attack, power or software failure. Get everything back even when the drive's partition table, boot record, Master File Table or root directory is lost or corrupt.
Hard Drives
Partitions
Floppy Drives
Drive Images
Zip/Jaz Drives
http://www.runtime.org/

Norton Utilities/SystemWorks
The Norton Protected Recycle Bin helps you recover deleted and overwritten files.
The UnErase wizard helps you retrieve files you've accidentally deleted.
http://www.symantec.com/nu/nu_9x/features.html

For NTFS
http://www.restorer2000.com/r2k.htm

Data Recovery
http://www.dtidata.com/
Fast File Undelete
http://www.dtidata.com/products_ff_undelete.asp

Undelete
http://www.quantumsoft.co.uk/undelete.stm

File Recover 2000
http://www.filerecover.com/

R-Tools
http://www.r-tt.com/

File Restore
If you've deleted your data and you want to get it back, you need FileRestore.
FileRestore is a simple, easy-to-use tool for recovering files that have been lost or deleted from your Windows system. Designed for Windows XP, 2000, NT, Me, and 9x
http://www.winternals.com/products/repairandrecovery/filerestore.asp.

Hard Disk and Data Recovery Related Tools:
The DiskPatch tool supposedly can rebuild the File System structure depening on the damage to the structure.
http://www.diydatarecovery.nl/

ERD Commander
Key features:
Boots dead systems directly from CD
Easy, familiar Windows-like interface
Includes the Locksmith utility to reset lost Administrator passwords
Includes FileRestore so that you can quickly find and recover deleted files
Provides access to XP Restore Points on unbootable Windows XP systems
Compares key info on unbootable systems with that of a working system for diagnosis and trouble-shooting
Allows for formatting and partitioning of disks
Built-in network access to safely copy data to/from dead systems
Repair and diagnostic tools located on Start menu
Repair tools include Service and Driver Manager, Locksmith, FileRestore, Registry Editor, Explorer, Disk Management, and Command Prompt
Diagnostic tools include the System Compare, Event Log Viewer, System Information, TCP/IP Configuration, and Logical volumes utilities
Compatible with Windows NT, 2000, XP, and Server 2003  
http://www.winternals.com/products/repairandrecovery/diskcommander.asp

DFSee
http://www.dfsee.com/
As a tool to 'UNDELETE' files that have been accidentaly deleted.
This feature is implemented for HPFS and NTFS only.

MRECOVER
http://kristenonline.com/lain/cih/mrecintro.htm

Emergency Undelete
I believe this is free
For Win2000 and NT may work on XP
http://www.c2000.com/software/#win2000

Back2Life
http://www.simtel.net/pub/pd/57588.html

Hard Drive Mechanic
http://www.highergroundsoftware.com/6.html
It's true. Even if you just re-formatted your entire hard drive, you can still get all of your data back because, unlike what most people believe, formatting does NOT erase your files! With Hard Drive Mechanic's Unformat Feature, you can restore all of your valuable data in about 10 minutes!
demo version:
http://www.highergroundsoftware.com/downloads2.htm

Filerecovery for Windows
http://www.lc-tech.com/filerecovery.asp
Filerecovery for Windows® is a safe and affordable do-it-yourself data recovery solution that is designed to recover deleted files from all types of media such as Hard Drives, Floppy Drives, SmartMedia, CompactFlash, Memory Sticks, and other types of removable media.

Undelete
http://www.executive.com/consumer/undelete/undelete.asp
You know how upsetting it is to accidentally delete a file that you need—it takes just a moment to lose hours of work. Undelete file-recovery utility captures ALL deleted files including those that typically bypass the Recycle Bin. You can even recover files you purged from our Recovery Bin. With our Emergency Undelete feature, you can recover files deleted prior to Undelete being installed on your system (provided they have not been written over). Buy Undelete and you'll never again be at the mercy of lost data.

Fast File Recovery
http://savemyfiles.com/fastfile.htm
A definite must for the PC guru! It will allow the user to perform all data recovery tasks associated with disks which are not physically damaged.

File Scavenge
http://www.quetek.com/prod01.htm
File Scavenge is the most comprehensive, award-winning file undelete and data recovery for NTFS volumes on Windows NT, Windows 2000 and Windows XP.

Active UNERASER
http://www.uneraser.com/undelete.htm
Active UNERASER is a compact and powerful undelete utility that can recover deleted files and folders on FAT12, FAT16, FAT32 and NTFS systems. It can even restore files from deleted and re-formatted partitions.

Undelete 3.0
http://www.pcconnection.com/scripts/productdetail.asp?product_id=309884
Undelete 3.0 restores accidentally deleted files within seconds from anywhere on your system. Version 3.0 includes new SecureDelete, full Windows XP support and expanded search options.

FinalData Data Recovery
http://www.finaldata.com/
FinalData Data Recovery Solution will recover files that have been lost by   quick formatting, FDISK, FAT damage, MBR damage or directory   destruction. It recovers data from FAT12/16/32, NTFS, and EXT2, EXT3.

File Rescue Plus
http://www.file-rescue.com/
Recover Accidentally Deleted Files and Pictures Quickly and Easily — Even from Quick Formatted or Virus Damaged Drives!  
Runs on Windows 95-98-ME-XP-NT-2000-2003 Server or Workstation
Scans FAT 12/16/32/NTFS, Flash, Compact, Smart, Secure Digital, Memory Stick
Recognizes: Hard Drives, Floppy, Zip, Syquest, Ditto, Digital Cameras, etc...

Oops — you've accidentally deleted the file that contains key data that you need right away! You've lost all the pictures you just downloaded from your digital camera!

What do you do?

Just run File Rescue Plus! Simply scan the disk and choose the files you want to recover. It's that simple!

Your computer contains a lot of key information — financial data, addresses, phone numbers, legal documents, important photographs and much more. And face it, mistakes do happen!
 


BadCopy Pro
http://www.jufsoft.com/badcopy/
BadCopy Pro is a leading data recovery tool for floppy disk, CD-ROM, CD-R/W and other storage media. It can effectively recover and rescue corrupted or lost data from damaged, unreadable or defective disks. Various damage situations and all file types are supported.

Directory Snoop
http://www.briggsoft.com/dsnoop.htm
Directory Snoop is a low-level forensic utility that can recover erased files in an emergency, wipe sensitive data, and search for hidden data at the cluster level. Step through your File Allocation Table (FAT) and map individual clusters back to the file that owns them. Purge orphaned (and possibly sensitive) file names right out of the directory structure. $29 shareware for Windows 95 through XP (NTFS drives not supported).

others
Active@ UNDELETE will help you to restore data residing drives formatted in FAT12, FAT16, FAT32, NTFS, NTFS5 file systems and it works under all Windows family operating systems: Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000 and Windows XP.
http://www.active-undelete.com/

http://ssl.oosoft.de/en/products/ooue/

Undelete & Recover deleted files from your FAT 12/16/32 Hardisks
http://www.tipsdr.com/recover-data-recovery.html

http://www.recovermyfiles.com/

------------------------------------
Or Data Recovery Services

http://www.ontrack.com/datarecovery/
Ontrack offers a full range of data recovery solutions to address your data loss needs. Unlike other data recovery companies, Ontrack provides exclusive and patented solutions that do not require you to send in your media for recovery. In situations where the hardware is functioning normally, our patented Remote Data Recovery service and EasyRecovery software solutions can solve your data loss needs safely and effectively in a matter of hours. If another company claims that there is no alternative to shipping your drive, it's because they don't offer an alternative. For situations in which the hardware is physically failing, our In-Lab services will utilize our Class 100 clean-rooms to retrieve your mission critical data.

or

FLAT RATE DATA RECOVERY PRICING INCLUDES!
http://www.i-t-s.com/datarec/datarec_pricing.htm

or

Total Recall
http://www.recallusa.com/
Our recovery and forensic technology is used by support and call centers as well as data recovery providers world-wide.

ESS Data Recovery
http://www.savemyfiles.com/
ESS Data Recovery, Inc. has been removing barriers in the data recovery and computer forensics market ever since its inception
0
 
LVL 22

Accepted Solution

by:
dovidmichel earned 500 total points
ID: 10715217
The header is the key. Once the old header was overwritten the program no longer has the capability to see any of the old data.

Here is the only program that I know of that might enable you to restore the old data. If it will not work then the only other option I know of is a Data Recovery service.

http://www.emaglink.com/MMPC.htm

MediaMerge for PC (MM/PC)
Handling 1000's of tape format variations, MediaMerge/PC is the world's leading PC tape I/O software package, and it brings a plethora of capability to the management and manipulation of data residing on tapes, optical disks, CD�s or hard drives. This Windows based software is compatible with 95, 98, 2000, NT, and XP, and it connects via SCSI to the tape drive. In its standard format MM/PC has a huge array of capabilities, but there are also some authorization-coded modules for more specialized work or advanced features.

Restore Tape Backups from any Source
With MediaMerge/PC any PC with a suitable tape drive and SCSI adapter can restore backup tapes from almost any source. It does not matter if the tape was generated using ArcServe, Sytos Plus, Mountain backup, NT Backup, Backup Express, Unix, VAX/VMS backup or any other formats. MM/PC will read the tapes, and the restore process is extremely simple. The type of tape is recognized automatically, and either a directory of the original files will be displayed or an option to restore the entire file may be given. Typically all subdirectories and full-length file names will be retained. Having a very simple standard interface and no knowledge of the original backup package is required.
0
 
LVL 2

Expert Comment

by:hindmost
ID: 10729205
You have got two problems to deal with, the first is that the catalog on the tape is basicly stuffed. This AFAIR is fairly simple to fix as a copy is stored on the server as well. The killer is if an eod was written to the tape. If it has then you are going to have to use a data recovery service to get anything after the eod on the tape. They use special tape drives that will ignore the eod and allow them to hoover off the remaining bytes and reconstruct the data. A standard drive will stop at the eod marker. You can find out if the eod was written using mtfcheck.exe from the windows 2000 resource kit. Further info can be found here: http://support.microsoft.com/default.aspx?scid=kb;en-us;256065
The vogon website also has an article which clearly explains the problem. http://www.vogon-international.us/tape-recovery-common-problems.htm

I've experimented a bit with a couple of different tape drives here and it's the drive itself not the software which stops at the eod. I had thought that using something like dd might have at least let you read the bits at a low level into a file and let you reconstruct it from that but no joy I'm afraid.
0
Google Storage: Standard vs. Nearline vs. Coldline

Google Cloud Storage has a number of classes to choose from. Although there are a lot in common, they vary in price and usage terms. This post explains Google Cloud Storage classes and helps to understand which  one to choose.

 
LVL 22

Expert Comment

by:dovidmichel
ID: 10734724
Hindmost,

I'm afraid that I don't fully understand you update.

This is my understanding of how it works:

EOD End Of Data should always be written to mark the end of the session. It is the EOD filemark that is used to append to tape. When appending to tape the application will have the drive space to the end of data and from there write a new session header.

EOM End Of Media on the other hand is the physical end of the tape and the drive can not read past that. Which is why there is a special trailer on the tape which will signal and Early Warning to the drive so the drive can tell the application the EOM is coming up soon and so that a continuation block can be written and the backup continue on the next tape.  

What I don't understand is how is it possible to ever append to tape if the drive does not have the capacity to read past the EOD filemark.

0
 
LVL 2

Expert Comment

by:hindmost
ID: 10737151
I'm not entirely sure I grok this either. I thought that was how they worked as well.

At the moment all I can say is that I can't get it to work. What appears to happen is that, as you have said, the tape drive seeks to the end of data in order to append further data. It then erases the eod and writes a new header. It can then add data and later read it but what I can't get it to do is space past an end of data and then read from the tape. From looking at the code involved it would seem to be a limitation (feature) of the drive firmware, I don't fully understand it (I'm looking through the source for linux drivers) but writing or erasure of eod seems to be hardwired into the firmware, as does the assumption that reads will complete at eod. Writes can erase an eod and the creation of a new header then allows appending. (I think the assumption is that spacing PAST the eod is nonsensical cos then you may end up with two eod's on the one tape) What is neccesary here however is that we don't create a new header in order to recover the data. Otherwise we are back at the same situation with a catalog which doesn't allow the recovery of files beyond the fried data.
0
 
LVL 2

Expert Comment

by:hindmost
ID: 10745029
regarding the assumption about the logic of spacing paste eod on reads I'm glarking that this is the case in order to prevent chaos when using non rewinding devices. You seem to not be able to space past an eod on either read or write, what the write operation at eod's first operation glarks as is erasing the eod. The design logic for having this hardwired into the drive(again an assumption at the moment) is that it's not subject to vagaries of OS or backup software design. However if anybody can correct me on this, as I may be dissapearing down a blind alley (up my own a***<g>) I'd be happy to be proved wrong.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

How to update Firmware and Bios in Dell Equalogic PS6000 Arrays and Hard Disks firmware update.
VM backup deduplication is a method of reducing the amount of storage space needed to save VM backups. In most organizations, VMs contain many duplicate copies of data, such as VMs deployed from the same template, VMs with the same OS, or VMs that h…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now