• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 543
  • Last Modified:

How do I recover or recreate the .tsk files from a Spotmau file backup?

Good evening experts,
I have this wonderful software called Spotmau. I know , I know, a lot of you out there don't like the product, but it has worked for me on several occasions of restores in the past. Unfortunately, this is not one of those times. Here is the problem that I am encountering. when a backup is performed on a folder with files in them , Spotmau backs up the folder and its contents with a .data extension and a .tsk file as a pointer to the data. Example:

!
the other folders that I backed up , somehow are missing the .tsk file, so consequently , I cant restore. Example:

!
So, as you can see, there is no tsk file for the data files.

Please tell me there is a way to recover them or recreate the tsk files for the data I backed up.
0
BLACK THANOS
Asked:
BLACK THANOS
  • 13
  • 7
  • 3
2 Solutions
 
nobusCommented:
can you post a tsk file for examination?
0
 
BLACK THANOSAuthor Commented:
Of course
0
 
BLACK THANOSAuthor Commented:
I backed up my desktop.

here is the .tsk file for your examination.

I had to rename the .tsk file to .txt as experts-exchange doesn't support the uploading of that particular extension.
Just rename the ext back to tsk when you examine it Nobus (or anybody else that wants to take a crack at it).

Keep in mind that the whole reason I posted this question is that the .tsk files are missing from the data I backed up.
DESKTOP.txt
Desktoptsk.png
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
nobusCommented:
not much in it
maybe sleuthkit helps?  http://www.sleuthkit.org/
**note i don't know anything about it, just stumnled on it

maybe tsk  recover helps :  https://sysforensics.org/2012/04/the-sleuth-kit-part-5-recover-files-with-tsk_recover-and-icat.html

tsk_recover will extract the unallocated (or allocated) files from an image and save them to a local directory. This is useful if you deleted a bunch of files and want to recover them to a folder
0
 
BLACK THANOSAuthor Commented:
Hmm, looks interesting. I will investigate...
0
 
nobusCommented:
0
 
BLACK THANOSAuthor Commented:
Already tried recovery genius. It came as a part of the powersuitegolden_full809 that I purchased. I also have put in a support call to Spotmau before I came to this forum, but their service  leaves a lot to be desired. I haven't heard back from them in four days. Don't get me wrong, powersuitegolden_full809 has saved my bacon on numerous occasions, but until now I have not had to use the support system.
 
Thanks for your efforts nobus. I should call NOBLE as you have helped me solved issues in the past. I will wait a couple of more days to see if Spotmau support chimes in.
0
 
nobusCommented:
>>  I haven't heard back from them in four days  <<  be patient
i had a support question for Mustek, and it took more than a week to answer; but they gave a solution!

**you can always put in a second mail, to stir things up a bit
0
 
BLACK THANOSAuthor Commented:
I stirred things up with six emails and finally got a response, but not the one that I wanted. I was told, and I quote,

"Hi Mr. Hyde,
Thank you for your email.
Unfortunately the Spotmau program is no longer maintained and we do not have a good solution to resolve this fault. Sorry for that...
To compensate you for all the inconvenience and show our appreciation for your further cooperation, we would be happy to send you a product free of charge with a value up to USD $59.95. There are many kinds of software, such as Multi media, PDF, Business and Mobile on our website. Please have a look at this link: http://www.wondershare.com/#365 to see whether any product attracts you. If so, please tell us the product title, I will apply the free key code for you.
Again please accept our sincere apologies in this case."

Best Regards
Marina
Support Team
Spotmau Corporation
http://www.spotmau.com/#10250

So , in essence there is no solution and all of the backups that I performed using their software are useless and irretrievable with the .tsk file to go along with the .data files.  

Can you imagine how angry I am right now, as if the offer of free software is equitable compensation for the data I have
lost forever. How depressing.
0
 
BLACK THANOSAuthor Commented:
I meant : without  the .tsk file
0
 
nobusCommented:
you don't have an older version?
otherwise post another question, looking for spotmau owners with problems

very strange- they offer recovery for everything else ; but not for their own files? ?
http://spotmau-data-recovery-rescue-cd-usb.software.informer.com/
0
 
BillDLCommented:
Looking at the *.TSK file for your Desktop backup, I have my doubts that you will be able to recreate a missing TSK file by inspecting the *.DATA file.

It is basic XML tagged text, which is a fairly standard method for creating files that need to store settings, for example a playlist for audio files that is read by the program and retrieves values like album, artist, year, play length, etc.  XML files are also used as program configuration files, email contact *.VCF files (vCards), and a whole lot more uses.

Here's an extract from your file which covers 3 of the files in the Desktop backup.  I have changed the proper XML formatting and used sequentially indented lines for the different values to try and make it easier to follow visually:
<Backup remark=""
	data="D:\DESKTOP(2014-07-17)\DESKTOP.data"
		depend=""
			time="2014-07-17 00:14:20">

<Dir name="C:\Users\B&amp;G-Admin\Desktop">

<File speed="rapid"
	data_part="0"
		name="C:\Users\B&amp;G-Admin\Desktop\xat.com Professional Image Optimizer.lnk"
			size="1126"
				start="700516916"
					data="D:\DESKTOP(2014-07-17)\DESKTOP.data"
						modifyTime="2014-06-05 17:34:55"
							attribute=""/>

<File speed="rapid"
	data_part="0"
		name="C:\Users\B&amp;G-Admin\Desktop\xat.com Image Optimizer.lnk"
			size="1121"
				start="700515795"
					data="D:\DESKTOP(2014-07-17)\DESKTOP.data"
						modifyTime="2014-06-05 17:34:55"
							attribute=""/>

<File speed="rapid"
	data_part="0"
		name="C:\Users\B&amp;G-Admin\Desktop\WM Recorder 14.lnk"
			size="955"
				start="700514840"
					data="D:\DESKTOP(2014-07-17)\DESKTOP.data"
						modifyTime="2014-05-29 12:07:23"
							attribute=""/>

Open in new window


The first two blocks of tags are fairly easy to understand, but unfortunately I don't know what the   depend=""   value could be used for because in this case it doesn't have a data value.

Each file that is packed into the single *.DATA file starts with a   <File speed>   tag.  It could be that this is the value that dictates a specific compression level or algorithm in a similar manner to the different methods available to WinZip, WinRAR, 7-Zip, etc.  I would guess that this is important for the program to know when restoring the backup or else they wouldn't have included a superfluous value.

Looking at your Music backup screenshot I see that the *.DATA filenames are suffixed with an ascending number starting from Zero.  I assume that the   data_part="?"    value refers to which *.DATA file the backed-up file is packed into.  In this case you only have a "DESKTOP0.data" file, so all the files tagged in your XML file will refer to data_part="0".  The problem in reconstructing a TSK file would be knowing which of the *.data files each of the backed-up files was packed into.

The "name" value speaks for itself.  It is the fully qualified path where the file existed and where it would be restored to.

The "modifyTime" and "attribute" values will be specified so that the files can be restored as they were.

One thing that does puzzle me is the
data="D:\DESKTOP(2014-07-17)\DESKTOP.data"
value.  Is this the path to a *.DATA file, or to a folder named DESKTOP.data?
It isn't apparent from your earlier screenshot.

OK, now to the nitty-gritty.  Exactly where does the program find the files in the backup.  Each of the files listed is given a file size and starting position within the respective *.DATA file.

size="1126"   start="700516916"
size="1121"   start="700515795"
size="955"    start="700514840"

Your DESKTOP0.DATA file is shown in Windows Explorer with a file size (ON DISC) of 684,100 KB = 700518400 bytes.

It is fair to assume that the "start" values are a step-by-step walk through the *.data file with what almost amounts to a "track number" markers in bytes from the start of the file.  The difference between the size of your file as shown in Windows Explorer and the starting point of the first file in it, as given in the TSK file, is probably just down to the different values of file size you see in a file's "Properties" dialog.

The problem I have is that the file size and start values don't add up and coincide with the start value of the next file in the backup.

700516916 + 1126 = 700518042

The starting position of the next file in the backup *.data file is 700515795, not 700518042.  How can the start position be less than the sum of the file size and the starting position of that particular file?

I think that only the Spotmau program will be clever enough to know how the files are indexed, and I don't think you would stand a chance of constructing a new TSK file from scratch even if you were able to find out the distance through the DATA file each file began.

You also have to be careful in searching for programs that purport to recover TSK files.  Firstly I would imagine that the *.TSK file extension has probably been used by a number of different programs, and secondly there are unscrupulous sites that take key words from your search and inject them into a page so that it looks as though you have found a program that handles the exact file extension you are asking about.

Suggestion

Have you tried renaming a copy of your *.DATA file to *.ZIP to see whether 7-Zip (more comprehensive than WinZip) can unpack the file?

I would really like to get a look at the file header data of a *.data file created by this program, as it may yield some useful information about how the archive has been compressed.  One program that may be able to gives some detail is TrID:
http://mark0.net/soft-trid-e.html

I use a program named Universal Extractor (which also uses the TrID database of file extensions and headers) to unpack odd-ball archives.  Who knows, it might just work:
http://legroom.net/software/uniextract
I would suggest using the "portable" version referred to as "UniExtract Binary Archive" with the download link.
0
 
nobusCommented:
hey, tx Bill for jumping in !
0
 
BLACK THANOSAuthor Commented:
That was a text full of information and very valuable for future reference Bill. All information is valuable. However, I've already tried re-naming the extension from .tsk to .zip, .rar, .b1, etc.....

I believe you hit the nail on the head Bill ( You too Nobus ) , that only the program (Spotmau) will be able to recognize or re-construct it's own version of a .tsk file. During my searching, I found several programs purporting to repair or recreate .tsk files , but they were all referencing something other than Spomau's .tsk extension. The reality is that Spotmau no longer supports their product, so I am just going to move on to another product similar to it. I had a great run with Spotmau and am sad to find out it is no longer supported or even updated.  You guys, put so much effort in helping me figure this out , that I believe it's important to make this thread public so others who use Spotmau can make informed decisions about the continued use of the software. The two of you rightly deserve the points, because the solution is to be aware of Spotmau's shortcomings.
0
 
BLACK THANOSAuthor Commented:
By the way Nobus, I also own versions of Spotmau from 2007, 2010, and 2012. Believe me, I tried the recovery from each version.
0
 
BLACK THANOSAuthor Commented:
Thank you gentlemen.
0
 
nobusCommented:
may i ask - if you ever tried to put back a generated backup from Spotmau?
it may have been bad from the start
for image backups, i use paragon's free B&R now : http://www.paragon-software.com/home/br-free/download.html
0
 
BillDLCommented:
Thank you REGISHYDE
0
 
BLACK THANOSAuthor Commented:
I have restored hundreds of backups from Spotmau and in those occasions the .tsk files were there and everything went quite normal.
0
 
BillDLCommented:
I know this is going to sound VERY simplistic, but is there any possibility that the *.TSK files have the "hidden" attribute, and that something has changed your Windows Explorer Folder Options > View setting to the default so that it does not show hidden and system files?

I doubt it highly, but stranger things have happened.  We sometimes look for the complicated solution when there is something far more obvious escaping our attention.

Just out of curiosity I pulled all the values of the nineteen "size=" tags from the DESKTOP.TSK file you attached earlier.

1126
1121
955
1165
1198
104566
2220
21395592
371813880
957
1088
1011
2300
282
68764024
203
3410
237099936
1323008

Assuming the values are in bytes, Total = 487128042 bytes
Convert bytes to KB: 487,128,042 / 1,024 = 475,711 KB (rounded up)

The DESKTOP0.data file shows in your screenshot as having a file size of 684,100 KB, and therefore appears to be a LOT larger in file size than the sum of the sizes of all the files packed into it.  So not only does there appear to be no file compression involved here (possibly dictated by the <File speed="rapid"> tag value), but there is also some extraneous "padding" in the backup file for whatever reason.

I had hoped that perhaps the combined file sizes of the contents might be a close match to the file size of the *.data file, in which case any very small overhead might simply have been that occupied by the file header data, and that extraction of the contents might have been simplified somewhat due to lack of an extra compression layer.  Clearly there is a lot more to the structure of the *.data file that I (we) cannot really ascertain.  According to my calculations, although Maths was never my strong point, the on-disc size of the *.data file is something like 200 MB larger than the expected size of the contents.

I would normally have opened the *.data file in a Hex Editor to see if that yielded any clues about the structure, in particular if it showed a 3 or 4 letter acronym or a recogniseable Hex String as the file type identifier right at the start, but at 668 MB the file isn't something that you could quickly upload somewhere for us to download and inspect.

I looked at the current file type database used by Marco Pontello's TrID program (http://mark0.net/soft-trid-deflist-d.html).  It doesn't list any *.DATA file extensions, the nearest being *.DAT, but one of these stuck out:
DAT - Runtime Software compressed disk image

Runtime Software is the company that sell the excellent data recovery program named GetDataBack.  The reason that this one stuck out to me, amongst all the other DAT file extensions, is simply because of that XML-formatted file and because I remembered that this company also have a drive imaging application named DriveImage XML that saves the drive images as RAW format.      

According to online sources, the Hex String in the header data for the Runtime Software DAT files is:  1A 52 54 53 20 43 4F 4D 50 52 45 53 53 45 44 20
I would be very curious to see whether this appears at the top when a *.DATA file created by the Spotmau backup program is opened in a Hex Editor.

I see that Marco Pontello has an "online TrID File Identifier" here:
http://mark0.net/onlinetrid.aspx
I would imagine that there will probably be a file size limit, in which case it would be better just downloading the standalone EXE and most recent *.TRD definition file.  Links down near the bottom of the page: http://mark0.net/soft-trid-e.html

Just to reiterate my thoughts though, I think you will probably be peeing into the wind with this.
0
 
BLACK THANOSAuthor Commented:
To your credit BillDL,  we were thinking along the same lines in terms of investigating the .data files forensically with a hex editor. Also , I looked at data recovery options before I posted here and GetDataBack was at the top of the list as they do have an extension .DAT that seemed promising, but alas, this software was also a dead end. however, you have giving some very good information to look into , so I am not discarding my drive or re-formatting it. All of your suggestions  will take some time on my part to try. As I often say, all information if valuable.  My thanks and regards,

Regis T. Hyde , BSB/IS, MIS, Doctoral Learner (DM/IST).
0
 
BLACK THANOSAuthor Commented:
BillDL

I also checked the properties of the folder. I changed the properties to not hide system files, hidden files, empty directories, or extensions:


!
0
 
BLACK THANOSAuthor Commented:
Thank you for your expertise.

Regards,
Regis
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 13
  • 7
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now