asked on

Does anyone recognize the tape drive header?

Does anyone recognize this tape header and what was used to create the tape?

ASKER CERTIFIED SOLUTION

David Favor

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Dave Mohyla

ASKER

Hi David,

I have already performed a dump via Linux, that is what we are looking at. I can recover files in a forensic format to some extent. The tape was made in 2003. It does not look as if NTbackup made it the MTF begins with TAPE, and it does not have a Veritas header.

David Favor

2003... The format sure looks like some very old OS. The H: looks vaguely Microsoft-ish.

The \\FSERV2 looks like some other OS, without camel case support.

Whew... If the output you provided really is the first tape block + you get no read errors (indicating first block is corrupted), it's unclear.

No search I did turns up any listing of backup tape format which looks like your first block.

Good luck. Looks like decoding this tape may be a long process.

Dave Mohyla

ASKER

Thanks David,
It does look odd!
Thanks for your input!

Dave Mohyla

ASKER

I do believe this was a Microsoft based server and the tape also backed up a network share. I can see standard MS directory hierarchy at text in the images.

Gerald Connolly

Can do that dump but in hex it might make more sense

Member_2_231077

caroot = [Computer Associates] Arcserve admin account name.

Member_2_231077

I disagree, CAROOT implies ARCSERVE, no ifs or buts on that score.

David Favor

Marked my answer as best, since it covers generic tape dumping + debugging, which seems to be required to resolve this issue.

Member_2_231077

>Vaguely resembles CPM Disk dump... I could be wrong...

At least you got one bit right ;)