±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 0
Overall: 26790
Visitors: 49

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Recover deleted data from backup tapes?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 
  

Re: Recover deleted data from backup tapes?

Post Posted: Wed Nov 28, 2012 4:55 am

Data can be recovered from backup tapes also as recovered from hard disk. There are software available on Internet which claims recovering data from backup tapes. Why don't you download and try a software yourself. Here i suggest you to give Kernel for Tape data recovery software a try. I have used data recovery software from the same vendor and that worked like a charm for me.  

Last edited by MarkAlto800 on Wed Nov 28, 2012 11:14 pm; edited 1 time in total

MarkAlto800
Newbie
 
 
  

Re: Recover deleted data from backup tapes?

Post Posted: Wed Nov 28, 2012 7:13 am

I would be very wary of software that claims it can recover from "despooled and broken tapes".

Although the demo offer seems good, I would again be wary. I did some work for a governmenrt agency who had used third party software. That software missed 70% of the files on some of the tapes and of the files it did recover 50% were corrupt.

Also they dont mention archive software - do they support backup exec, arcvserve (loads of variants), netbackup etc. - the BIGGEST problem with tapes is not the physical media but rather the format of the data on the tape.

They could simply be doing file carving and to a layman this might sound like a good idea as files are assumed to be written to tape sequentially. However some archive softare embeds small checksum data structures thoughout files, also other such as netbackup allow you to stream data from multiple machines, in this case files can be, and usually are, very fragmented.

No axe to grind here as I don't sell my tape tools - buyer beware etc. - too many oddities with the advert for me to trust it.
_________________
Paul Sanderson
SQLite Recovery - find and recover deleted sqlite dbs
sandersonforensics.com...e-Recovery
www.twitter.com/sandersonforens
www.facebook.com/recon...resoftware 

PaulSanderson
Senior Member
 
 
  

Re: Recover deleted data from backup tapes?

Post Posted: Wed Nov 28, 2012 7:46 pm

Well as luck would have it I have the tapes here many of which are showing as blank. Evidence at hand suggests they have held data previously so I will download the demo and see what it can do.

If it recovers anything at all from the tapes then given how cheap it is I'll be buying a copy

If it recovers nothing then well...I won't Smile

Edit - Well that was a short lived test Laughing downloaded the trial version and it didn't recognise my backup tape drive at all. I checked and it had no windows drivers associated with it (Backup Exec uses it's own drivers). So I installed windows drivers and the software recognised the tape drive, recognises the tape I put in and accurately reports it's size. I click on "make image" which is the first step in data recovery, and instantly it reports "no data available"

Test conclusion, does not do what it says on the box = me not purchasing software

I tried to create an image of a tape which has data on it I've successfully recovered already with Backup exec, but now the software won't detect the tape no matter what I do. Seems very buggy and if it can't take an image of a wiped/blank tape then try and recover data seems a bit pointless really.
 

Adam10541
Senior Member
 
 
  

Re: Recover deleted data from backup tapes?

Post Posted: Thu Nov 29, 2012 3:48 am

You can't recover from a wiped tape using software. The firmware in the drive will prevent you reading passed the end of data marker (EOD) an dEOD on blank/wiped tape is at the beginning of media (BOM).
_________________
Paul Sanderson
SQLite Recovery - find and recover deleted sqlite dbs
sandersonforensics.com...e-Recovery
www.twitter.com/sandersonforens
www.facebook.com/recon...resoftware 

PaulSanderson
Senior Member
 
 
  

Re: Recover deleted data from backup tapes?

Post Posted: Thu Nov 29, 2012 7:22 pm

So the claim on the website, that they can recover data from "Tape Drives have been erased."

Would appear to be either a blatant lie, or they have sipped the word "drives" in there so they can say "we were talking about the tape drive not the tape" haha.

Paul, that was my understanding as well but thought maybe they had figured some sneaky way to trick the drive into just imaging anyway, but as the software can't even recognise a tape that has live data on it the tool is clearly not worth any more of my time and certainly not my money Smile  

Adam10541
Senior Member
 
 
  

Re: Recover deleted data from backup tapes?

Post Posted: Fri Nov 30, 2012 10:24 am

There are a few very old tape drives you could read 'deleted data'. Open reel is one. However, all helical scan drives I have seen, and every other drive produced probably in the past 15 years can not be read without very specialised techniques. The techniques are very closely guarded by companies that may charge $5K to read a tape.

As Paul says, reading the physical tape may only be part of the story, logical variations, and local configuration issues are enormous.
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 2 of 2
Go to page Previous  1, 2