±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 13
Overall: 26773
Visitors: 87

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Arcserve

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Arcserve

Post Posted: Thu Jun 18, 2009 11:35 am

Hi

Does anyone know the format of the arcserve tape header? In particular I am looking for the creation date.

Thanks
Ron
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics 

roncufley
Senior Member
 
 
  

Re: Arcserve

Post Posted: Fri Jun 19, 2009 5:30 am

Just in case anyone is interested I now know the answer: starting at offset (decimal) 365 in the header is a date time string in C format.
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics 

roncufley
Senior Member
 
 
  

Re: Arcserve

Post Posted: Fri Jun 19, 2009 5:57 am

Thanks Ron, useful if someone's searching the forums in future - appreciate you taking the time.

Jamie  

jamie
Site Admin
 
 
  

Re: Arcserve

Post Posted: Fri Jun 19, 2009 6:28 am

Keep in mind that this will only give you the Tape Header - there can be multiple sessions within the tape.  

IanF
Senior Member
 
 
  

Re: Arcserve

Post Posted: Sun Jun 21, 2009 3:56 am

- IanF
Keep in mind that this will only give you the Tape Header


Er, yes, but that was what I was looking for.

From your answer I presume that you know the full format of the tape headers and the session headers, it would be most useful if you would share your knowledge with the rest of us.
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics 

roncufley
Senior Member
 
 
  

Re: Arcserve

Post Posted: Mon Jun 22, 2009 2:33 am

I see you have your answer.

You should have fun with ARCserve especially when you get to embedded SIDF data streams (System Idependent Data Format - otherwise known as Sanity Independent Data Format). ARCserve was my biggest headache when dealing with tapes - the format changes subtly between versions.
_________________
Paul Sanderson
SQLite Recovery - find and recover deleted sqlite dbs
sandersonforensics.com...e-Recovery
www.twitter.com/sandersonforens
www.facebook.com/recon...resoftware 

PaulSanderson
Senior Member
 
 
  

Re: Arcserve

Post Posted: Mon Jun 22, 2009 6:07 am

- roncufley


Er, yes, but that was what I was looking for.

From your answer I presume that you know the full format of the tape headers and the session headers, it would be most useful if you would share your knowledge with the rest of us.


Sorry Ron - I was probably just pointing out the obvious. Embarassed I'm sorry to say that I haven't done any work with Arcserve in years and that was as a sysadmin - so I can't help with the full format. Just had fun in the distant past with corrupt headers etc.  

IanF
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next