±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35886
New Yesterday: 2 Visitors: 134

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Tape backup permissions

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Beetle
Senior Member
 

Tape backup permissions

Post Posted: Oct 22, 09 00:53

Does anyone have any suggestion(s) for dealing with the following situation?

- we have six backup tapes from what appears to be a Windows server

- we can "see" the files after cataloging the tapes in NTBackup, but cannot restore the files because of "Media has been secured. You do not have the proper privileges." failure.

- we can see the file data in hex but if we just dump the tape with dd we aren't in a position to auto-carve as we don't know what software created most of the files which appear to be from Macintosh systems. We are considering pulling out the data by extracting between the file marks if we have to, but that will be a killer effort (3x72gb tapes and 3x40 gb tapes).

- it looks like the security on the tapes was set by an administator on a domain controller so joining the Backup group won't work.

I tried the demo of MM/PC which seemed (it doesn't extract the actual data just writes out 'MMPC demo' in the 'recovered' file) to be able to pull the files out but it costs $40,000 per year for a "universal" solution.

I know Sanderson Forensics had software for tapes at one time but it doesn't appear on their site anymore.

Any suggestions would be welcome.  
 
  

roncufley
Senior Member
 

Re: Tape backup permissions

Post Posted: Oct 22, 09 01:47

I have sent you a pm
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 
 
  

mscotgrove
Senior Member
 

Re: Tape backup permissions

Post Posted: Oct 22, 09 02:45

The MM/PC should have a log file that will show the files that could be recovered. It should also have a signature flag in the log for common file types.

eMag will also offer a bureau service.

The non native restoration approach does often overcome the security issues built into backup packages.  
 

Page 1 of 1