LTO Tape Duplicator recommendations + Imaging questions
Hello Forensic Focus people.
I've recently started a new job where I've been tasked with Cloning and then imaging 43x LTO-3 Tapes.
I've done some research and I found the following product https://www.storageheaven.com/TapeMaster-LTO-Data-Tape-Copier-p/1099.htm
It is a standalone device, however the cost of it is around £11,000
The individual internal Tape drives retail from around £1200 to £1500 depending on the version.
Has anyone had any experience with such a product? I'm currently thinking of building a custom PC that has 2x LTO 3 drives in it and using that to do the cloning. I could build this for more than half the cost of the unit.
This would then allow us to purchase an additional 2x Drives of LTO6-7 for considerably less than what that item is listed at for the future.
So my questions are
Anyone used a standalone LTO tape duplicator? If so, which and would you recommend it?
Has anyone built a custom PC with 2x LTO drives, cloned the tapes and what are your experiences?
I'm working on a very large case and therefore quality over speed is definitely required.
And my last question is what methods you would recommend for actually imaging the tapes? Software recommendations and methods. We will probably go down the route of DD images of the drives, but I'm interested to hear back from anyone that has experience of such a task.
What backup software was used to create the tapes? I would suggest just using that to make copies. i.e. BackupExec has a "Duplicate" job that will do a Tape-to-Tape copy, and you also run Tape-to-Disk jobs to create *.BKF files. I prefer doing tape to disk copies so that any future searching and restoration can be done without spending time swapping out tapes.
If you're looking for something that copies the entire tape (i.e. getting unused space, doing recovery, etc..) try this https://www.kerneldatarecovery.com/tape-recovery.html. Keep in mind backups from this software cannot be easily placed back on new tapes, and the files won't be usable/readable by backup software.
Yes, I would see a bigger issue with the actual software than with the hardware.
Personally I wouldn't build a "custom" PC, I would look more for a "normal" PC of the exact period the tapes were recorded, making sure it runs the exact same OS and backup software and add to it the LTO tape drives.
Also it depends if you have to make a "copy" or a "clone", there are some caveats (implicit in the way the data is stored on tape) that may be relevant, see
And, maybe the idea of replicating the data on tape might be a good one or a not-so-good one. check
I wouldn't bother duplicating them and you can't really image tape like a HDD.
I'd buy some very large HDDs. Create a new partition and NTFS volume on the 1st disk of the same size as the 1st tape. Restore the first tape to that volume. After restoration, try and shrink the partition as much as you can. Once you have done that create a 2nd partition and restore the 2nd tape to that. Keep adding partitions and restoring tapes to the disk until there isn't enough space on the disk to restore any more tapes. Create a forensic backup of this disk (image it to E01 etc.) then bag and tag the disk. Restore the remaining tapes to further disks bagging and tagging them as you go.
Alternatively, after creating a forensic backup, wipe the disk and reuse it to restore the rest of the tapes. It really depends if you want to exhibit the disks you restored to or if you are happy just keeping from the disk images you made of them.
You need to figure out what software they used to do the backups onto tape and use the same software to do the restoration.
You mention with what you have been tasked with doing, but can you elaborate on the desired end result? It sounds as if you might not need to so what you were requested to do if there is (and there most likely is) a simpler path to the end result.
Cloning tapes, as you know, simply gets you another copy of the tape. Are two copies needed?
LTO tapes have a tab on them which allows for the tapes to be inserted into the drive in Read Only mode. If your customer's desire for a clone copy is to preserve the source data, they are simply adding costs to the project. If they are concerned about how the tapes were originally stored and would like a backup copy because of fear of losing the data from the source tapes, then it might be money well spent.
The next step you identified is "imaging" the tapes. Data is written to tape using proprietary formats created by backup software vendors. Creating a raw image of the contents of the tape provide little-to-no-value. I suspect you would like the tape restored, extracting the contents from the proprietary backup format onto an NTFS (or other) file system so that the files can be accessed and used for some other purpose.
If at this point you wish to use your forensic software to inspect and search the data, you may want to create an image of the hard drive (or partition) upon which the newly restored data is located and then you can use the features of your forensic software.
- Sales Pitch Notice -
Backup tape duplication and restoration is what my company does, so should you require assistance we help, as we have a data center located near Brighton.