Arcserve

Just in case anyone is interested I now know the answer starting at offset (decimal) 365 in the header is a date time string in C format.

Thanks Ron, useful if someone's searching the forums in future - appreciate you taking the time.

Jamie

Keep in mind that this will only give you the Tape Header - there can be multiple sessions within the tape.

Keep in mind that this will only give you the Tape Header

Er, yes, but that was what I was looking for.

From your answer I presume that you know the full format of the tape headers and the session headers, it would be most useful if you would share your knowledge with the rest of us.

I see you have your answer.

You should have fun with ARCserve especially when you get to embedded SIDF data streams (System Idependent Data Format - otherwise known as Sanity Independent Data Format). ARCserve was my biggest headache when dealing with tapes - the format changes subtly between versions.

Er, yes, but that was what I was looking for.

From your answer I presume that you know the full format of the tape headers and the session headers, it would be most useful if you would share your knowledge with the rest of us.

Sorry Ron - I was probably just pointing out the obvious. oops I'm sorry to say that I haven't done any work with Arcserve in years and that was as a sysadmin - so I can't help with the full format. Just had fun in the distant past with corrupt headers etc.

since i'm a total noob about tapes forensics, what do you use to image (?) a tape?

I use software written in house - you can use DD but this will usually result in a number of images, one for each tape file.

mhhh.. i absolutely need to practice more with tapes…