Join Us!

Notifications
Clear all

Arcserve  

  RSS
roncufley
(@roncufley)
Active Member

Hi

Does anyone know the format of the arcserve tape header? In particular I am looking for the creation date.

Thanks
Ron

Quote
Posted : 18/06/2009 11:35 pm
roncufley
(@roncufley)
Active Member

Just in case anyone is interested I now know the answer starting at offset (decimal) 365 in the header is a date time string in C format.

ReplyQuote
Posted : 19/06/2009 5:30 pm
Jamie
(@jamie)
Community Legend

Thanks Ron, useful if someone's searching the forums in future - appreciate you taking the time.

Jamie

ReplyQuote
Posted : 19/06/2009 5:57 pm
IanF
 IanF
(@ianf)
Member

Keep in mind that this will only give you the Tape Header - there can be multiple sessions within the tape.

ReplyQuote
Posted : 19/06/2009 6:28 pm
roncufley
(@roncufley)
Active Member

Keep in mind that this will only give you the Tape Header

Er, yes, but that was what I was looking for.

From your answer I presume that you know the full format of the tape headers and the session headers, it would be most useful if you would share your knowledge with the rest of us.

ReplyQuote
Posted : 21/06/2009 3:56 pm
PaulSanderson
(@paulsanderson)
Senior Member

I see you have your answer.

You should have fun with ARCserve especially when you get to embedded SIDF data streams (System Idependent Data Format - otherwise known as Sanity Independent Data Format). ARCserve was my biggest headache when dealing with tapes - the format changes subtly between versions.

ReplyQuote
Posted : 22/06/2009 2:33 pm
IanF
 IanF
(@ianf)
Member

Er, yes, but that was what I was looking for.

From your answer I presume that you know the full format of the tape headers and the session headers, it would be most useful if you would share your knowledge with the rest of us.

Sorry Ron - I was probably just pointing out the obvious. oops I'm sorry to say that I haven't done any work with Arcserve in years and that was as a sysadmin - so I can't help with the full format. Just had fun in the distant past with corrupt headers etc.

ReplyQuote
Posted : 22/06/2009 6:07 pm
Rampage
(@rampage)
Active Member

since i'm a total noob about tapes forensics, what do you use to image (?) a tape?

ReplyQuote
Posted : 22/06/2009 7:16 pm
PaulSanderson
(@paulsanderson)
Senior Member

I use software written in house - you can use DD but this will usually result in a number of images, one for each tape file.

ReplyQuote
Posted : 22/06/2009 7:18 pm
Rampage
(@rampage)
Active Member

mhhh.. i absolutely need to practice more with tapes…

ReplyQuote
Posted : 22/06/2009 7:19 pm
Share: