Hi,
I have a case going where I have two backup tapes (LTO) made with Symantec Backup Exec 13 and I am using MediaMerge/PC to restore the tapes to hard drives before I image them. While running the forensic log function, MMPC claims that the tapes I have are not the first in the sequence, and apparently neither one of them are in sequence with the other.
To what degree can I trust what MMPC is claiming? Is this actual proof of there being more tapes, or could it be that MMPC erroniously interprets data from the tapes as being evidence of there being more tapes?
Any experience or thoughts on the matter would be greatly appreciated.
Regards,
Stigster
Get yourself an eval copy of BackUp Exec and catalog the tapes. You will probably need to do this anyway. Also, I am pretty sure that MMPC will not restore portions of the tape that have been backed up with the backup exec agent (i.e. if you have brick-level exchange backups).
see if you can get more information on the origin of the tapes and how they were backed up. if they were backed up with a virtual tape library, the data for a single backup could be spread across a bunch of tapes, and the start of a backup job won't necessarily be at the beginning of a tape.
MM/PC will be looking at the meta data in the header blocks to determine the volume sequence number. This is probably Block 0, File mark 0.
If you look at this block on both tapes you may beable to see why the 'error' message has been displayed.
MEDIA_SEQUENCE_NUMBER is location 0x3C