Critical 500GB backup ruined? How to recover something?

Discussion in 'Acronis True Image Product Line' started by rainabba, Jun 27, 2007.

Thread Status:
Not open for further replies.
  1. rainabba

    rainabba Registered Member

    Joined:
    Jun 27, 2007
    Posts:
    7
    In order to expand a raid 5 array (Intel ICH8R) I did a complete backup over the network and split the files at 4.7 GB so I could move them to an eSATA attached drive as the backup went. Somehow of the 95 files, 1 came up missing and I didn't realize it until everything else had been moved so I can't "undelete" from the remote disk.

    I can't do a Restore because of this missing file. How can I recover the rest of the data? I assume the backups accur in a linear fashion and if so, the recover should be able to continue (leaving a big empty, corrupt point in the file system).

    Please help! I've spent a lot of money on backup equipment and software (I do love Acronis TI, but this would turn me off permanently), and a lot of time (2 days now) preparing for this migration. Without this restore I'm going to be set 2 years back in my workstation config (installed/configured apps), and have to spend days reinstalling things.
     
  2. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,040
    Am I missing something. You set the small size and you were moving them, missed the fact one was missing, and it's Acronis fault. But sadly I am afraid you may indeed be out of luck. Generally without all the files you can't do anything.

    Pete
     
  3. rainabba

    rainabba Registered Member

    Joined:
    Jun 27, 2007
    Posts:
    7
    I don't believe I said anything about fault though if I was, I'd fault myself.

    What I'm asking is if there is a way to recover any of the data in the 94 files that I do have, despite file 87 being missing. I can't imagine why the fat (likely stored in the first file) and all data upto, and possibly past the missing file couldn't be restored. I realize this would leave a corrupt file system, but that's much easier to deal with than NO file system.

    To find that TI can't deal with such a circumstance would give me much reason to reconsider the product. I mean, 500GB of backups useless because of one error? What if it was just a bad sector on the storage device? That might make for a great backup process, but backups are only as useful as their ability to be restored. Follow?
     
  4. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,482
    Location:
    California
    I may have some good news for you. I have just done a test using a backup split into 650MB .tib files (a total of 10).

    I deleted #7 and copied #6 into its place. Then I changed the 9th byte in the file to 0x07 hex (7 decimal) and was able to mount and explore the backup, verify .zips, etc.

    TI's verify won't work and restore won't work because it says the image is corrupted. I didn't try and access every file, but obviously anything in the "#7 copy" will be corrupted (#87 in your case).

    A similiar procedure may work for you. Copy #86 to #87 (mybackup86.tib -> mybackup87.tib, for example), change the 9th byte ( offset 8 ) to 0x57 hex (87 decimal) and try and mount the backup.

    I used a program I wrote to change bytes in files. I haven't tested it on 4.7GB files, though, but any hex file editor that supports extremely large files (5GB+) should work.

    You can send me a PM if you want.

    ----
    Edit: I have tested my program with larger files and it failed. (It was written years ago in Turbo Pascal. Surprisingly, it did work with a 3.5GB file.) Anyway, I downloaded a free hex editor and successfully changed the byte in a 7.5GB file so it should work fine on a 4.7GB file.
     
    Last edited: Jun 28, 2007
  5. rainabba

    rainabba Registered Member

    Joined:
    Jun 27, 2007
    Posts:
    7
    MudCrab, I'm about to check this idea out. You may be my hero. Either way, thanks for the suggestion. How did you find this was a sequence number?
     
  6. rainabba

    rainabba Registered Member

    Joined:
    Jun 27, 2007
    Posts:
    7
    :( Got: "Cannot assign a drive letter to a partition from the backup archive".
     
  7. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,482
    Location:
    California
    If found the sequence in previous testing of a files & folders multi-part backup image.

    I got that error too, when it wasn't quite right.

    Make sure you have all the .tibs for the backup in the same folder (directory).
    Make sure the filenames all end with the part number.

    Once it's correct, TI will say that it is part #7 (or whatever number it is) of the backup set. In the picture below TI thinks it's a valid part of the image even though it is just a copy of part #6 (with the byte changed).
    splittest01.JPG

    splittest03.JPG

    splittest04.JPG

    This is what I'm assuming you'll need to change yours to after you copy your backupname86.tib to backupname87.tib. If you do this and it doesn't work, I'll create another test that splits into 90+ files and see if TI uses a different offset/format.
    splittest05.JPG

    After the change, the only byte different should be the offset 8 byte. In the picture below you can see offset 8 shows '7' for splittest7.tib and '6' for splittest6.tib.
    splittest02.JPG
     
  8. dbknox

    dbknox Registered Member

    Joined:
    Jun 7, 2006
    Posts:
    511
    Location:
    Canada
    Sorry to butt in here but I have to say MudCrab you astound me!
    Good work.
    Thanks for the valuable lessons.
    I hope I never need it but I will keep your examples just in case.
     
  9. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,040
    Likewise I tip my hat to you Mudcrab.

    Pete
     
  10. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,482
    Location:
    California
    Thanks for the compliments, dbknox and Peter2150.

    I have done this particular type of file examinations many times before in data conversions (mostly database and mailing lists). In this case, finding the split number byte in the file was a simple matter of "flipping" the files in a hex editor.

    I have since tested this on a backup split into 91 parts, deleting the 87th part and replacing it with the 86th part (with the byte number change). It worked just fine so hopefully it will work for rainabba and he can recover most of his files.

    I don't have 440GB of data to backup with room to test 90+ 4.7GB files though... (maybe one day I'll purchase a 2TB drive :D )
     
  11. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,482
    Location:
    California
    I just wanted to update this thread with some new test information. Another poster had asked about recovering data when the first .tib split was lost.

    I have run several more tests and two split sets and it seems that if either the first or the last part of a multi-part image file is missing, then you can't use this method to recover any files.

    In the case of the last file missing, TI will just error and not find the last created volume. With the first split file missing (replacing it with part 2 [changing the split number by to 1]), TI will mount the image, but you can browse it. Explore will show the partition, but no files.
     
  12. seekforever

    seekforever Registered Member

    Joined:
    Oct 31, 2005
    Posts:
    4,751
    This isn't too surprising because the information about the archive structure that TI develops as it creates the archive is placed in the last file so the last file is critical. (I know you know that but just in case somebody else doesn't.)
     
  13. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,482
    Location:
    California
    Update on "Critical 500GB backup ruined?" thread

    I received a PM today from rainabba and we wanted to update this thread with the successful results.

    rainabba,

    Thanks for letting us know the results.
     
    Last edited by a moderator: Apr 11, 2008
Thread Status:
Not open for further replies.