Notifications
Clear all

Arcserve

10 Posts
5 Users
0 Likes
902 Views
(@roncufley)
Posts: 157
Estimable Member
Topic starter
 

Hi

Does anyone know the format of the arcserve tape header? In particular I am looking for the creation date.

Thanks
Ron

 
Posted : 18/06/2009 10:35 pm
(@roncufley)
Posts: 157
Estimable Member
Topic starter
 

Just in case anyone is interested I now know the answer starting at offset (decimal) 365 in the header is a date time string in C format.

 
Posted : 19/06/2009 4:30 pm
Jamie
(@jamie)
Posts: 1288
Moderator
 

Thanks Ron, useful if someone's searching the forums in future - appreciate you taking the time.

Jamie

 
Posted : 19/06/2009 4:57 pm
 IanF
(@ianf)
Posts: 55
Trusted Member
 

Keep in mind that this will only give you the Tape Header - there can be multiple sessions within the tape.

 
Posted : 19/06/2009 5:28 pm
(@roncufley)
Posts: 157
Estimable Member
Topic starter
 

Keep in mind that this will only give you the Tape Header

Er, yes, but that was what I was looking for.

From your answer I presume that you know the full format of the tape headers and the session headers, it would be most useful if you would share your knowledge with the rest of us.

 
Posted : 21/06/2009 2:56 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

I see you have your answer.

You should have fun with ARCserve especially when you get to embedded SIDF data streams (System Idependent Data Format - otherwise known as Sanity Independent Data Format). ARCserve was my biggest headache when dealing with tapes - the format changes subtly between versions.

 
Posted : 22/06/2009 1:33 pm
 IanF
(@ianf)
Posts: 55
Trusted Member
 

Er, yes, but that was what I was looking for.

From your answer I presume that you know the full format of the tape headers and the session headers, it would be most useful if you would share your knowledge with the rest of us.

Sorry Ron - I was probably just pointing out the obvious. oops I'm sorry to say that I haven't done any work with Arcserve in years and that was as a sysadmin - so I can't help with the full format. Just had fun in the distant past with corrupt headers etc.

 
Posted : 22/06/2009 5:07 pm
(@rampage)
Posts: 354
Reputable Member
 

since i'm a total noob about tapes forensics, what do you use to image (?) a tape?

 
Posted : 22/06/2009 6:16 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

I use software written in house - you can use DD but this will usually result in a number of images, one for each tape file.

 
Posted : 22/06/2009 6:18 pm
(@rampage)
Posts: 354
Reputable Member
 

mhhh.. i absolutely need to practice more with tapes…

 
Posted : 22/06/2009 6:19 pm
Share: