Forensic Investigation

[bdmeyer]

I am restoring a 320 GB Exchange Mail store from a tape using DD to send it to an NFS Share.

Early strings output indicated it was backed up using Symantec Veritas backup. (I'll have the version again, once it is finished the DD process.)

I am assuming that this file, won't actually be the file as it lay on the server, rather something with Veritas headers perhaps interspersed through out. I certainly could be wrong, I am not familiar with the file structure of a Veritas backup at all.

If I am correct, that I will still need to run this file through a Veritas software to recover the original file, can anyone shed some light on what I need to begin doing?

Can I even run Veritas against a disk file, after having recovered it in this fashion?

Any Manuals, FAQ's, forums, etc that I should read are appreciated.

--Bruce D. Meyer

[Rakesh_Khandelw]

To read this tape through NetBackup you have to have NetBackup server up and running, which may not be a viable option if you do not already have one. If you have a NetBackup server already then you can simplet import the tape and do the required restore from the tape.

The process for mporting the tape and update NetBackup catalog is well defined in Admin Guide. Follow the link below to download it.

- System Administrator's Guide for Windows, Volume 1 ( http://seer.entsupport.symantec.com/docs/290203.htm )

- System Administrator's Guide for Windows, Volume 2 ( http://seer.entsupport.symantec.com/docs/290204.htm )

- System Administrator's Guide for UNIX and Linux, Volume 1 ( http://seer.entsupport.symantec.com/docs/290201.htm )

- System Administrator's Guide for UNIX and Linux, Volume 2 ( http://seer.entsupport.symantec.com/docs/290202.htm )

Read the chapeter, NetBackup Catalog, section using the catalog utility in Admin Guide Volume 1.

If you do not have a NetBackup server, you can try this -

Reading backup images with tar
NetBackup for UNIX uses a modified GNU tar for reading backup images. The modified tar is located in /usr/openv/netbackup/bin/tar. By using the modified tar, NetBackup can understand compressed files, sparse files, long pathnames, ACL information. It offers features similar to those in cpio.
Although non-NetBackup versions of tar can be used to restore files, they provide only limited restore capabilities.
Note: You cannot use the NetBackup modified-GNU tar on UNIX or tar32.exe on Windows to extract files from a NetBackup for Windows backup image.
Effects of a non-NetBackup tar
Non-NetBackup versions of tar do not supply all of the restore capabilities that the NetBackup /usr/openv/netbackup/bin/tar provides. Possible problems result.
The following is a list of some effects that a non-NetBackup tar may encounter in certain situations:
■
Compressed backups cannot be recovered.
■
Multiplexed backups cannot be recovered.
■
Solaris extended attributes cannot be restored to a client.
■
VxFS named data streams cannot be restored to a client.
■
Backups cannot be recovered that contain raw partitions. (Includes FlashBackup images.)
■
NDMP client backup images cannot be restored, though NDMP vendors may have tools or the utilities that may perform a restore directly from the media.
■
Non-NetBackup versions of tarmay have trouble with sparse files and often skip sparse files.
■
HP CDFs are restored with non-NetBackup versions of tar. The directory is no longer hidden and the name of the directory has a + appended to it.
■
If the backup spans more than one piece of media, you must read and combine the fragments from the media to give to tar. To combine the fragments, the system’s dd command may be useful. Another possibility is to use taron the fragments. To use taron fragments may allow recovery of any file in the backup other than the one that spanned the media.

Some versions of the HP9000-800 /bin/tar command are known to give a directory checksum error for the second fragment of a backup that crossed media.
■ Some versions of Solaris tar combine the atime,mtime, and ctime strings with the file name and create the file paths that are not desirable.

To restore files with a non-NetBackup tar

The following process explains how to use a non-NetBackup tarto read a
backup from a NetBackup tape. Most versions of tar can read the tapes that
NetBackup creates after using the mtcommand to position to the proper tape
location. First, see the notes following the procedure as well as “Effects of a
non-NetBackup tar” on page 162 for possible limitations.
This sequence assumes that the media is known to Media Manager and that the
tape drive is under Media Manager control.
First, obtain the following information:
■
The media id of the tape that contains the required backup.
■
The tape file number of the backup on the tape (see the NetBackup Images on Media report for this tape).
■
The tape type and density.
■
The tape pool.
To restore files with a non-NetBackup tar
1 tpreq -m media_id -a r -d density -p poolname -f /tmp/tape
Where:
media_id is the media id of tape that contains the backup.
density is the density of the tape.
poolname is the volume pool to which the tape belongs
2 mt -f /tmp/tape rew
3 mt -f /tmp/tape fsf file_#
Where:
file_# is the tape file number of the backup on tape. Determine the tape file
number by checking the NetBackup Images on Media report for the tape.
4 mt -f /tmp/tape fsr
5 /bin/tar -tvfb /tmp/tape blocksize
Where:
■ blocksize is 64 (assume that the tape is written with 32K blocks)

6 tpunmount /tmp/tape

Notes on the procedure, “To restore files with a non-NetBackup tar”

1 This procedure does not apply to optical platters.
2 This procedure does not apply to encrypted backups using NetBackup Encryption. Encrypted backups are recoverable, however, the backups cannot be decrypted. To determine if a backup is encrypted, run tar -t before the recovery. The output for an encrypted backup is similar to the following example:
erw-r--r-- root/other Nov 14 15:59 2006 .EnCryYpTiOn.388
-rw-r--r-- root/other Oct 30 11:14 2006 /etc/group.10-30
Where the e at the beginning of line one indicates that the backup is encrypted. (Additional messages appear during recovery.)
3 This procedure does not work on the Solaris platform. You cannot use /usr/sbin/tar on Solaris to read NetBackup backups. The Solaris tar command uses the ctime and the atime fields differently than other tar commands. When /usr/sbin/tar is used to restore backups, directories with large numbers are created at the top level. These directories are from the ctime and the atime fields being read as pathnames. You can, however, use /usr/openv/netbackup/bin/tar or GNU tarto read the backups on Solaris platforms.
4 Steps 1 and 6 are optional in a stand-alone environment. If step 1 is skipped, DOWN the drive, then substitute the /devpath of the drive in place of /tmp/tape in the other steps. Remember to UP the drive when you are done.
Example
The following example was successful on an HP9000-800 with a DOWNed 4mm stand-alone drive and the NetBackup tar. mt -t /dev/rmt/0hncb rew
mt -t /dev/rmt/0hncb fsf 1
mt -t /dev/rmt/0hncb fsr 1
/usr/openv/netbackup/bin/tar tvfb /dev/rmt/0hncb 64
Some platforms require other options on the tar command. The following is required on Solaris 2.4:
/usr/openv/netbackup/bin/tar -t -v -f /dev/rmt/0hncb -b 64

Files that tar generates
Any version of tar (including NetBackup-modified tar), can generate a number of files depending on the circumstances of the recovery:
■
@@MaNgLeD.nnnn For backups containing pathnames longer than 100 characters, tar generates the files that are named @@MaNgLeD.nnnn that contain the actual file.
■
@@MaNgLeD.nnnn_Rename targenerates another file (@@MaNgLeD.nnnn_Rename) that explains how to rename the @@MaNgLeD.nnnn files to return the files to the correct location.
■
@@MaNgLeD.nnnn_Symlink For long names of symbolic links, tar generates the files that are named @@MaNgLeD.nnnn_Symlink. These files contain descriptions of the symbolic links that need to be made to return a link to the correct file.
■
For cross-platform ACLs restores, tarcreates and stores the ACLs in .SeCuRiTy.nnnn files in the rootdirectory. Read or delete the files. Regenerate the ACLs to the corresponding files by hand. For more information, see “Restoring files and access control lists” on page 681.
■
For cross-platform VxFS extent attribute restores, tarcreates and stores extent attributes in .ExTeNt.nnnn files in the root directory. The files can either be deleted or read and the extent attributes regenerated by hand to the corresponding files.

[bdmeyer]

Rakesh,

 Thank you for the very detailed reply.

Here is my current status:

  I have installed a trial version of Backup Exec 11d which is what the mail store (edb file) was originally backed up with.

I  have copied the 320 Gb file to the windows server where backup exec resides.

For the life of me, I can't seem to get Backup exec to even notice the file exists and attempt to restore it.

I did read where you said I could import the tape. I don't have a tape drive at my disposal. I had to get a different department to dd the data from the tape to disk for me so I could get this far.

I will happily read whatever pages you recommend so that I can get this file into it's native mail store format, so I can begin importing it into EnCase or FTK for an analysis.

 If you feel I should use themodified tar on a linux machine, I can do also. The original archive resides on a CentOS machine.

If I understand TAR correctly, it doesn't actually compress anything, rather it combines many files into one, in preparation for compression, or transport. It crosses my mind that a mail store backup may not have more than a single file.

I can do a strings on the restored file, which is full of text. it doesn't look like many binary files do.

Anyway, I am anxiously awaiting your recommendations for my next step. 

I apologize for the delay, but it takes a long time to copy 320 GB.   :)

--Bruce D. Meyer

[bdmeyer]

I should mention that I am actually reading the admin guide, so you don't think, I am ignoring what you have already written.

--Bruce 

[Rakesh_Khandelw]

I am confused.

In your first post you had mentioned it's NetBackup tape and now you are telling me it's Backup Exec tape.

I am not much familiar with Backup Exec but I am sure process for retrieving data from Backup Exec tapes is going to be different than the one for NetBackup.

If this is the case, tapes are in Backup Exec format, and you want to retrieve it  with NetBackup then follow NetBackup Guide otherwise you need to follow the process for Backup Exec from Beackup Exec Admin guide.

[bdmeyer]

When I was given the tape, I was told netbackup. AQfter making a site visit, they told me backup exec.

Frankly, I hand't even realized the difference until you pointed it out just now.

I guess my only question that remains is, can I restore from disk, the file that was orginally backed up to tape?

We had to pull it off the tape on a tivoli system, and then copy it to disk.

If you say that it should be possible, I'll pursue this further.

Thanks for your time Sir.

--Bruce 

[Rakesh_Khandelw]

I am not sure at this time because I am not sure how Backup Exec writes the image, not sure if it writes on disk in different foramat than tape or not. You may want to ask the question in Backup Exec forum or dig into Backup Exec Admin Guide.

[bdmeyer]

Rakesh,

 I will check in the Backup exec forum then. Thanks for all your help. I truly appreciate your time.

--Bruce D. Meyer

[J_H_Is_gone]

you do know that there is an option to restore a Backup Exec tape using Netbackup, right?

[Rakesh_Khandelw]

Please don't forget to post the solution or process worked for you. It may help someone else in same situation.

[bdmeyer]

In response to both posts.

1.) No, I had no idea. I didn't download Netbackup, but if I can't find the answer from someone helpful like yourself for Backup Exec, then I may just do that.

2.) I will certainly try to remember that. Most problems I have ever encountered have been resolved through google, or newsgroups, forums such as this. I need to try and give soemthing back I would say.

Thanks for your help Sir,

 Bruce