Recovering data from unknown tapes

Matra · 10-26-2017, 09:00 AM

Hi all,

I've scoured this forum (and Google) which has really helped me get to where I am today, let me cut to the chase and explain the situation:

I have some DDS-150 (4mm) tapes that contain some data that may be of interest and want to convert it to a more usable/flexible format on an ext HDD or network.

I don't know what was used to make the tapes
I'm using a HP DAT72 (USB) drive which I know is working just fine
All tapes have a block size of 512b (found this out thanks to this forum using dd if=/dev/nst0 bs=128k count=1 | wc -c)
There are multiple files/folders on each tape but only around 10-20gb of each tape is used, each for an old HDD on a very old file server (I think). They are labelled as 'drive D', 'drive E' etc.

As you can see from above my drive name is nst0 and the usual mf commands work just fine.

When trying to determine the data type on the type:

Code:

file -< /dev/st0

returns

Code:

/dev/stdin: data

I've tried tar -tvf /dev/nst0 to view the contents and the return is

Code:

tar: This does not look like a tar archive
tar: Exiting with failure status due to previous errors

(I did have a longer error message earlier but can't find it, first line was the same though)

So I then tried CPIO cpio -civt < /dev/nst0 which just returned a load of junk and some random text from what appears to be within a file.

Here I've been able to make some headway using dd (I'm a fairly 'fresh-fish in the Linux world)

Code:

dd if=/dev/st0 of=/tmp/file1

creates a binary file dump of the tape contents but I have no idea how to view/open it to see the tape contents and files.

Any help/suggestions would be great. Just being able to read the file list on the drive would be a massive bonus, recovering them would be the icing on the cake

michaelk · 10-26-2017, 10:27 AM

Welcome to LinuxQuestions.

By the way the difference between /dev/st0 and /dev/nst0 is that using /dev/nst0 does not rewind the tape when the current tape operation is completed.

Since the tapes are labeled drive D, drive E etc maybe they were created on a Windows operating system. The data on tape could be a proprietary format which might be difficult to recover unless you have the application.

You can try viewing /tmp/file1 using a hex editor to see if there is a header or magic number that is readable.

DavidMcCann · 10-26-2017, 10:53 AM

Just looking at the Wikipedia article reveals that the tapes may be using DCLZ compression. That was usually done by firmware rather than software, I believe, and different manufacturers' products did not always give compatible results.

Matra · 10-26-2017, 02:34 PM

Quote:

Originally Posted by michaelk

Welcome to LinuxQuestions.

By the way the difference between /dev/st0 and /dev/nst0 is that using /dev/nst0 does not rewind the tape when the current tape operation is completed.

Since the tapes are labeled drive D, drive E etc maybe they were created on a Windows operating system. The data on tape could be a proprietary format which might be difficult to recover unless you have the application.

You can try viewing /tmp/file1 using a hex editor to see if there is a header or magic number that is readable.

Thanks,

When I look at the device list st0 does not exist but nst0 does, figured the drive decided/decides which it's going to be?

They very well might have been created on a Windows system but most likely prior to 1997!! Next on my list was to inspect with a hex editor though I can't do this until Monday

fatmac · 10-27-2017, 06:28 AM

Judging by what you have said, I would imagine they were just daily or weekly backup tapes, probably nothing interesting on them.

You should have full backups of your present data somewhere, in case of emergencies, probably two of, if the data is critical, & these should be updated regularly.

Matra · 10-30-2017, 02:51 AM

Quote:

Originally Posted by michaelk

Welcome to LinuxQuestions.
You can try viewing /tmp/file1 using a hex editor to see if there is a header or magic number that is readable.

I've made some headway and found the tape creation data "XF tape created on 03/01/06 Microsoft Windows NT Backup (NTBackup.exe) version 1.0 Rev 3 41"

At least now I know where to look and will have to find how to get hold of that/run it!!

Quote:

Originally Posted by fatmac

Judging by what you have said, I would imagine they were just daily or weekly backup tapes, probably nothing interesting on them.

You should have full backups of your present data somewhere, in case of emergencies, probably two of, if the data is critical, & these should be updated regularly.

Annoyingly it's not 'our' data. It's another company's data from an acquisition over a decade ago. Nobody has even looked at these tapes since but obsolescence review means that I should (or have to) as they may contain notes from the original design that are not found anywhere else.

michaelk · 10-30-2017, 04:48 AM

FYI...

https://en.wikipedia.org/wiki/NTBackup

Matra · 10-30-2017, 06:44 AM

Thanks, I at least know what format they are in and some Googling resulted in a program called mtftar which should convert the bkf to tar BUT I can't seem to find a version that will make, keeps coming up with errors - guessing it's an old unsupported program now and will have to dig out an old XP machine from somewhere

Matra · 10-31-2017, 10:34 AM

Thought I'd update this with progress, dug out an old XP machine and got the tape drive working... went to recover and it only saw the date created and wouldn't let me recover any files...

So I DD-d all of the drives to a single img file per tape (in linux) and copied across to my Win10 machine running Nucleus Kernel Tape Data Recovery Software - which shows all of the data that is on the tapes! Now I can sift through and find what I want and see if it's worth the fee to buy the software.

Thanks everyone for the pointers and help

michaelk · 10-31-2017, 10:42 AM

Thanks for the update