Altirium logo

Posts Tagged ‘Tape recovery’

Festive fun with LTO

‘Twas the night before Christmas, when all thro’ the house
Not a creature was stirring, not even a mouse;
Save for the IT manager at a German TV channel attempting to restore some footage from their PresStore backup archive in time for a New Year ’s Day TV Show…

To this day we are not sure what was not working, but working it was not. The catalogue of the PresStore backups had been cleared, it was thought that the 200 x LTO4 tapes would no longer be needed, so now a frantic effort was being made to re-create the infrastructure and scan 200 tapes.

With a single LTO4 drive it was already going to be a matter of luck whether the right tape was found in time as even working 24 hours a day you could hope only to get through 40 or so tapes in the time available, and the re-cataloguing kept failing with configuration errors, and so came the call for help, followed by an IT manager in a Volvo bearing LTO tapes and an expression of angst.

One of the benefits of writing one’s own software for various backup formats is that you don’t need to worry about configuration, processing is pretty much a function of tapes drive numbers, and with 20 LTO5 drives running in less than 2 days the PresStore backups had been re-scanned, a catalogue created and the required data identified.

Restoration of the required data from the PresStore backup took about an hour and so with time to spare our hero was racing back under the channel to save the day.

I have no idea who the footage was of, someone I am too old to appreciate I am told, so I apologise now to any Bavarian parent whose New Year peace we were responsible for disrupting, but the happy smiling face of the IT manager made it all worthwhile.

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)

Unlucky 13?

Being a generally optimistic person and not believing in bad luck, not even if someone turns up with an OnStream cartridge, the prospect of 13 x LTO2 tapes containing ARCserve backups was not of particular concern. Then the additional information was provided, they had been to another company for restoration and there was a problem with the data, the backups were corrupted and could not be restored, “was there anything we could do”?

Not having seen the tapes it was not honest to give more than a cautiously optimistic opinion. No-one here had encountered a corrupted ARCserve backup since some problems with Adaptec 1542 cards and MSDOS with too much memory installed back in the early 1990s. It seemed more likely we would find that they were either not ARCserve at all, or else were encrypted.

When the tapes arrived it all became clear. They were ARCserve with multiplexing, which means that the backup data from several backups can be interleaved and any attempt to proceed in a linear manner without first loading and interpreting the ARCserve MUX (multiplex) tables is going to end in tears, or at least with worthless data. The next challenge was restoration within an average life-span, restoring a single backup would be relatively straightforward one the MUX tables had been correctly interpreted, but with over a hundred backups per tape the idea of restoring one set at a time was not overly appealing as each tape would have to be read over 100 times, effectively turning a 13 tape restore into a 1300+ tape restoration exercise. This is where the benefits of developing software for tape restoration come to the fore, and being able to modify code to enable the simultaneous processing of all backups so each tape took less than 3 hours to read.

Once the tapes had been catalogued the required Exchange email data was located. Anyone fancy a guess at which number tape it was on? Sorry, that would have been too poetic, it was on tape 7.

 

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)

How do you restore Tivoli TSM data for forensic examination purposes

Tivoli Storage Manager (“TSM”) provides a sophisticated heterogeneous data storage environment within which large volumes of data can be held. These might include email backups, user documents and SQL database, in fact all of the information that might be just a little bit useful in a computer forensic investigation or a tape data discovery exercise.

So, you are an investigator who has been handed a case containing 25 LTO4 cartridges from a TSM archive, now what?
Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)

Tape – “The reports of my death are greatly exaggerated”

(With apologies to Mark Twain)

The release of LTO5 by Quantum Corporation brings 1.5TB native/3TB compressed tape to the market, and it is a sure fire bet that IBM and HP will shortly follow with their own offerings, which means that for the past 20 years or so, a technology many said was going the way of the Dodo, has managed to more than keep pace with competing technologies, and seen quite a few off (remember how optical disk was the future of storage  back in the late 1980′s?).

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 4.0/10 (2 votes cast)

TK50 data recovery, look out for media degradation

TK50 was a major player in tape backup on VAX/VMS systems several years ago. Being fundamentally ½” (half inch) tape of the type used in open reel drives, but housed as DLT style cartridge, it suffers from the same long term storage problems as some brands of 1/2″ media. TK50 drives could store 70MB of data, and took quite a long time to fill, so have long since ceased to be a viable backup option even if you can find drives and media. But, there are a surprising number of tapes out there with data on them and recent weeks seem to have brought forth a flurry of requests to get data from them, and in one case to copy some. In a high proportion of these cases the data transfer operation has ended up being a data recovery exercise involving considerable work in the lab.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 7.0/10 (1 vote cast)

eDiscovery and the monster in the vault

Past failure cannot be taken as a signpost for the way things will be in the future, so the inability of the US and UK financial regulatory authorities to spot the credit bubble from 20 paces, or the world’s largest Ponzi scheme even when pointed out to them in neon lighting, should not be taken as a sign that regulation can be ignored.

What is almost certain is that these regulatory paper tigers are about to be forced to become real, and with it will come new zeal for enforcing regulatory compliance leading to an increase in eDiscovery and eDisclosure requests.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 8.0/10 (1 vote cast)

Computer Forensics – don’t ignore the tapes

Much Computer Forensic work is associated with data recovery from hard disk drives, USB pens and other common data storage media. Even the television drama departments appear to believe that data is stored only on this limited range of media, I don’t have a back catalogue to check against but I am pretty certain that on Spooks there has never been an analysis of a DLT or LTO tape cartridge. So what about tape? Probably the largest volume of data stored in the world is on tape, so is it of any value in forensic investigations and litigation work?

The hard disk drive in a computer system contains the most up-to date information along with other forensically valuable information such as internet history and local temporary files, so why should you bother looking at the backup tapes?

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)

Data Recovery when everything fails

Much data recovery work involves the salvage of data from one specific type of storage, a hard drive, RAID array, backup tape or DVD. Occasionally a requirement pops up that transcends this norm.

Having faithfully adhered to a regime of nightly backup of a SUN UNIX system, the failure of the hard drive appeared to be an inconvenience that would soon be overcome for this customer. The hard drive having swiftly been replaced, the backup tape was brought back from storage and the restore process initiated. Five minutes in, however, and the DLT drive made a nasty noise, the cleaning lights came on and ufsrestore became ufs-cannot-restore.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)

What future has tape data storage?

With the volume of data being stored doubling every 18 months, and the possibility of increased regulation in the financial sector following the recent debacle possibly tightening all areas including data retention and data availability, how best to secure data for the long term?

In our data recovery business we are seeing an increase in hard drive recovery work from disk based backup systems. “We don’t use tape anymore” being the gist of many a statement on the subject of backup strategy, “disk based systems are so much more easy to use, and recovering the data is less arduous”. This much is true, disk based storage systems can be on-line permanently, de-duplication can be used to reduce the volume of extraneous data, and down time caused by accidental file deletion or local system failure can be kept to a minimum.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)