Home / server / Questions / 8560
Accepted
Nick R
Asked: 2009-05-16 02:44:56 +0800 CST

How can you repair a corrupt ntbackup (.bkf) file?

  • 772

I've got a corrupt ntbackup file that won't open in ntbackup.

There are various utilities that a google search turns up that say they can repair the files. Do I need to use one or is there a simple way of using ntbackup to do this?

windows backup

2 Answers

  1. Best Answer

    Update: This forum thread on tek-tips has some very useful information, like

    Many thanks to Michael (aka mpears) for referring me to the free NTBkup software at http://www.fpns.net/willy/msbackup.htm. Using this software, I was able to recover thousands of files from a corrupted, 20-GB BKF file, saving hundreds of dollars and an untold number of hours in re-creating various documents.

    As alternative you could try this commercial software for BKF recovery.

    Kernel BKF File Repair - Recovers and repairs the files from damaged bkf archives corrupted due to backup interruption, virus attacks, crc errors or backup software corruption. It allows access to corrupt bkf files which can not be restored using the original backup software due to any kind of corruption.

    There is also an open source project on SourceForge: JMTF

    Good luck!

    • 4

  2. If the backed up files within BKF are neither compressed nor encrypted then it is fairly easy - well not too hard - to extract single files manually by using grep, hexedit and dd.

    MTF Format: http://laytongraphics.com/mtf/MTF_100a.PDF

    Example (assumes using bash shell): extract Outlook.pst

    grep -a -o -P 'O\x00u\x00t\x00l\x00o\x00o\x00k\x00\.\x00p\x00s\x00t' corrupt.bkf >offsetts.txt

    Inspect offsets.txt, find offset that is followed by "NACL" "CSUM" and "STAN"

    OFFSET=123456
dd if=corrupt.bkf bs=512 skip=$(( OFFSET / 512 )) | hexdump -C | less

00000000  46 49 4c 45 00 00 00 00  88 00 0e 02 00 44 bc 55  |FILE.........D.U|
00000010  00 00 00 00 2d 8e 77 00  00 00 00 00 00 00 00 00  |....-.w.........|
00000020  00 00 00 00 88 0a 00 00  00 00 00 00 18 00 70 00  |..............p.|
00000030  02 00 88 9b 00 08 00 00  1f 7a 74 17 73 1f 61 a2  |.........zt.s.a.|
00000040  b2 d7 00 00 00 00 00 1f  7a 74 17 73 54 00 00 00  |........zt.sT...|
00000050  33 0a 00 00 16 00 58 00  4f 00 75 00 74 00 6c 00  |3.....X.O.u.t.l.|
00000060  6f 00 6f 00 6b 00 2e 00  70 00 73 00 74 00 00 00  |o.o.k...p.s.t...|
...
00000170  12 1e 62 a3 33 bf 00 00  53 54 41 4e 00 00 20 00  |..b.3...STAN.. .|
00000180  00 44 bc 55 00 00 00 00  00 00 00 00 8e 0b 21 42  |.D.U..........!B|
00000190  44 4e c1 7c 3c 6a 53 4d  17 00 13 00 01 01 40 00  |DN.|<jSM......@.|

    STAN means "Standard stream", the byte count is in 8 bytes (little endian) that begin 4 bytes after "STAN", so in this example 00 44 bc 55 00 00 00 00 or 0x55bc4400 bytes. The file starts at 22 bytes after beginning of STAN, you can see the "!BDN" magic number in the PST Header. To extract the file:

    OFFSET=$(( OFFSET / 512 * 512 + 0x18e ))
FSIZE=$(( 0x55bc4400 ))
dd if=corrupt.bkf of=Outlook.pst bs=1 skip="$OFFSET" count="$FSIZE"

    This will take some time if the file is large ... done!

    • 0