Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently, we can perform and encrypt a Windows backup with ntbackup and GPG in 2 separate steps in a batch script, as below:

ntbackup backup "@selection_file.bks" /f "backup_file.bak"
gpg --recipient "recipient" --encrypt "backup_file.bak" --output "encrypted_file" --yes --batch

I'm wondering if there's any way to combine these steps to output the backup directly to GPG, without creating an intermediate, unencrypted backup file?

To clarify, I'm looking for something like standard input redirection or piping

prog.exe | prog2.exe

that works with GPG at the command line. Thanks for your time.

share|improve this question
up vote 1 down vote accepted

As Matt_Simmons so lucidly explained, ntbackup won't do output to stdout, so trying to use it is doomed.

gpg, however, will do the right thing if you use (unix convention) '-' as the file to input.

So now you need a way to gather files that includes 'the ability to easily select and exclude individual files', which tar totally fits the bill for (see the -T and -X flags). Modern versions will even do compression as well, via -z (gzip) and -j (bzip) flags.

And of course you can tie them together with a pipe:

tar -cjf - /dir/to/backup -X .mp3 | gpg --encrypt - --output "encrypted_backup.enc"
share|improve this answer

I don't think you'll be able to do that. But as an alternative you could probably backup to a mounted truecrypt volume.

share|improve this answer
Thanks, I suspect you're right. – nedm May 28 '09 at 21:35

OK, here's why this isn't going to work.

What you're attempting to do is convince ntbackup to stream backup data to standard out instead of to a file. The problem is that ntbackup is not written to be able to do this. ntbackup must be given the filename to output the data to, and unfortunately in Windows, there is no equivalent to /dev/stdin or /dev/stdout.

In order for this to work, you would need to convince ntbackup to print the raw backup data to the screen. There is no documentation that I am aware of (or have found through searching) that even hints that this is remotely possible. It just wasn't written to do this. Sorry.

share|improve this answer
Thanks for the thorough explanation. Can you suggest an alternative that would let me stream to GPG? How about 7zip or one of the windows ports of tar (though I'd prefer compression)? The main advantage of ntbackup -- outside of shadow copy -- is the ability to easily select and exclude individual files and directories, but I'm certainly willing to work around this. – nedm Jun 1 '09 at 15:29

Up for some programming? :) You can use a named pipe (aka fifo) to do this, but as far as I can tell, there's no batch-file ready interface.

share|improve this answer
wow. just reading that documentation makes me feel dirty ;-) – Matt Simmons May 31 '09 at 11:36
Truly. I had a quick google but couldn't find any batch interface sadly. Surely someone has written some vbscript for this?! – Alex J May 31 '09 at 12:26

You could probably use a FIFO file to act as the pipe. Though I'm not exactly sure how you'd create one of these on windows. But that's generally what they're used for, where you can't use STDOUT to pipe to.

share|improve this answer

Performing a standard ntbackup and then using gpg does create an intermediate, unencrypted file. However, if you turn on EFS, you can put the backup file in an encrypted folder so that an attacker can't recover plaintext of the .bkf file. That's probably going to be the easiest way to accomplish what you're asking for without completely switching toolsets.

share|improve this answer

You can't do it with gpg but you can with openssl and mysys:

cat.exe testfile | openssl enc -cast > outfile

Here's the manpage, you can even specify a password on the command line if you really need to. This will only work with symmetric encryption.

share|improve this answer

The 7-Zip command line documention mentions -si and -so switches to read from stdin and write to stdout.

7z a dummy -tgzip -so Doc.txt > archive.gz

compresses Doc.txt file to output stream and writes that stream to archive.gz file.

It doesn't mention piping, but if you can write to stdout, I don't see why gpg wouldn't be able to read it in.

share|improve this answer

I don't believe that ntbackup supports any sort of encryption natively.

share|improve this answer
Right, which is why I was hoping that there was a clever batch file trick to redirect the output from ntbackup to GPG rather than a file. – nedm May 28 '09 at 21:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.