Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a corrupt ntbackup file that won't open in ntbackup.

There are various utilities that a google search turns up that say they can repair the files. Do I need to use one or is there a simple way of using ntbackup to do this?

share|improve this question
    
I tried NTKbup, but solved the problem using a trial of Symantec Backup exec – Nick R May 28 '09 at 13:58
up vote 4 down vote accepted

Update: This forum thread on tek-tips has some very useful information, like

Many thanks to Michael (aka mpears) for referring me to the free NTBkup software at http://www.fpns.net/willy/msbackup.htm. Using this software, I was able to recover thousands of files from a corrupted, 20-GB BKF file, saving hundreds of dollars and an untold number of hours in re-creating various documents.


As alternative you could try this commercial software for BKF recovery.

Kernel BKF File Repair - Recovers and repairs the files from damaged bkf archives corrupted due to backup interruption, virus attacks, crc errors or backup software corruption. It allows access to corrupt bkf files which can not be restored using the original backup software due to any kind of corruption.

There is also an open source project on SourceForge: JMTF

Good luck!

share|improve this answer
    
Currently (July 2015), the BKF / MTF Specification can be found under laytongraphics.com/mtf/MTF_100a.PDF and Will Krantzer's pages at willsworks.net/msbackup.htm and sites.google.com/site/willkranz – Zrin Jul 19 '15 at 21:04

If the backed up files within BKF are neither compressed nor encrypted then it is fairly easy - well not too hard - to extract single files manually by using grep, hexedit and dd.

MTF Format: http://laytongraphics.com/mtf/MTF_100a.PDF

Example (assumes using bash shell): extract Outlook.pst

grep -a -o -P 'O\x00u\x00t\x00l\x00o\x00o\x00k\x00\.\x00p\x00s\x00t' corrupt.bkf >offsetts.txt

Inspect offsets.txt, find offset that is followed by "NACL" "CSUM" and "STAN"

OFFSET=123456
dd if=corrupt.bkf bs=512 skip=$(( OFFSET / 512 )) | hexdump -C | less

00000000  46 49 4c 45 00 00 00 00  88 00 0e 02 00 44 bc 55  |FILE.........D.U|
00000010  00 00 00 00 2d 8e 77 00  00 00 00 00 00 00 00 00  |....-.w.........|
00000020  00 00 00 00 88 0a 00 00  00 00 00 00 18 00 70 00  |..............p.|
00000030  02 00 88 9b 00 08 00 00  1f 7a 74 17 73 1f 61 a2  |.........zt.s.a.|
00000040  b2 d7 00 00 00 00 00 1f  7a 74 17 73 54 00 00 00  |........zt.sT...|
00000050  33 0a 00 00 16 00 58 00  4f 00 75 00 74 00 6c 00  |3.....X.O.u.t.l.|
00000060  6f 00 6f 00 6b 00 2e 00  70 00 73 00 74 00 00 00  |o.o.k...p.s.t...|
...
00000170  12 1e 62 a3 33 bf 00 00  53 54 41 4e 00 00 20 00  |..b.3...STAN.. .|
00000180  00 44 bc 55 00 00 00 00  00 00 00 00 8e 0b 21 42  |.D.U..........!B|
00000190  44 4e c1 7c 3c 6a 53 4d  17 00 13 00 01 01 40 00  |DN.|<jSM......@.|

STAN means "Standard stream", the byte count is in 8 bytes (little endian) that begin 4 bytes after "STAN", so in this example 00 44 bc 55 00 00 00 00 or 0x55bc4400 bytes. The file starts at 22 bytes after beginning of STAN, you can see the "!BDN" magic number in the PST Header. To extract the file:

OFFSET=$(( OFFSET / 512 * 512 + 0x18e ))
FSIZE=$(( 0x55bc4400 ))
dd if=corrupt.bkf of=Outlook.pst bs=1 skip="$OFFSET" count="$FSIZE"

This will take some time if the file is large ... done!

share|improve this answer

protected by Iain Nov 8 '12 at 11:42

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.