All has not been well for FUMC computing this week. You may recall my previous post where our RAID array became corrupted. We lost our shared drives, had to rebuild the array, and then restore from backup.
Well, the same thing happened again yesterday afternoon. I swapped SCSI drives again just in case (even though I am fairly certain it is the controller hardware). I went to restore from our backup file using NTBackup within Windows Server 2003 R2 and received this message: “The backup file contains unrecognized data and cannot be used.” I tried a separate .bkf file, same thing. I was beginning to get a lump in my throat.
Our disc backups are each full backups. The only thing I can think of is that the array failed during the backup. However since the OS and thus ntbackup.exe run on a separate array it continued anyway. Whatever the cause, the result was tragic. I couldn’t use NTbackup to restore our data (60GB).
If you search for programs that can restore .bkf files you will find a myriad of programs that claim they can recover the files. However, they all cost a decent amount of money 🙁 I eventually stumbled upon this command line program because of a thread on Experts-Exchange. http://www.fpns.net/willy/msbackup.htm This gentleman has written an open source executable file that can recover .bkf files as well as .qic (for earlier versions of Windows). It took quite a bit of reading and tinkering to get the correct syntax but eventually I was able to run:
ntbkup E:\backup\Network_Midnight.bkf @extract.cmd
where extract.cmd is a file in the same directory as ntbkup.exe it contains this single line ‘G:\common+ c:\restore\common\’
What this command and this file do is search the entire .bkf (Network_Midnight) for the folder ‘common’ on the G: drive (within the backup set) and then it copies the contents from the .bkf file into the ‘C:\restore\common\’ directory. The ‘+’ sign allows ntbkup to include sub-directories.
Since our backup file included multiple drives (not just the G: drive) the entire .bkf file was about 120GB. I used this method to recover the contents of G: and F: totaling about 60GB. It took about 2 hours, but it appears to have worked flawlessly. I was impressed and that lump in my throat turned into a really loud shout-out at 3:30 in the morning 🙂