TIB file - $150 Reward for data recovery assistance
Ok here's the scenario I'm in
All my emails are stored with a 5Gb Truecrypt file store, foolishly I managed to delete 6 yrs of archives by importing over my archive folder, doh! not to worry I have a back up....phew....tried to explore my backup TIB ...error message "This is not the last volume of the backup set"....shit! After much research I've determined that this basically means my TIB file is corrupted/f*cked (I will always validate any archives in the future even if it takes 2 days!!).
So my quest has started as to how to recover my data as my hard drive shows a 370Gb TIB file so I'm fairly hopeful that somewhere in there will be a 5Gb chunk that is my truecrypt file store. Luckily my TIB was created with zero compression (well it might not help at all......)
I've emailed a couple of companies that suggest they do data recovery on TIB files however I've yet to get a response from them. So my questions for any Acronis gurus:
1 - the TIB file structure, would it be possible to extract files from an uncompressed, unencrypted TIB file using file carving techniques?
2 - Are files fragmented when True Image writes them into the TIB archive
I've been playing around with demo version of DataLifter File Extractor Pro, creating a smaller TIB and truecrypt volume but have yet to successfully file carve the file out, this suggests that True Image doesn't simply store files......help!!
Hi Fungus, Thanks for the reply, ok some specific more details....
What TI version and build you used to create the backup.
TI Home 2009, I'll add the build number shortly I've installed the latest version 2010 so will need to reinstall the old version to discover the build number
TI Is it a single full backup, or are there many incrementals too?
Yes single full backup
Is the TIB file on a different drive?
Yup external hard drive
What TI version and build do you now have installed?
True Image Home 2010 Build 6053
Have you tried any TI Boot CD disks.
Yes, same error regarding not being last volume of the backup
My question: Is your TIB file really that big?
Unfortunately, yes - it was an uncompressed backup of my hard drive, mostly music and movies however also a couple of truecrypt file stores with personal email etc....
I attempted a few file carves tests last night, however my understanding of file systems, file structures etc means I have probably tried daft approaches all unsuccessful so far.....
TEST1
Create TIB Image containing Truecrypt file store, file carve out the file store using file header and footer.
RESULT - corrupted file store, I believe the TIB Image must alter/encode the file structure somehow
TEST2
Create TIB Image containing Truecrypt file store, identify filestore using file header and footer, overwrite all bytes with contents of a different filestore.
RESULT - The image file would open via True Image explorer, however error message on restoring the filestore, True Crypt mounted the extracted file but it contained invalid file system.
This is the next approach I hope to try, and after this I have run out of ideas......
TEST
1 - Create TIB Image of 5Gb Truecrypt file store (using the filestore with deleted emails)
2 - Identify Truecrypt filestore start and end within corrupted 370Gb TIB Image, copy this 5Gb block
3 - Overwrite the 5Gb block in the TIB Image created in step one with the data copied from step 2
4 - Attempt to open the TIB created in step one.
5 - Mount Truecrypt file store, and hopefully retrieve lost emails!!
Obviously the above assumes zero file fragmentation...and is based on my limited understanding on file systems so is probably bound to fail. If anyone else has experience of successfully recovering data - please help!
ok, an update.....its very quiet on here which suggests I'm attempting the impossible.
So the test I outlined previously obviously failed...I guess it must be something to do with the checksums. Annoyingly on openning the 370Gb file in winhex I can find my 5Gb block of emails, the header and footer of the truecrypt file are there, it would appear with zero fragmentation. This is even more frustrating as it suggests that whilst the TIB file may not validate on checksums, the contents (well the file I'm interested in) of the TIB are intact.
I contacted a company advertising TIB file recovery, however seems like the company is no longer active. What is really needed is a "open with errors" mode in Acronis, whereby the checksum errors are ignored. I find it hard to believe that there are no tools that do this as TIB corruption appears to be a VERY common issue.
So in order to prompt some assitance please see below...
$150 REWARD
This is a call for help, for which I will pay $150 to the person whom helps me successfully extract my file.
I am happy to provide remote access to my server so that whomever helps does not need to download 370Gb Tib, they are free to install any tools they wish. Ideally I'm hoping an Acronis developer (or ex employee) with access to tooling that I'm sure exists wishes to earn some extra cash.
Full confidentiality is assured please contact me on danny_uk_76@yahoo.co.uk if you are interested.
Since you're in the UK you might state which country's currency you're talking about. Several use dollars.
For your problem, search the forum for Truecrypt if you haven't already sone so and see if it helps. I remember reading some messages with that word in it but it may also have been in the old forum.
good point dwnndrty,
US dollars or equivalent in whomever helps local currency
thought I'd add the build detail
TI 2009 Build 12.0.0.9615
(AcronisTibUrlHandler.exe is actually 12.0.0.9064)
1. Did you try using the TI home 2009 to attempt to restore the file instead of 2010. Acronis is not always backwards compatable I have had some strange errors when attempting to restore with a later version of acronis.
2. For test 2 try recover instead explorer
3. For test 2 you may have carved out the unaltered truecrypt file try mounting it in true crypt without running acronis (that is if acronis did not alter/encode the file structure)
4. if step 3 doesn't work and you remember which algorithms you used to encrypt the backup you could attempt to manually decrypt it with out mounting it (remove file header and footer) also im not sure what the output would look like and whether or not you could view individual files if it is corrupted but you should atleast be able to view the text from your emails along with a bunch of garbage (if your email archive is uncompressed)
also from
http://www.truecrypt.org/faq
What will happen when a part of a TrueCrypt volume becomes corrupted?
In encrypted data, one corrupted bit usually corrupts the whole ciphertext block in which it occurred. The ciphertext block size used by TrueCrypt is 16 bytes (i.e., 128 bits). The mode of operation used by TrueCrypt ensures that if data corruption occurs within a block, the remaining blocks are not affected. See also the question 'What do I do when the encrypted filesystem on my TrueCrypt volume is corrupted?
What do I do when the encrypted filesystem on my TrueCrypt volume is corrupted?
File system within a TrueCrypt volume may become corrupted in the same way as any normal unencrypted file system. When that happens, you can use filesystem repair tools supplied with your operating system to fix it. In Windows, it is the 'chkdsk' tool. TrueCrypt provides an easy way to use this tool on a TrueCrypt volume: Right-click the mounted volume in the main TrueCrypt window (in the drive list) and from the context menu select 'Repair Filesystem'.
for step four you may not need to know which algorithims you used
http://www.truecrypt.org/docs/?s=encryption-scheme
note-I am definately not an expert
*double post*