• Please review our updated Terms and Rules here

Any utility to read/browse Windows NT 4.0 Backup files?

Chuck(G)

25k Member
Joined
Jan 11, 2007
Messages
44,223
Location
Pacific Northwest, USA
I've got a few tapes that start off like this:


Code:
00000000  54 41 50 45 00 00 00 00  00 04 0e 00 00 00 00 00  |TAPE............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000030  02 00 08 00 87 55 3c 2b  00 00 00 00 01 00 00 00  |.....U<+........|
00000040  00 00 01 00 34 00 5e 00  00 00 00 00 00 00 00 00  |....4.^.........|
00000050  80 00 92 00 00 04 be 0c  1f 46 78 ab 0f 01 54 00  |.........Fx...T.|
00000060  61 00 70 00 65 00 20 00  63 00 72 00 65 00 61 00  |a.p.e. .c.r.e.a.|
00000070  74 00 65 00 64 00 20 00  6f 00 6e 00 20 00 30 00  |t.e.d. .o.n. .0.|
00000080  39 00 2f 00 32 00 38 00  2f 00 32 00 30 00 30 00  |9./.2.8./.2.0.0.|
00000090  31 00 4d 00 69 00 63 00  72 00 6f 00 73 00 6f 00  |1.M.i.c.r.o.s.o.|
000000a0  66 00 74 00 20 00 57 00  69 00 6e 00 64 00 6f 00  |f.t. .W.i.n.d.o.|
000000b0  77 00 73 00 20 00 4e 00  54 00 20 00 42 00 61 00  |w.s. .N.T. .B.a.|
000000c0  63 00 6b 00 75 00 70 00  20 00 28 00 4e 00 54 00  |c.k.u.p. .(.N.T.|
000000d0  42 00 41 00 43 00 4b 00  55 00 50 00 2e 00 45 00  |B.A.C.K.U.P...E.|
000000e0  58 00 45 00 29 00 20 00  56 00 65 00 72 00 73 00  |X.E.). .V.e.r.s.|
000000f0  69 00 6f 00 6e 00 20 00  31 00 2e 00 30 00 20 00  |i.o.n. .1...0. .|
00000100  52 00 65 00 76 00 2e 00  20 00 33 00 2e 00 34 00  |R.e.v... .3...4.|
00000110  31 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |1...............|
00000120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000400

Clearly, these are WT 4.0 backup images. I can find tools to browse XP and later .BKF files, but not the earlier NT 4.0 ones. Does anyone know of any documentation for the file format or tools (other than native NT 4.0 NTBACKUP) to handle these beasts?
 
Nope--that's post NT 4.0 backup. Got it on my machine, as well as mtftar--both choke on NT 4.0 backup files after a bit.

As a matter of fact, I can't find any documentation on ntbackup 1.0 file format. My understanding is that NTBackup for 2K could understand NT4 tapes, but the highway stops there with XP+ using something very different, based on the mtf description.
 
Don't quote me on this but I have a dim memory of NT4 backup being a rebadged version of Seagate Backup Exec
 
Last edited:
After trying to get mtftar to work (it goes for a bit and just stops--and the code is unreadable without a lot of aspirin), I broke down and installed Windows NT 4.0 Terminal Server (with SP3) on an old system. Some things that I observed:

1) You can define the installation of several different tape drives and NTBackup will select the appropriate one, but you'll always get a serious event noted at login time for the drives not installed. Minor annoyance.
2) NTFS as NT 4 understands it is not the same as NTFS as Windows 2000 knows it. I formatted a partition on a secondary hard drive with 2K and NT4 refused to see it. So reformat under NT4 and everything is cool. Minor annoyance again.
3) MTF is wedded to the tape block size; mtftar apparently doesn't know this. Volume and set header records are single-block files, but the actual size can be all over the map, depending on the drive. For example, a Seagate TR7 drive defaults to 512 bytes, but my Quantum DLT4000 defaults to 8192. You can transfer backup volumes between different types of drives, providing that the file size is a multiple of the physical block size. To go from 1024 byte blocks to 8192 byte ones, for example, I used the linux "truncate" utility; you can use it extend a file with nulls to an even multiple of a large block by using the "-s %blocksize" argument.
4. There seems to be an opinion that NTBackup for NT4 servers is not the same NTBackup used for NT4 workstation. It could be true, so I decided to play things safe and use NT server.

Hope this is useful to other folks.
 
Basic support for NT 5.0/2000's version of NTFS (i.e. without support for its new features) was added to NT 4.0's NTFS driver in, I gather, SP4. (And there's normally no good reason to not just install SP6a.) There is also a post-SP6a hotfix that adds support for it to AUTOCHK/CHKDSK, but according to BearWindows it can sometimes cause the system to hang when checking disks. It's best to just stick with NT 4's native NTFS version, and avoid multi-booting with or otherwise directly accessing such volumes with newer Windows versions; they will automatically, surreptitiously "upgrade" NT 4 NTFS partitions.

Note that NT Workstation, NT Server, and NT Server Enterprise Edition are all different editions (in licensing, branding, and which system utilities are included) of the same OS, and share the same service packs and many hotfixes, whereas NT Terminal Server is a specially-modified version of NT 4.0 and has its own separate versions of service packs and hotfixes. I'm not familiar with whether NT Backup is one, but certain components do enable certain features or vary in their behavior depending on whether you're running a Server or Workstation edition (e.g. Disk Administrator doesn't allow you to create fault-tolerant partition sets on Workstation, and applications can benefit from the /3GB boot.ini switch only on Enterprise Edition).
 
I threw up my hands with the backups I've got, after having run NTBackup, mtftar, mtf etc. and getting incomplete or various errors. Customer wants his data files from 20+ years ago, so I wrote my own extractor, which searches for the various DBLKs and works from there. Doesn't care about sets, tape headers, whatever--just the important stuff. You can even have a program poop in the middle of the backup file and the utilities will still grab most of the data.

Sorry to say that it can be much easier to craft your own utilities than trying to make unknown or badly documented third-party stuff work. :( The bonus is that you come away with a very detailed understanding of the mechanism.

That picture hasn't changed at all over the years. Crappy code is a plague on our civilization.
 
Back
Top