I've got A VBK file (veeam backup & replication) where the the beginning of the file is missing
and need to reconstruct it manually (HEX) in order to be recognized by the software

I've examined a few good working file and figured that the structure is as follows

first sector - header + some unknown (yet) bytes (will not be recognized without it)
....
sector 8 index (very important, I think every byte counts)
.....
sector 104 copy of the index (not needed)
(dumb, who puts a copy of so important data so close to the source)
....
metadata
.....
data
.....
metadata
.... Etc.

what I need the most is reconstruct sector 0x08 which tells the software where everything is located (metadata, data)
I've figured it out partially (bolow) and need help with the rest

Here is A small example I've created

note if you gonna install the software
* the intallation package is huge (3.5GB)
* takes a long time to install
* denies access to the file

structure of sector 0



I dont know what 0x100-0x10F means
it seams that 0x107 is always (?) 09
on 0x10D and 0x10F i've seen different data (attached below)

----------

structure of sector 8



here is what I've found so far

0x1000 - 0x1007 might be (?) some kind of checksum (which I dont know how its calculated)
0x1008 - 0x100F ?
0x1010 - 0x1017 file size
0x1018 - 0x101B always the same as 0x1078 -0x107B number of sections (metadata, data)
0x101C - 0x101F ? (always 00)
0x1020 - 0x102F (?) always the same
0x1030 - 0x1047 (?) different data from file to file
0x1048 - 0x106F (?) always the same (except 0x1048)
0x1070 - 0x1077 (?) always the same
0x1078 - 0x107B number of sections (metadata, data)
0x107C - 0x107F (?) differnt data from file to file
0x1080 - 0x1087 location where the first section (metadata) starts
0x1087 - 0x108B the lengths of section section (always the same)
0x108C - 0x108F (?) different data from file to file
0x1090 - 0x1097 location where the second section (metadata) starts
0x1097 - 0x109B the lengths of the section (always the same)
0x109C - 0x109F (?) different data from file to file
0x10A0 - 0x10A7 location where the last section (metadata) starts
0x10A7 - 0x10AB the lengths of last section (always the same)
0x10AC - 0x10AF if its the last its always the same (0x00)

can anyone help to figure out the rest of it ?

below is attached the beginning of the files (first 0x08 sectors) I've based my research (03 and 04.bin have a lot of sections)


alternatively does anyone know how the data is compressed (data starts @ 0x1E1F000) so I can decompress it ?

ISTM that the info for each section should be viewed as ...


... which would then suggest that the leading dword is some kind of checksum or CRC.

_________________
A backup a day keeps DR away.

I thought that it might be a checksum for that section
because in the small dos file extract.exe (to extract the files out of the VBK) when I've searched "calc" I got a few results about CRC and SHA256 ...
the question is what and how is it calculated

or is there a way to decompress the data somehow

0x1000 - 0x1003 must be A checksum of that sector only
but still don't know how it's calculated

Hi HaspHL,

I just strumbled upon this thread using Google. I’m in the same pickle; the beginning of the vbk file is corrupt. The rest of the file is still intact.

Have you made any more progress? The stuff you posted here is really helpful and gives me already a lot of info to get started with. I’m not in the possession of a file that is not corrupted; so this really helps!

Hopefully we can figure this out together!

Kind regards,
Chrisker

1. what is the size of your VBK file ?
2. how many sectors are corrupted ?

HaspHL, Hello, I have the same case. were you able to find a solution?

during the time this thread is alive I've got a lot of requests to get a copy/access to the file extract.exe

what I can't understand is why does someone need to ask me to get access/copy for something that's available free of charge on the internet @veeams website