I've got A VBK file (veeam backup & replication) where the the beginning of the file is missing
and need to reconstruct it manually (HEX) in order to be recognized by the software
I've examined a few good working file and figured that the structure is as follows
first sector - header + some unknown (yet) bytes (will not be recognized without it)
....
sector 8 index (very important, I think every byte counts)
.....
sector 104 copy of the index (not needed)
(dumb, who puts a copy of so important data so close to the source)
....
metadata
.....
data
.....
metadata
.... Etc.
what I need the most is reconstruct sector 0x08 which tells the software where everything is located (metadata, data)
I've figured it out partially (bolow) and need help with the rest
Here is A small example I've created
note if you gonna install the software
* the intallation package is huge (3.5GB)
* takes a long time to install
* denies access to the file
structure of sector 0
- Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 09 00 00 00 01 00 00 00 03 00 00 00 6D 64 35 00 <- header
........
00000100 00 00 00 00 00 00 00 09 00 00 00 00 00 10 00 00 <- don't know what it is
I dont know what 0x100-0x10F means
it seams that 0x107 is always (?) 09
on 0x10D and 0x10F i've seen different data (attached below)
----------
structure of sector 8
- Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00001000 66 4C 9C 9A 01 00 00 00 12 00 00 00 00 00 00 00
00001010 00 30 DF 07 00 00 00 00 03 00 00 00 00 00 00 00
00001020 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00
00001030 00 00 00 00 6D 00 00 00 00 00 00 00 02 00 00 00
00001040 00 00 00 00 00 00 00 00 02 00 00 00 FF FF FF FF
00001050 FF FF FF FF FF FF FF FF FF FF FF FF 01 00 00 00
00001060 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00001070 00 00 00 00 A0 0B 00 00 03 00 00 00 DF 65 2F A1
00001080 00 90 01 00 00 00 00 00 00 10 50 00 33 BD FC 89
00001090 00 A0 51 00 00 00 00 00 00 10 50 00 A7 15 4D 70
000010A0 00 B0 A1 00 00 00 00 00 00 10 50 00 00 00 00 00
here is what I've found so far
0x1000 - 0x1007 might be (?) some kind of checksum (which I dont know how its calculated)
0x1008 - 0x100F ?
0x1010 - 0x1017 file size
0x1018 - 0x101B always the same as 0x1078 -0x107B number of sections (metadata, data)
0x101C - 0x101F ? (always 00)
0x1020 - 0x102F (?) always the same
0x1030 - 0x1047 (?) different data from file to file
0x1048 - 0x106F (?) always the same (except 0x1048)
0x1070 - 0x1077 (?) always the same
0x1078 - 0x107B number of sections (metadata, data)
0x107C - 0x107F (?) differnt data from file to file
0x1080 - 0x1087 location where the first section (metadata) starts
0x1087 - 0x108B the lengths of section section (always the same)
0x108C - 0x108F (?) different data from file to file
0x1090 - 0x1097 location where the second section (metadata) starts
0x1097 - 0x109B the lengths of the section (always the same)
0x109C - 0x109F (?) different data from file to file
0x10A0 - 0x10A7 location where the last section (metadata) starts
0x10A7 - 0x10AB the lengths of last section (always the same)
0x10AC - 0x10AF if its the last its always the same (0x00)
can anyone help to figure out the rest of it ?
below is attached the beginning of the files (first 0x08 sectors) I've based my research (03 and 04.bin have a lot of sections)
alternatively does anyone know how the data is compressed (data starts @ 0x1E1F000) so I can decompress it ?