ARCserve ate my email

It had been a bad few days resulting in a new building and computer equipment being required, but at least there was a backup of the data so the systems could be re-instated without too much fuss and bother, or could they? No they could not, a problem within the backup that led to a file backup being incomplete was causing the restore to fail before the all important data was reached. What was the problem, more to the point was a data recovery possible? Scenario When a physical disaster, like flood or fire impacts your business, the last thing you need are more obstacles when you try to get back on your feet and rebuild your IT infrastructure. In this particular case the company involved saw their building razed to the ground. New premises were sought and the task of rebuilding servers and restoring data from backups followed. Whilst the fire proof safe that housed the company data prevented the tapes from being completely destroyed, there were more than just physical problems to overcome. The Case Altirium received several 4mm DAT tapes from a company who's premises had burnt down. The company was quite diligent with their company data, routinely performing daily backups and storing the backup tapes in a fireproof safe. The tapes we received had some physical damage, fortunately however the damage was not too severe and after re-casing the recorded media, we were able to produce duplicate copies of the data on to new media. The duplicate tapes were returned to the company so that the data could be restored into their working environment. It was only once the restore operation was under way that the hidden problems began to manifest themselves. The accounting and financial information, which was critical to the company, was restored without any problem. The errors within the data became apparent when attempts to restore large PST files belonging to senior management, containing email and contact information, were made. During the restore of the data ARCserve was reporting an 'Invalid header signature', when such an error occurs the restore operation stops and no further data is restored. The problem with the backups had been occurring long before the problems caused by the fire. Altirium's data recovery experts began analysing the data and were quickly able to locate the point in the data where the errors were being reported. Sure enough, the ARCserve backup meta-data was indicating that a PST file of a specific size had been stored within the backup data. However, the amount of file data backed up did not match what was reported in the backup meta-data. During the restore process, when ARCserve expected to find file trailer meta-data, instead it was positioning within the file data and this is why the error was being reported. The Problem The original data had been stored on a NetWare server. To optimise space usage on disk NetWare, like other operating systems, can store files as spare. With spares files file data space can be pre-allocated within the file system but not actually used for storage until data is written in the allocated space. In this instance the Outlook PST files containing the emails were, for some reason, being flagged as being spares files but all the data existed on the tape. When sparse files occur within a backup, the backup application can generate the empty data rather than reading data from the tape. This mismatch between what was reported to be stored on the tape and what was actually stored on the tape caused the application to fail, thus leading to a tape data recovery requirement. The Solution At Altirium we develop software internally for the purpose of data recovery and data processing, and are equipped to handle data from all types of computer tapes many different backup formats. Our data recovery engineers were able to modify the recovery software to circumvent this unique problem and one that we had not previously encountered, and were able to make a complete recovery of the Outlook PST file.

For more information on ARCserve ate my email talk to Altirium Ltd