Post AlqHCKlcirar03GAeu by voltagex@aus.social
 (DIR) More posts by voltagex@aus.social
 (DIR) Post #AlqHCIJBrbf3NHwR3w by voltagex@aus.social
       0 likes, 0 repeats
       
       #AskFedi Does anyone have an alternative for #Macrium Reflect? I need to occasionally image my machines, Macrium is the only one I've seen with Volume Shadow Copy (Online backup) that works well.However, they've refused to release the file format and I've had a couple of images become corrupted.
       
 (DIR) Post #AlqHCIiiKi4seRsoqW by voltagex@aus.social
       0 likes, 0 repeats
       
       Grabbing a copy of NTI Backup.
       
 (DIR) Post #AlqHCJ5OyME3moUwD2 by voltagex@aus.social
       0 likes, 0 repeats
       
       That's gone well*
       
 (DIR) Post #AlqHCJVdOpD36Alt68 by voltagex@aus.social
       0 likes, 0 repeats
       
       Next up is AOMEI which looks like this and has shown me several popup ads already.
       
 (DIR) Post #AlqHCJuntFLIMEXzKS by voltagex@aus.social
       0 likes, 0 repeats
       
       At least it's using VSS.
       
 (DIR) Post #AlqHCKNABo1lmBodX6 by voltagex@aus.social
       0 likes, 0 repeats
       
       AOMEI seems to be running okay, but the "ADI" file format starts with a header of "BIFH" instead of anything I'd expect. I can't easily find a file format description.
       
 (DIR) Post #AlqHCKlcirar03GAeu by voltagex@aus.social
       0 likes, 0 repeats
       
       **Stopping for now, there's still too much I don't understand in even the uncompressed files. Samples at https://static.voltagex.org/aomei/sample.7z, 100kb download, 100MB unpacked.Files created with qemu 7 and https://www2.aomeisoftware.com/download/adb/AOMEIBackupperStd.exe (7.4.0)**Can someone ask the EU to mandate that all file formats are described publicly so I don't have to do this, as fun as it is?#ReverseEngineering Start of ADI file format:Spent way too long chasing compressed data that was actually Unicode. All strings written by the application are unicode.Header BIFHTrailer BIFTBytes between 10h and 2Fh change dramatically per fileDrive ID at 3984789 [3CCD95h] probably depends on length of file but needs more investigation because it might be a *destination* drive IDComment at 3984432 [3CCC30h]Filename / Backup name at 44hData is going to take a lot more work but if you have UNCOMPRESSED ADI files (not the default!) you MAY be able to carve your data straight out of the file.If the backup is compressed, it's zlib.
       
 (DIR) Post #AlqHCMKOv30RqCXSVM by voltagex@aus.social
       0 likes, 0 repeats
       
       And this is just crap. https://github.com/AOMEI
       
 (DIR) Post #AlqHCOLBR6ow5Cv70C by voltagex@aus.social
       0 likes, 0 repeats
       
       Acronis: Nohttps://forum.acronis.com/forum/acronis-true-image-home-forum-older-versions/tib-reader-viewer-file-specifications
       
 (DIR) Post #AlqHCR9Ezy3An2M7Iu by voltagex@aus.social
       0 likes, 0 repeats
       
       I'd appreciate some help with this at some point if anyone else is interested * scripting qemu-img and whatever tooling allows you to generate vhdx files with content in them* help understanding the compressed ADI files. "Normal" compression I can almost understand, "Max" compression looks completely random * help understanding what changes between two backups of identical drives * scripting and configuring Windows so it will stop immediately writing to mounted drives* scripting the AOMEI backup command line interface