[File] [PATCH] of Magdir/archive for Acronis True Image backup (*.tib)

[Jörg Jenderek]

Hello,

some day ago i run a tree map utility on my disks to look for disk space
"eating" files. Finally i also find Giga bytes examples with file name
extension "tib". Such examples are described by the file command
version 5.35 only as "data".

The File Identifier TrID ( see http://mark0.net/soft-trid-e.html ) on
the other hand describes such examples as "Acronis True Image (v13)".

With verbose option -v this software show URL with information about
file format on Wikipedia for such examples:
http://en.wikipedia.org/wiki/TIB_(file_format)
So i use that URL as reference.

Acronis produce backup software with names like "True Image".
Depending on used configuration this software makes backup of
drives/partitions and stores file content together with some meta
information as files with name extension "tib" inside directory "Meine
Backups" for german localized variant on backup drive with human
readable names like "RAMDISK-40MB_FAT16_full_b1_s1_v1.tib" or with
alphanumeric names like "AAC1.TIB" inside "Acronis Secure Zone" ( FAT32
partition with ID type 0xbc). So i also add website page of manufactory.
That is:
	http://www.acronis.com/

Because container stuff for file command is handled by Magdir/archive i
started to add magic lines there.
First i used magic found in trid database ( tib-TrueImage-v13.trid.xml
inside triddefs_xml.7z). This is now expressed by line like:
 0	ubequad	0xce24b9a220000000	
According to Windows registry file type declaration "tibfile" for tib
name extension i choose as describing text "Acronis True Image backup".
Afterwards name extension and user defined mime type is now displayed by
lines:
 !:mime	application/x-acronis-tib
 !:ext	tib

The backup file format is in a proprietary format. So the format is
different depending on version. So supplied magic only applies to
version in some range. I only tested True Image 2013 Build 5962 and 2019
Build 14110. And according to trid database (tib-TruImage.trid.xml )
older versions (about year 2007) use other magic patterns.

So i myself look for more fields to extract from tib file by looking for
human readable strings. At the end of tib images some informational
strings like "\Device\0000011e" and "\Device\HarddiskVolume39" are
stored. The offset and length are varying. So i was not able to get
reliable magic lines and add my effort lines only as comments.

After applying the above mentioned modifications by patch
file-5.35-archive-tib.diff then all such examples are
described by Magdir/archive like:
AAA1.TIB:				Acronis True Image backup
AAB1.TIB:				Acronis True Image backup
AAB2.TIB:				Acronis True Image backup
AAC1.TIB:				Acronis True Image backup
Ext-35GB-empty_full_b1_s1_v1.tib:	Acronis True Image backup
FAT32_7GB_empty_full_b2_s1_v1.tib:	Acronis True Image backup
RAMDISK-40MB_FAT16_full_b1_s1_v1.tib:	Acronis True Image backup

I hope my diff file can be applied in future version of
file utility for other users.

With best wishes
Jörg Jenderek
-- 
Jörg Jenderek


-------------- next part --------------
--- file-5.35/magic/Magdir/archive.old	2018-04-25 00:19:45 +0000
+++ file-5.35/magic/Magdir/archive	2018-11-30 03:49:39 +0000
@@ -1428,2 +1428,27 @@
 # LyNX archive
 56	string	USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE	 LyNX archive
+
+# From: Joerg Jenderek
+# URL: http://www.acronis.com/
+# Reference: http://en.wikipedia.org/wiki/TIB_(file_format)
+# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110
+0	ubequad		0xce24b9a220000000	Acronis True Image backup
+!:mime	application/x-acronis-tib
+!:ext	tib
+# 01000000
+#>20	ubelong		x			\b, at 20 0x%x
+# 20000000
+#>28	ubelong		x			\b, at 28 0x%x
+# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
+# ???
+# strings like "\Device\0000011e" "\Device\0000015a"
+#>0	search/0x6852300/cs	\\Device\\
+#>>&-1	pstring		x			\b, %s
+# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39"
+#>>>&1	search/180/cs	\\Device\\
+#>>>>&-1	pstring		x			\b, %s
+#>>>>>&0	search/29/cs	\0\0\xc8\0
+# disk label
+#>>>>>>&10	lestring16	x		\b, disk label %11.11s
+#>>>>>>&9	plestring16	x		\b, disk label "%11.11s"
+#>>>>>>&10	ubequad	x			%16.16llx