[File] [PATCH] of Magdir/archive for Acronis True Image backup (*.tib)

[Christos Zoulas]

On Nov 30,  5:01am, joerg.jen.der.ek at gmx.net (=?UTF-8?Q?J=c3=b6rg_Jenderek?=) wrote:
-- Subject: [File] [PATCH] of Magdir/archive for Acronis True Image backup (*

| This is a multi-part message in MIME format.
| --------------61A62E047991B36344C48D99
| Content-Type: text/plain; charset=utf-8
| Content-Transfer-Encoding: 8bit
| 
| Hello,
| 
| some day ago i run a tree map utility on my disks to look for disk space
| "eating" files. Finally i also find Giga bytes examples with file name
| extension "tib". Such examples are described by the file command
| version 5.35 only as "data".
| 
| The File Identifier TrID ( see http://mark0.net/soft-trid-e.html ) on
| the other hand describes such examples as "Acronis True Image (v13)".
| 
| With verbose option -v this software show URL with information about
| file format on Wikipedia for such examples:
| http://en.wikipedia.org/wiki/TIB_(file_format)
| So i use that URL as reference.
| 
| Acronis produce backup software with names like "True Image".
| Depending on used configuration this software makes backup of
| drives/partitions and stores file content together with some meta
| information as files with name extension "tib" inside directory "Meine
| Backups" for german localized variant on backup drive with human
| readable names like "RAMDISK-40MB_FAT16_full_b1_s1_v1.tib" or with
| alphanumeric names like "AAC1.TIB" inside "Acronis Secure Zone" ( FAT32
| partition with ID type 0xbc). So i also add website page of manufactory.
| That is:
| 	http://www.acronis.com/
| 
| Because container stuff for file command is handled by Magdir/archive i
| started to add magic lines there.
| First i used magic found in trid database ( tib-TrueImage-v13.trid.xml
| inside triddefs_xml.7z). This is now expressed by line like:
|  0	ubequad	0xce24b9a220000000	
| According to Windows registry file type declaration "tibfile" for tib
| name extension i choose as describing text "Acronis True Image backup".
| Afterwards name extension and user defined mime type is now displayed by
| lines:
|  !:mime	application/x-acronis-tib
|  !:ext	tib
| 
| The backup file format is in a proprietary format. So the format is
| different depending on version. So supplied magic only applies to
| version in some range. I only tested True Image 2013 Build 5962 and 2019
| Build 14110. And according to trid database (tib-TruImage.trid.xml )
| older versions (about year 2007) use other magic patterns.
| 
| So i myself look for more fields to extract from tib file by looking for
| human readable strings. At the end of tib images some informational
| strings like "\Device\0000011e" and "\Device\HarddiskVolume39" are
| stored. The offset and length are varying. So i was not able to get
| reliable magic lines and add my effort lines only as comments.
| 
| After applying the above mentioned modifications by patch
| file-5.35-archive-tib.diff then all such examples are
| described by Magdir/archive like:
| AAA1.TIB:				Acronis True Image backup
| AAB1.TIB:				Acronis True Image backup
| AAB2.TIB:				Acronis True Image backup
| AAC1.TIB:				Acronis True Image backup
| Ext-35GB-empty_full_b1_s1_v1.tib:	Acronis True Image backup
| FAT32_7GB_empty_full_b2_s1_v1.tib:	Acronis True Image backup
| RAMDISK-40MB_FAT16_full_b1_s1_v1.tib:	Acronis True Image backup
| 
| I hope my diff file can be applied in future version of
| file utility for other users.

Added, thanks!

christos