Wed, 18 Feb 2004 --

OK, I think I've made some interesting findings.  First off, let's take 
a look at my MS Backup for Win95 applet findings.  Here's a snippet from 
a hexdump (hexdump -C) of the qic file written to disk by the MS-Backup applet:

00000000  56 54 42 4c 03 00 08 00  54 45 53 54 20 4f 4e 45  |VTBL....TEST ONE|
00000010  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20  |                |
*
00000030  20 20 20 20 38 6f 3a 44  24 01 71 00 06 00 43 4d  |    8o:D$.q...CM|
00000040  53 00 00 00 00 14 00 00  00 00 46 00 00 01 00 00  |S.........F.....|
00000050  00 00 00 00 01 05 12 1f  02 03 1a 0b 1c 16 00 00  |................|
00000060  9e 29 04 00 00 00 00 00  00 00 00 00 00 00 00 00  |.)..............|
00000070  00 00 00 00 00 00 00 00  00 00 c0 00 81 07 00 00  |..........�.....|
00000080  00 00 00 00 00 00 00 00  e9 73 66 0c f0 41 b0 00  |........�sf.�A�.|
00000090  ff c0 f0 00 00 0a 00 12  40 f8 ff 3c 8d 9d f0 0e  |���.....@��<..�.|
000000a0  00 02 18 f3 05 fe 40 80  00 a0 00 43 00 0e 80 02  |...�.�@..�.C....|
000000b0  90 00 0b 49 e2 09 c5 78  80 33 fe 49 93 36 08 f1  |...I�.�x.3�I.6.�|
000000c0  98 6b d8 61 ad 79 08 49  11 f5 f3 cc 00 08 42 7f  |.k�a�y.I.���..B.|
000000d0  9f 4f cb 14 14 15 62 d2  06 42 13 20 85 98 8c 0b  |.O�...b�.B. ....|
000000e0  00 08 40 02 7e 09 2a 00  09 98 64 8e 00 17 00 31  |..@.~.*...d....1|
...
00025a30  00 00 00 00 00 0a 00 00  00 00 00 00 00 00 00 1c  |................|
00025a40  00 00 00 00 00 00 00 00  00 00 00 00 00 50 ab 2d  |.............P�-|
00025a50  40 00 00 00 00 22 39 ea  34 00 00 00 00 18 00 56  |@...."9�4......V|
00025a60  00 49 00 44 00 45 00 2d  00 43 00 44 00 44 00 2e  |.I.D.E.-.C.D.D..|
00025a70  00 53 00 59 00 53 00 02  00 00 00 00 00 00 00 00  |.S.Y.S..........|
00025a80  00 09 00 00 22 39 ea 34  00 00 00 00 18 00 56 00  |...."9�4......V.|
00025a90  49 00 44 00 45 00 2d 00  43 00 44 00 44 00 2e 00  |I.D.E.-.C.D.D...|
00025aa0  53 00 59 00 53 00 00 00  00 00 00 00 00 00 00 00  |S.Y.S...........|
00025ab0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0002b880

Here's the exact same backup job sent to a TR-1 (Iomega POS 800 internal) 
which was then bit-copied from the tape (dd if=qft0 of=test_one.mstape):

00000000  00 00 00 00 00 00 00 00  e9 73 66 0c f0 41 b0 00  |........�sf.�A�.|
00000010  ff c0 f0 00 00 0a 00 12  40 f8 ff 3c 8d 9d f0 0e  |���.....@��<..�.|
00000020  00 02 18 f3 05 fe 40 80  00 a0 00 43 00 0e 80 02  |...�.�@..�.C....|
00000030  90 00 0b 49 e2 09 c5 78  80 33 fe 49 93 36 08 f1  |...I�.�x.3�I.6.�|
00000040  98 6b d8 61 ad 79 08 49  11 f5 f3 cc 00 08 42 7f  |.k�a�y.I.���..B.|
00000050  9f 4f cb 14 14 15 62 d2  06 42 13 20 85 98 8c 0b  |.O�...b�.B. ....|
00000060  00 08 40 02 7e 09 2a 00  09 98 64 8e 00 17 00 31  |..@.~.*...d....1|
...
000259b0  00 00 00 00 00 0a 00 00  00 00 00 00 00 00 00 1c  |................|
000259c0  00 00 00 00 00 00 00 00  00 00 00 00 00 50 ab 2d  |.............P�-|
000259d0  40 00 00 00 00 22 39 ea  34 00 00 00 00 18 00 56  |@...."9�4......V|
000259e0  00 49 00 44 00 45 00 2d  00 43 00 44 00 44 00 2e  |.I.D.E.-.C.D.D..|
000259f0  00 53 00 59 00 53 00 02  00 00 00 00 00 00 00 00  |.S.Y.S..........|
00025a00  00 09 00 00 22 39 ea 34  00 00 00 00 18 00 56 00  |...."9�4......V.|
00025a10  49 00 44 00 45 00 2d 00  43 00 44 00 44 00 2e 00  |I.D.E.-.C.D.D...|
00025a20  53 00 59 00 53 00 00 00  00 00 00 00 00 00 00 00  |S.Y.S...........|
00025a30  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0002b800

Which is pretty neat if you ask me.  It appears, in this case, that all that
is needed is to manufacture the VTBL entry.

_______________________________________________________________________________

I have two other formats that I'm looking at getting running as well.  The
first application is Central Point Backup for DOS/Win3.1.  Unfortunately, 
I couldn't get an exact copy of the tape file as the Iomega POS Tape 250 
didn't even light up when I plugged it in.  I may play with that some more 
(does it only respond when there's floppy seek at bootup by the BIOS?).  
However, I've got plenty of cpbackup tape images to play with and I can infer
a lot of information.  For instance, when CP Backup writes the backup to a
file instead of the tape, it writes three (types of) files:  cpbackup.001, 
cpbackup.dir, and cpbackup.inf.   The cpbackup.001 (and I assume if I crossed
volumes, like D:\, E:\ etc etc it would make .002, .003 etc etc) seems to be
the actual data file.  The cpbackup.dir is a directory listing and I haven't
figured out if the cpbackup.inf file has any actually useful information in
it, since it's only 27 bytes (in this specific instance).  Here it is in 
it's entirety:

00000000  01 49 43 50 01 00 00 00  00 00 ff ff ff ff 00 00  |.ICP......����..|
00000010  00 00 00 00 00 00 00 00  00 00 00                 |...........|
0000001b

In any case, it appears to me that a CP Backup tape volume consists of a 
leading section of a directory entry (that's equivalent to cpbackup.dir)
and the data section included after.  Looking at the disk data file (vs 
tape image), I can't ascertain if it is supposed to be unformatted tape 
data (see my tape_format_data information file) or is a completely 
different format.  Maybe if I can get my Iomega POS Tape 250 working . . .

In my oldest archive I have some sort of a directory entry at the beginning
of the file followed by a section starting as follows:

00024400   E2 43 02 00  EF 73 66 0C  F0 40 28 3A  90 44 1B 45  .C...sf..@(:.D.E
00024410   E8 D4 F0 03  02 01 89 24  F1 71 10 9E  53 00 3A 46  .......$.q..S.:F
00024420   A0 10 30 53  20 E0 7F FF  FF FF FF FF  FF FF FF C9  ..0S ...........
00024430   FE FF C5 78  60 7F D8 5C  89 0F 08 C0  22 E4 40 B8  ...x`..\....".@.
00024440   5F 85 42 C2  DC 28 89 1B  0C 40 21 E1  72 3C 0C 33  _.B..(...@!.r<.3
00024450   00 8C D9 28  E6 C8 19 1C  C1 45 8D 8F  00 04 70 78  ...(.....E....px

And from a different, two tape archive:

00024400   E2 43 02 00  F1 73 66 0C  F0 40 28 3A  90 44 1B 45  .C...sf..@(:.D.E
00024410   E8 D4 F0 03  02 01 89 24  F1 71 4C B2  53 00 3A 46  .......$.qL.S.:F
00024420   A0 10 30 53  20 E0 FF FF  FF FF FF FF  FF FF FF C9  ..0S ...........
00024430   FE FF 88 5F  FF 0B 91 21  E1 18 04 5C  88 17 0B F0  ..._...!...\....
00024440   A8 58 5B 85  11 23 61 88  04 3C 2E 47  81 86 60 11  .X[..#a..<.G..`.
00024450   9B 25 1C D9  03 23 98 28  B1 B1 E0 00  8E 0F 1E 80  .%...#.(........

I also found the same structure in a third CP Backup tape image.  

I am beginning to wonder if I could create a VTBL header for these data 
sections as well or if this is all just a coincidence.  I am beginning to 
be able to determine CP Backups from others.

_______________________________________________________________________________

Finally, the most incomprehensible format I've run into so far is the 
Norton Backup from Norton Desktop (I think).  I'll save that for some other 
day though.  The Seagate (Arcada) Backup Exec program will only write to tape.
I think I might attempt to attach a SCSI tape to the test machine and see
if the tape images differ from the images made by the Iomega Ditto (POS) 800.
Perhaps it's time to invest in a copy of VMware for further testing.