Although NTBackup is a decent backup application, it's been around for a long time. Microsoft first introduced it in 1997, and it remained largely unchanged until it was eventually retired. In addition, NTBackup was never intended to be an enterprise-class data backup utility. It was included with Windows as a way of allowing smaller organizations to back up their servers without having to invest in third-party data backup software.
Even though NTBackup is an old application, there are many organizations still using it. It's still very popular. Even today, there are numerous organizations that haven't upgraded to Windows Server 2008, and many of those organizations that continue to use legacy Windows Server operating systems also use NTBackup.
NTBackup wasn't designed for large backups
Keep in mind that there is a big difference between a small organization today and a small organization in the mid-1990s. At the time when NTBackup was originally introduced, only large organizations performed multi-gigabyte backups. Today, however, even a small data backup usually includes several gigabytes of data.
NTBackup was never designed for multi-gigabyte backups. That isn't to say that you can't create large backups with it, but my experience has been that the odds of a backup being usable decrease sharply as the size of the backup increases.
This tends to be a major problem for a couple of different reasons. First, unless an organization regularly tests their backups, the problem often goes undetected until the backup is needed, and by then it may be too late to do anything about the problem.
Sometimes a large backup will complete without errors. When you try to restore the backup, however, you may receive an error message stating that the backup file contains unrecognized data and cannot be used. You can see an example of this error message below in Figure A.
Figure A: The backup file contains unrecognized data and can not be used.
The backup that I was trying to restore in Figure A when I created the screen capture was roughly 27 GB in size. Out of curiosity, I backed up the same server again using exactly the same method. I wanted to see if the corruption occurred consistently. What I found, however, was that the backup that I created on my second attempt was valid.
Unfortunately, there is no obvious way of telling whether or not a backup is good. NTBackup behaved in exactly the same way during both the corrupt and the good backup, and neither backup produced errors. Since NTBackup won't tell you whether or not a backup is good, it is critical for organizations that depend on NTBackup to regularly test their backups.
NTBackup restore techniques
So now that we've established that NTBackup often creates corrupt backups, I'll tell you what to do if you're faced with a corrupt backup you can't restore.
If you try to restore a backup and receive the error message shown in Figure A, don't make the mistake of automatically assuming that the backup is corrupt (even though it probably is). I have seen a couple of situations in which NTBackup displayed this error message even though the backup file was not corrupt. In both of those cases, the backup file resided on a remote server, and copying the file to the server where NTBackup was running made the problem go away. Some people have even reported not being able to restore a backup that is located on an external hard disk, although I have never run into that problem myself.
Newer operating systems
When Microsoft created Windows Vista and Windows Server 2008, they retired NTBackup and created a new backup utility called Windows Server Backup. Windows Server Backup can't restore .BKF files created by NTBackup, so Microsoft created the Windows NT Backup - Restore Utility that will allow .BKF files to be restored to machines running Vista or Windows Server 2008.
Sometimes, the Windows NT Backup Restore Utility will produce the error message shown in Figure A, even if the backup isn't corrupt. This happens most often if the Removable Storage Management feature has not been enabled.
Incidentally, the Removable Storage Management feature doesn't exist in Windows 7 or in Windows Server 2008 R2. If you are using one of these operating systems, then you won't be able to successfully use the Windows Vista/Windows Server 2008 version of the Windows NT Backup - Restore Utility. Microsoft has a newer version of the utility which you can download from Microsoft's website.
What if the backup really is corrupt?
Unfortunately, Microsoft doesn't have a fix for corrupt backup files. There are some third-party software vendors that make applications that are designed to repair corrupt .BKF files. One such utility is called MS Backup Repair. Another such application is Repair My Backup.
I have found Repair My Backup does a decent job of salvaging data from a corrupt .BKF file, but that you may not be able to recover everything. Any files within the backup that are directly affected by the corruption are likely to be unrecoverable. Even so, Repair My Backup can usually get most of the data back.
Because Microsoft has retired NTBackup, I don't expect the corruption problems to ever be fixed. If you are still depending on NTBackup, I highly recommend that you test your backups on a regular basis.
About the author: Brien M. Posey, MCSE, has previously received Microsoft's MVP award for Exchange Server, Windows Server and Internet Information Server (IIS). Brien has served as CIO for a nationwide chain of hospitals and was once responsible for the Department of Information Management at Fort Knox. You can visit Brien's personal website at www.brienposey.com.
This was first published in August 2010