.vbk File Format

[Zennher]

Hello,

Is there a source of information somewhere regarding the .vbk file format ? (magic number, header, size or any other available information ?)

Thanks for you help.

Zen

[HannesK]

Hello,
and welcome to the forums.

No, it's a proprietary format without public documentation. Just curious, what's the background of the question?

Thanks for your understanding,
Hannes

[Andreas Neufert]

No, this is not available in public. You might find some explanations in this forum on a high level.

There is a header with the optional encryption details in. Then there are metadata bank pairs and related backup data until metadata bank is full and then again a new metadata bank pair and related data. The size/offset varies because of compression.

Please share for what this data is needed, then we might have a pointed answer towards it.

[Zennher]

Hello,

We would like to know more about the format because we are researching the possibility to carve those files once they have been deleted e.g. after ransomware attacks when the attacker is deleting the backups.

Thanks & Regards

Zen

[Andreas Neufert]

Veeam supports provide these kind of services for customers directly for free (under support contract).

[Zennher]

Oh ok good to know ! and how does it work does the victim have to send you a full disk image or are you providing a tool ?

[Andreas Neufert]

Customer need to work with our support case by case.

[Zennher]

OK thanks for your feedback.

Best Regards