This is a set of tools for reading the contents of Acronis True Image backup files (in particular the ones with file extensions .tib and .tib.metadata)
Target features:
- Verification of backup file integrity
- FUSE file system mounter for viewing file-based backups
- Loop device style-interface for reading backups of full disks/partitions
Reversing Engineering TODOs:
- Encryption
- Most of the Windows format spec
- Some parts of the Mac spec (see the source code for gaps)
- Compile nodejs 10 from source (see this commit's message for more details) and install it
npm installto get dependenciesnpm run buildto compile the typescriptnpm installnode dist/index.js, you can put any operations you want to do into this file
The objective is to support all versions of the file format. As of right now the Mac and Windows versions produce relatively different file formats (thus likely why True Image does not natively allow for cross-os archive viewing).
Judging by the backwards compatibility information located here (https://kb.acronis.com/tib), the following distinct variants of the file format exist in the wild (each number listed below is the version year of True Image):
- Windows
<= 2012 - Windows
>= 2013 and <= 2014 - Windows
>= 2015 to present - Mac OS
all years
Going along with the True Image documentation here: https://kb.acronis.com/content/1772, we will use the following top-level terms to describe the containers:
-
Archive- A complete chain/group composed of all backup files over time for a single configuration
- Composed of
Slices
-
Slice- Represents a single point in time and a single set of files
- Composed of
Volumes (usually just 1 unless it is being split up into smaller parts) - NOTE: In the case of Mac backups, multiple slices may reference the same volume
-
Volume- A single
.tibfile. Stored the actual file and metadata information
- A single