Reverse Engineer Unknown File Format

Question

I have thousands of old backup files from EaseUs Todo Backup. They are incremental backups saved inside a ".pbd" file (EaseUs's proprietary backup format). I've tried to get my files out using their official tools, but they dont work due to the amount of files I have. I want to write my own program to take these files out and extract them to a more common format like .zip.

I figure I'd start by using their software to backup a simple text file (with contents "hello world"), then change that text file to "hello world123" and run another incremental backup. This way I can compare the two initial files to see where the file names/contents are stored within the binary.

Here are the two test files: https://dl.dropboxusercontent.com/s/6fhqrkodz68vgv0/backups.zip

Screenshot of files: https://dl.dropboxusercontent.com/s/a4pui0hugym10xq/explorer_sWDcZaogNa.png

When I compare the two files in a hex editor, I can't seem to find where the names/contents are, and how I can parse these files in software. This is the first time I've reverse engineered anything native (I've decompiled java/c# a bunch) so any tips/advice are appreciated.

Answer 1

Sending the files through binwalk reveals a bunch of zlib-compressed chunks:

Scan Time:     2020-07-05 14:11:21
Target File:   my folder_20200704_Full_v1.pbd
MD5 Checksum:  754146f25634e3eb90ee85ba8e2dc766
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
152           0x98            Zlib compressed data, compressed
271           0x10F           Zlib compressed data, compressed
2856          0xB28           Zlib compressed data, compressed
2988          0xBAC           Zlib compressed data, compressed


Scan Time:     2020-07-05 14:11:21
Target File:   my folder_20200704_Full_v2.pbd
MD5 Checksum:  f443635bfaf4203ba0ad40adc6ae1d1f
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
152           0x98            Zlib compressed data, compressed
271           0x10F           Zlib compressed data, compressed
2859          0xB2B           Zlib compressed data, compressed
2996          0xBB4           Zlib compressed data, compressed

From there I was able to slice out each chunk and decompress it using dd and zlib-flate: zlib-flate -uncompress < <(dd skip=271 ibs=1 if=my\ folder_20200704_Full_v1.pbd) > chunk2. I can see the folder name in the first two chunks, and the last chunk reveals the file name yo.txt, but I can't see the file contents anywhere. Additionally, binwalk is unable to detect anything in the decompressed chunks. Hopefully this gets you a bit further along. :)