0

I have thousands of old backup files from EaseUs Todo Backup. They are incremental backups saved inside a ".pbd" file (EaseUs's proprietary backup format). I've tried to get my files out using their official tools, but they dont work due to the amount of files I have. I want to write my own program to take these files out and extract them to a more common format like .zip.

I figure I'd start by using their software to backup a simple text file (with contents "hello world"), then change that text file to "hello world123" and run another incremental backup. This way I can compare the two initial files to see where the file names/contents are stored within the binary.

Here are the two test files: https://dl.dropboxusercontent.com/s/6fhqrkodz68vgv0/backups.zip

Screenshot of files: https://dl.dropboxusercontent.com/s/a4pui0hugym10xq/explorer_sWDcZaogNa.png

When I compare the two files in a hex editor, I can't seem to find where the names/contents are, and how I can parse these files in software. This is the first time I've reverse engineered anything native (I've decompiled java/c# a bunch) so any tips/advice are appreciated.

1

Sending the files through binwalk reveals a bunch of zlib-compressed chunks:

Scan Time:     2020-07-05 14:11:21
Target File:   my folder_20200704_Full_v1.pbd
MD5 Checksum:  754146f25634e3eb90ee85ba8e2dc766
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
152           0x98            Zlib compressed data, compressed
271           0x10F           Zlib compressed data, compressed
2856          0xB28           Zlib compressed data, compressed
2988          0xBAC           Zlib compressed data, compressed


Scan Time:     2020-07-05 14:11:21
Target File:   my folder_20200704_Full_v2.pbd
MD5 Checksum:  f443635bfaf4203ba0ad40adc6ae1d1f
Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
152           0x98            Zlib compressed data, compressed
271           0x10F           Zlib compressed data, compressed
2859          0xB2B           Zlib compressed data, compressed
2996          0xBB4           Zlib compressed data, compressed

From there I was able to slice out each chunk and decompress it using dd and zlib-flate: zlib-flate -uncompress < <(dd skip=271 ibs=1 if=my\ folder_20200704_Full_v1.pbd) > chunk2. I can see the folder name in the first two chunks, and the last chunk reveals the file name yo.txt, but I can't see the file contents anywhere. Additionally, binwalk is unable to detect anything in the decompressed chunks. Hopefully this gets you a bit further along. :)

1
  • 1
    O wow thank you so much. I’ll definitely keep poking around. I had made sure to turn off compression for these backups so it’s weird you can’t find contents. I can see content in a hex editor – Jonathan Beaudoin Jul 6 '20 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.