Open a Veeam backup on Windows and copy individual guest files straight out of it. The extractor reaches past the virtual disk that the free utility stops at, so the result is documents rather than a VMDK to mount. No Veeam server takes part in the process.
Version 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server
A Veeam backup is a full .vbk plus its increments, so the chain has to be read together before a guest file resolves at a chosen restore point.
Inside the backup
What the VBK file extractor resolves from a Veeam restore point, before any guest file is written out.
A .vbk full, the .vib and .vrb increments and the .vbm metadata are read together. The extractor follows the restore point chain so the state of a guest file at the chosen point resolves across the set.
The free Veeam extract utility hands back a VMDK you then have to mount. This reaches through the virtual disk to the guest file system inside and copies the documents out directly.
Nothing from Veeam Backup and Replication has to be installed or licensed. There is no console to stand up and no repository to register, so an orphaned backup file opens on its own.
Veeam stores its blocks compressed and deduplicated inside the VBK. Those blocks are decompressed and reassembled on the way out, so what lands on disk is the original file, not a packed block.
The guest inside a Veeam backup can be an NTFS Windows machine or an ext4 or XFS Linux one. Both file systems are read from the block store, so the source operating system does not decide whether the backup opens.
The .vbk and its increments are only ever read, never written. A production restore point stays byte for byte what it was, which matters when the same backup still has to satisfy an audit.
The restore point chain is read once, so the current version of a guest file resolves without standing up a Veeam server.
Run the Free DemoFive steps with the VBK file extractor, from an unreadable backup to the guest files back on disk
Open File takes one backup, but use Open Folder here and point it at the directory holding the whole job. Veeam writes a chain, so the file you want may depend on the ones around it.
Identification comes from the binary signature in the file header rather than the extension, so a renamed backup still opens. The panel reports it as a Veeam backup and tells you whether this file is a full or an increment.
Each machine in the backup is listed, then the MBR or GPT partition table on its virtual disk, then the filesystem on each partition. NTFS, FAT and ext volumes are all browsable.
Type a file name into the search box or expand the machines one by one, then tick only the entries required. A 2 TB backup does not have to come out in full to retrieve one mailbox export.
The output keeps the folder layout the guest filesystem recorded, along with the created and modified dates on each file. Nothing is written back into the .vbk at any point.
Only enough for what you ticked. Extracting the virtual disk first needs room for the whole disk. A thin provisioned disk expands to its full declared size on the way out, so a 500 GB volume holding 60 GB of data lands as 500 GB.
Not a folder of files. Whole machines, each with its own virtual disk, with the guest documents several layers down. A few unrelated programs, such as certain CAD and e-book applications, also use the .vbk extension, so the first thing to confirm is that the file came from Veeam.
Machines
What the file opens onto
One backup job can cover many virtual machines, so the file opens onto a list of machines before it opens onto anything you recognise. Pick the one you need and carry on down.
Virtual disks
Where the free utility stops
Inside each machine sits its disk, VMDK on VMware vSphere or VHDX on Hyper-V, with a partition table inside that. This is the layer the free utility hands you and stops at.
Guest files
The documents themselves
The filesystem on each partition holds the documents, databases and mailbox exports. Reading it is what turns a backup file into a folder tree you can search.
The free Extract Utility stops at layer 3. It writes the virtual disk out, at full size if the disk was thin provisioned. A second tool has to mount that before anyone sees a file.
A VBK file extractor reads all five. The partition table and the filesystem are parsed in place, so layer 5 is reachable without writing layers 3 or 4 anywhere.
Yes. Veeam ships a free Extract Utility and it works. There is one catch.
It gives you the virtual disk, not your files. You still need a second tool to mount that disk before you can reach one document. A VBK file extractor skips that step.
Getting to one file
Two steps
Pull the VMDK out, mount it with another tool, then go looking. Room needed for the whole disk.
One step
Open the VBK, find your file, tick it, export. Room needed for what you ticked.
Veeam ships two free options, extract.exe on the command line and Veeam.Backup.Extractor.exe with a window. Both are worth trying before you pay for anything. Each one stops at a different place.
| Route | Opens VBK |
Guest files |
What it gives you | The catch |
|---|---|---|---|---|
| Veeam Extract Utility Free |
A small standalone download for Windows and Linux that pulls the VMDK, VMX or VHDX files out of a VBK, VIB or VRB | It stops at the disk. You get a VMDK or VHD and then need a second tool to mount it before reaching one file. A thin provisioned disk comes out at its full size rather than its used size. Veeam also documents that the utility cannot read backups held on a scale-out repository | ||
| Veeam Community Edition Free |
The full product with every restore option, including file level restore straight from a backup | A backup suite installed and configured on a working machine, with the repository imported, to retrieve a few files | ||
| 7-Zip and archive tools Free |
Nothing at all. A VBK is a disk image container, not a compressed archive | The container is proprietary and the virtual disk inside it needs a filesystem reader, which archive tools do not have | ||
| BitRecover Backup Extractor Free demo |
Opens the file in place, walks into the virtual disk and extracts only the guest files you tick | Not a repair tool. It does not restore a machine. It reads and extracts |
Use the Extract Utility when you want the whole disk back. Use Community Edition when you can stand up a console. VBK extractor software is for the times when you want one file and neither is worth the effort.
The backups outlive the infrastructure that made them more often than anyone plans for.
A repository gets archived to a NAS and the hosts are decommissioned. An MSP hands over a drive of VBK files at the end of a contract. A licence lapses, a server is rebuilt or the one person who knew the console has left. The files are intact in every one of these cases. What is missing is somewhere to point them at.
Standing up a Veeam server to read one archived repository is a large amount of work for a small amount of data. That is the gap VBK extractor software fills.
Veeam backups sit in the Professional edition, along with the other enterprise formats.
Professional costs $99 once and licenses up to 10 machines for good, with a year of updates and support behind it. That edition also takes in Acronis, ShadowProtect, Duplicati, Bacula and UrBackup, tape hardware, standalone virtual disks and the filesystems those disks carry.
Buy Professional $99 Compare all editions
Everything described here reflects Backup Extractor software version 26.7. BitRecover has been building data recovery and format conversion tools since 2011.
This is the part that catches people out. Veeam offers forward incremental, forever forward incremental and reverse incremental. The VBK does not sit in the same place in all three.
Forward incremental, the VBK is the oldest point
Full
.vbk
Monday
Increment
.vib
Tuesday
Increment
.vib
Wednesday
Increment
.vib
Thursday, newest
Reverse incremental, the VBK is the newest point
Rollback
.vrb
Monday, oldest
Rollback
.vrb
Tuesday
Rollback
.vrb
Wednesday
Full
.vbk
Thursday, newest
Same extension, opposite ends of the timeline
Guessing from the extension
Opening the VBK because it sounds like the main file can land you on Monday when you wanted Thursday.
Reading the dates
Load the folder, then pick the restore point by its backup date rather than by which extension it carries.
Veeam has deprecated reverse incremental in current releases, but repositories built years ago are still full of .vrb files, which are exactly the backups people come back to when the server is long gone.
What people want to know before opening a repository with no console attached
Yes. Veeam publishes a free standalone Extract Utility that opens a VBK without the server. Community Edition gives full restore options at no cost. Both are worth trying. The gap they leave is that the Extract Utility hands you the virtual disk rather than the files inside it, so a second mount step follows before you reach one document.
A VBK is a full backup. A VIB is a forward incremental, holding the blocks that changed since the file before it. A VRB is a reverse incremental, holding the blocks that were replaced when the full backup was rolled forward. A VBM alongside them is the metadata that describes the chain. All three are read here, so you do not need to work out which is which before you start.
It depends on the backup method, which is why guessing from the extension goes wrong. In a forward incremental chain the VBK is the oldest point and the newest data sits in the last VIB. A synthetic full or an active full inserts a new VBK along the way. In a reverse incremental chain the VBK is the newest point and the VRB files run backwards from it. Load the folder and choose the restore point by its date.
The most common reason is where the backup lives. Veeam states in its own documentation that the utility cannot read a backup sitting on a scale-out repository. That is how many larger environments are built. The files themselves are fine. A standalone extractor tool that reads them from the folder is not affected by how the repository was configured.
Keep the folder together. A VIB carries only what changed since its predecessor, so it cannot be read on its own. Point Open Folder at the entire job directory, not a single .vib pulled from the middle of the chain.
Yes. That is the main practical difference from the free utility. The partition table and the filesystem inside the virtual disk are read directly, so you can search for a file name, tick that one item and export it. You need free disk space for what you ticked, not for the whole disk.
Yes. This is where the free utility struggles most. A Veeam Agent backup of a physical server holds a raw disk image rather than a VMDK or VHDX, so the extract utility hands you an image file with no structure you can browse. Turning that into folders needs logic that understands volumes and partitions. That is what a VBK file extractor does, so an agent backup opens the same way a virtual machine backup does.
An encrypted backup is detected and reported when it loads, but it is not decrypted. Where the password is still known, strip the encryption in Veeam first and open what comes out. This tool reads backups. It does not break encryption.
The VBK extractor opens the backup, confirms the format and lists every machine, disk and file inside it. Export is the one action held back until you buy. Listing is enough to tell you whether the repository is worth paying to open.
No. The repository is opened for reading only, so every file in it is exactly as it was when you started. Nothing leaves the machine either, which means a second pass a month later gives the same result.
Download the VBK extractor tool and open the Veeam backup that has been sitting on the archive drive. If the machines and files are listed, the full version will write them out.
Free Demo Download Purchase Now
Version 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server · 30 day money back
Every format the engine reads, from tape and disk images through to forensic containers
If the backup on the archive drive turns out to be an Acronis image rather than a Veeam one
For CPIO archives, where eight header layouts share one extension