We have two TL2000's, an old one with LTO-5 drives and a new one with LTO-7 drives. Neither library has the Library-Managed Encryption option enabled as we didn't purchase it for either one. Our backup SW is Backup Exec 2014 and it supports the Application-Managed Encryption option, which is set on both TLs.
I have a number of archived tapes (LTO-5) on which the jobs were encrypted using BE's "hardware, otherwise software" encryption option. The presumption is that, if the LME option (hardware) wasn't available on the TL, Backup Exec would use AME (software) for these jobs, and since the key is kept within BE, the tapes would be able to be read on any PVTL unit with drives that support the tape generation.
These tapes can be read perfectly fine with the old TL, but they fail basic media catalog operations on the new TL (hardware errors being returned to BE) and cannot be read at all, so nothing can be recovered. However, I've found that if I duplicate the backup sets to "software" encrypted jobs on the old TL, the new jobs can be read on the new TL.
So it appears as if the old TL is performing LME even though we didn't purchase the option. Is that even possible? I've noticed that, in the web interface for the old TL, when these encrypted tapes are being read, the drive status changes to "decrypting," which I thought wouldn't happen unless LME were enabled. I've attached the trace of the new TL during when the encrypted tape was being read and can provide log dumps if someone wants to look into what the TLs are doing.
I was thinking that purchasing LME on the new TL would allow us to read the tapes, even though it's not on the old TL. But I don't want to spend the $$$ and find out that it doesn't work. and then also have to spend the time and $$$ on an alternative, like buying LTO-6 media and uplevelling the archives from LTO-5. Is it possible to get trials of that capability or somehow determine whether that would even work before buying it?