internal Firebird consistency check (cannot find tip page (165))
What it means
The transaction inventory (TIP) pages record, two bits per transaction, whether each transaction committed, rolled back or is still active. Every row version carries the number of the transaction that wrote it, and the engine looks that number up to decide which version a query sees. When a TIP page is missing, zeroed or overwritten, the engine cannot decide, and it refuses to go on: the database often does not open at all, and gbak cannot start.
The data itself is usually untouched: only the bookkeeping of transactions is gone.
First: make a copy, and work only on the copy
Stop the Firebird server, or at least make sure nothing is connected to the database. Then copy the file, together with any .delta file next to it (an nbackup lock) and the secondary files of a multi-file database. A copy taken while the server writes to the file is inconsistent, and every repair attempt changes the file it runs on. If the disk itself is failing, copy the file to another disk before anything else.
Then: try Firebird’s own tools
These come with every Firebird installation and often get a database back as a whole: indexes, triggers, users and all. On the copy:
gfix -v -full -n copy.fdb # validate, report only
gfix -mend -full -ignore copy.fdb # let gbak skip damaged records
gbak -b -v -ig -g copy.fdb copy.fbk # back up: no checksums, no GC
gbak -c -v copy.fbk restored.fdb # restore into a new database
Add -user SYSDBA -password ... as your server needs. If gbak -b completes, the restored database is the result: check the row counts of the important tables. gfix -mend throws away the records it cannot read, so compare with the original before you rely on the restored copy.
If gbak still fails: get the data out with fbrescue
fbrescue reads the database file directly, without the Firebird engine, and exports every row it can read. It does not stop at the first damaged record or page, and it never writes to the file. Download the single binary for your system from Releases (Windows, Linux, macOS; nothing to install).
fbrescue scan copy.fdb # what is damaged, by table
fbrescue export copy.fdb --out rescued --format sql # schema.sql + INSERTs per table
--format csv and --format jsonl are there too. Rows that could not be read are listed in rescued/_errors.jsonl with the page and the reason, and the exit status is 2 when anything was left out. To load the result into a new database:
isql -ch UTF8 -i rescued/schema.sql new.fdb
isql -ch UTF8 -i rescued/CUSTOMERS.sql new.fdb # and so on for each table
If you would like help, open an issue and attach the output of fbrescue report copy.fdb: it describes the damage without any of your data, and with table and column names replaced by numbers.
For this error fbrescue still exports every table. Transactions older than the oldest interesting transaction in the header are committed by definition. For newer ones whose state is lost, fbrescue takes the newest version of the row, which is right for every transaction that committed (nearly all of them), and the export says for how many rows it had to: those may include changes that were rolled back. When the inventory pages are only out of place, fbrescue finds them by scanning the file.