Yesterday I was alerted to a broken software raid on one of our production servers (Win Server 2003). The mirrored raid contained 1 logical drive (partiion d) containing purely data.
I'm very familiar with hardware raid rebuilding procedures on different hardware, but have never dealt with software raid. I performed the usual steps:
1) Identified problem drive ( in this case it was showing as 'missing' in disk management )
2) Powered down, removed power, and replaced this drive with brand new drive.
3) Booted into Windows, confirmed the new drive was showing up and remaining half of mirrored raid was online.
4) Removed mirror from 'missing' disk, removed 'missing disk', converted new disk to dynamic, and started rebuild of mirror.
Today I was informed a folder (2009 reports) was missing on one of the shares (share contains reports organized in subfolder by year, then month, with daily files) When I investigated I found the ending months of 2008 also missing, and some of the daily excel spreadsheets missing from November. (Last report was on 11/17/08)
After seeing this I checked another folder, and could not find a subfolder I created (probably has not been modified since november). Needless to say I need some idea of what happened by morning. I suspect it may be simply file structure damage, but I'd like additional imput.
I'm including a dmdiag report I ran on the server a few minutes ago.
(maybe I'll finally get the time and budget to flesh out a real disaster recovery plan I've been bringing up since I took over internal network administration...)
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
i recommand at first create an image of existing mirror volume to another temporary hard drive ,and then you can use easy recovery pro application to recover all your lost file and folder specially if your file system is NTFS you can find easy recovery pro application trial version from http://www.ontrackdatareco
please keep original failed member hard drive in safe place maybe you have to rcover some of your folder from that (if it isdetected in BIOS)
Solution:
Symantec Ghost restored the file structure (mft) automatically prior to ghosting. All data was present on the ghost.
The motherboard was the cause of the raid failure and data loss during rebuild. One of the sata drives (onboard sata) was randomly disappearing after being replaced. I also started noticing memory write errors.
I swapped the motherboard with the advanced rma replacement from Intel and all is well.
Business Accounts
Answer for Membership
by: rynoxPosted on 2009-01-20 at 19:08:14ID: 23426553
As you I would suspect file structure damage, does chkdsk show any errors? I'm wondering if whatever took out your drive, or the failure of the drive itself caused the damage. Hopefully you have backups....