Recovery of data from slave drive in Raid 1 array

Hi all.  I don't know a lot about RAID, but someone brought me a computer that was setup with a RAID 1 array.  It's not a RAID 0 array, for speed.  This is a RAID 1 array, for redundancy.  And I'm sure about that.  I mention this because in all the posts concerning RAID, there are many responses along the lines of, "Which type of RAID array is it?," and "if it's a RAID 0 then there's no way you can recover the data".  It's a RAID 1 array.

Now that I have that established... here's the deal.  The operating system totally crashed and the RAID array stopped working.  It doesn't appear to be the result of any kind of physical damage to either of the disks (which are 180GB Seagate SATAs).  But some very weird things are going on.  

On the master disk, there's a 60GB partition showing, and 120GB of unpartitioned space.
On the slave disk, there's a 180GB partition which contains data.  Though none of this data can be seen by the OS--it can only be seen by a file recovery program.  

On the master disk, some of the data can be seen by the OS, but the majority can only be seen by a file recovery program.  We recovered about 35 GB of data on the master disk.  This was all good data that wasn't corrupted or compressed.

On the slave disk, we've found about 100GB of data with the use of a file recovery program.  According to the owner of the computer, there should be about 100GB of data stored on the array.  All of this data is corrupt.  I mean, files can't be opened using the normal programs that would open them.  Text files are full of binary characters.  What's odd, though, is that I've found bits of text in binary files, like MS-Word documents, which contain some strings of readable text, even though they're binary files.

My question is, is the data on the second drive compressed or encoded by some special RAID process?  And if so, how can we decrypt it.  Or are we going to have to setup a RAID array again to be able to recover the data?

Thanks in advance,
Gregg      
gboethinAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ppfoongCommented:

It seems that the partition table of the 2nd harddisk is corrupted. By right, in a RAID 1 system, both harddisks should look exactly the same.

When there is OS crash, the problem is not related to the RAID (if you are using hardware RAID instead of OS RAID), and the crash result will also be mirrored. In such case, you need to recover from backup copy (in most practise, from backup tapes).

RAID only protect you from hardware failure of harddisk. A proper backup system will protect your data from OS and software failure.

Since your 1st harddisk seems to have less damage from the crash, if you do not have any data backup, the best you can do is recover as much as possible from this 1st harddisk. If you have data backup, restore the RAID and recover from the backup.


gboethinAuthor Commented:
Hi, thanks for the reply.  Let me ask you a few more questions.  First off, someone told me that the slave disk in a RAID 1 array may be compressed or encoded.  Could that possibly be what the problem is?

Also, how could all of the data on the disk become corrupt?  It doesn't seem likely to me that all of the data on the disk would become corrupt.  I could see some getting lost, especially if some kind of physical damage to the disk occurred.  But in this case, all of the files on the disk are there, in their correct directories.  They're approximately the correct size, but the actual content of every file is corrupt--or maybe I should say "unreadable" by normal programs.  

In order for every single file on the disk to become corrupted, every file would have to have been written to.  This would take a considerable amount of time, with 100GB worth of files.  So what I'm saying is that I don't think all of the data on the disk was corrupted in an instant.  I think it was either:
1) Not being written correctly to the second disk the entire time
2) Compressed or encoded, which as I understand, is sometimes the case with the slave disk in a RAID 1 array.

Any more help would be greatly appreciated.  And I'm going to increase the value of this question to 500, because I think is a very difficult question.
gboethinAuthor Commented:
I'm increasing the point value to 500.  
Why Diversity in Tech Matters

Kesha Williams, certified professional and software developer, explores the imbalance of diversity in the world of technology -- especially when it comes to hiring women. She showcases ways she's making a difference through the Colors of STEM program.

ppfoongCommented:

In RAID 1, mirroring, they should be exactly the same. In fact, if they are not the same, the RAID controller will initiate a consistency check and repair to make them identical again. If the 2nd drive is compressed, the 1st drive will also be compressed.

The operating system has an area to keep track of file information, such as FAT, MFT, etc. This area keeps record on the filename, and the sector where its data is stored in. Data of the same file might be fragmented and scattered around the storage area, and the FAT or MFT will tell the OS how is the sequence of the fragmented sectors of the file. If this area is corrupted, then you will have problem accessing the files, although the actual stored data are not corrupted.

In addition, there is the partition table area, which store information about how your harddisk is partitioned. If this table is corrupted, so that it tells you your harddisk only has one single partition, while in fact it has 2, then you will have problem accessing the stored data too. And this critical area is normally as small as only one cluster.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gboethinAuthor Commented:
Thanks for the reply.  Let me ask a final question to wrap this up.  The data on the first drive wasn't corrupted.  The files were readable by their corresponding programs (MS-Word files were readable by MS-Word, etc).  The data on the second disk was corrupt.  So, with the inconsistencies in the two disks, which were setup in RAID 1 format, there was a problem all along that was causing the files on the second disk to not be written correctly.  Is that right?

Also, just to let you know, I had to use a data recovery program to find almost all the files on both drives.  Most didn't show up to the OS.  Only a few did.  

Thanks,
Gregg
Dushan De SilvaTechnology ArchitectCommented:
Dushan De SilvaTechnology ArchitectCommented:
Hello gboethin,
Did you tried with my comment?

BR Dushan
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Storage

From novice to tech pro — start learning today.