Avatar of binele
bineleFlag for Australia asked on

disaster recovery - formatted hard drive recovery how to

I'm trying to recover data from a hard drive which has been put into a Thecus NAS 4100Pro.

3 x 1TB hard drives which were originally formatted in mac osx readable. I don't know which hard drive but there are videos in there which I need to recover urgently.

The 3 hard drives have since been deployed as a RAID 5 array in a Thecus NAS 4100pro device. There is data copied into the RAID 5 array (though out of the 1TB, about 200GB is used).

Is there a way I can take each drive, mount it somehow somewhere, run some software to analyze which files I can recover?

Or is the data lost forever??
Disaster RecoveryMac OS X

Avatar of undefined
Last Comment

8/22/2022 - Mon

You can try this software (http://www.diskdoctors.net/mac-data-recovery/software.html) with the method you described. Although I would backup that 200GB of data if possible as there is no guarantee that the Thecus will like the drive after it has been mounted elsewhere..

How would I mount the hard drive? It is in some format which my mac os would not understand?

Your help has saved me hundreds of hours of internet surfing.

Try RAID Reconstructor: http://runtime.org/raid.htm
The drives were in RAID configuration in NAS and you cannot recover data in readable format simply recovering files from each drive. You need to emulate RAID now. Use the RAID reconstructor and then try to copy data out.

Binele, were the drives in a RAID before you put them in the Thecus? If they were, then yes, you would need to use a RAID emulator to get the data. If they were not, then you can just mount them drives on your Mac and use the recovery software I linked (or something similar) in my first post.

To mount a single drive you would need to put the drive into an enclosure (or open bay if it's a desktop) and plug the drive into your system. OSX will see the drive but ask you to format (initialize) it, just tell it no. The software I linked should be able to utilize the drive in it's raw format to scan for data.

Sorry, all above suggestions are no good.  This device uses an embedded LINUX kernel.  The file system is not MacOS, or NTFS.

It uses software RAID, so you are going to have to get a LINUX machine with proper file system drivers (i think it is XFS, but have not been inside the thecus so can't tell you for sure).

In any event if you do any of the above, you have zero chance of recovery.  If you are not a talented UNIX person who knows their way around a binary editor, the md driver, file system headers, then you'll need to pay somebody.

Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.

If you guys would read his actual question... he never said that the drives were originally in the Thecus RAID.. That is what I was trying to clarify on my last post. If they were not in the Thecus RAID when they contained the data he is trying to recover, he might have a chance at getting it without having to simulate RAID

"I'm trying to recover data from a hard drive which has been put into a Thecus NAS 4100Pro."

Once they go in the thecus, they were formatted using md driver to build block/XOR parity.  
Simulating the raid is pointless.

So when the XOR parity was then built, then even if the other disks had all zeros, what would happen is the non-parity disks for any chunk would not be touched but the parity drive would get over written by the XOR values

i.e.  say disk was in 3rd column, stripe size was 1MB (for easy math, stripe most likely 64K, but don't know w/o getting hands on, starting, at say 500MB ..

                      DISK0              DISK1               DISK2 [that has data writtenfrom mac, starting here]
LogicalMB        500                501                 P(500,501)
                       502             P(502+503)           503
                       P(504,505)   504                       505
                      506               507                   P(506,507)
So if is disk is disk#2, and the data he wants starts where I show, you will see  that the 503,504 chunks are in tact, but the P500/501 & P(506,507)  would have been rewritten with the parity data.

As such, waste of time it is gone forever.

Now if the situation was that he wrote the data files on the thecus from the mac, and yanked disk2, and the thecus was dead, then somebody like me could recover his data if I had all 3 disks (or even just 2 of them and there were no unreadable blocks).

If above is not the author's scenario, please clarify.

And to clarify, my earlier response was based on an understanding that you had the configuration above, then wrote the mac files from a mac host onto the thecus when the RAID 5 had already been built, so the data that you wanted to recover would be in example offsets 500-507. (And you wanted to get the data back for some reason by reading raw drives)

 If that was the case, then the data does not exist on any one disk, so that is why I said you can't recover by just yanking each disk, and unless you have that experience i mentioned, you wont be able to do it yourself.

Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy

OK sorry for the confusion ...

The 3 disks were originally seperate non related hard drives which were in mac format. Files were written to it as an external disk (I used the USB device which you can put a raw drive into). Then I bought a NAS Thecus 4100 pro. Since I had the 3 disks, I decided to make a raid 5. I put the disks into the Thecus device and then it started to do its thing. Once it was all synced up, I backed up my mac which took about 100 GB thereabouts and then another mac was backed up as well, another 100GB thereabouts.

I then realised that I had important video data on one of the disks there. So I shut it down and before I did anything more, then posted here to see if I can remove the disks one by one and figure out whether I could recover.

I know I can't mount it like a normal Mac disk as it is a linux based disk now.

My question is how should I go about trying to recover?

So engel32, the disks were not in RAID before. Your suggestion was ok. But my question is how do I mount this Linux formatted disk to my mac to run any type of software?

Thanks for all the response but if someone can clarify further, it'll be much appreciated.

Check if this Paragon ExtFS for MacOSX could help: http://download.cnet.com/Paragon-ExtFS/3000-2248_4-75300587.html

When the thecus "did its thing" it wrote parity data on every 3rd chunk of the HDD you need.  Since the chunk size is significantly smaller then the file size (which I think is 64KB), then it is a total loss.

Because that disk drive will have below pattern every 64KB, reading from beginning of HD to end of HD, every 64KB.
The ones labeled PARITY were over written with PARITY from other disks.  


There is no way to "recover", the data was actually destroyed, it was written over.  The ONLY way this would not have happened is if the thecus did not run through an initialize phase.   So if it "did it's thing" for under a minute or so, then your data is there and can be recovered, because it was not replaced.  If it took 10+ minutes, then it clearly must have overwritten, so it is gone.

Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

I accept fate of not being able to restore from an initialized drive. Thanks for the help.