Solved

Accidentilly deleted Raid 5 config and need data back.

Posted on 2011-02-26
12
636 Views
Last Modified: 2012-05-11
I have a DEll Poweredge 830. It was set up with (3) 80 gig drives in a raid 5 configuration using a 6 port Raid pci controller. It had Windows Server 2003 as OS. The drives were set with 3 partitions forming (fat partition), C drive and D drive.

I was attempting to add (3) 500 gig drives in another raid 5 configuration then move an image of the first raid to the second.

However, during editing my second Raid Configuration, I had the first raid array highlighted and deleted the array and lost all data in the first Raid 5 array.

I put the array back together in the raid bios but how it is completely blank.

Anyway to recover this data? If so, what steps must I take to do so? I have a program called File Scavenger but never uset it on a Raid 5 array.

Thanks,
In Distress

0
Comment
Question by:thomasksullivan
  • 4
  • 3
  • 3
  • +1
12 Comments
 
LVL 87

Accepted Solution

by:
rindi earned 250 total points
Comment Utility
You could try the tools from runtime.org, first the raid reconstructor which makes images of each disk and then tries to put them together again as an array (in a file). After that you would have to run getdataback on that pseudo array to find the files you need.

http://runtime.org

You will need plenty of space on extra HD's for this (at least the same size the array was, plus additional space for the data you are going to extract). Of course you'll have to reinstall the OS, and once setup you should be able to copy back the data you need.
0
 
LVL 87

Expert Comment

by:rindi
Comment Utility
What I forgot to add above is that you will need to have the disk in a non raid environment to be able to see them with those tools.
0
 
LVL 32

Assisted Solution

by:PowerEdgeTech
PowerEdgeTech earned 250 total points
Comment Utility
A utility like rindi has recommended is what you'll need to use.  Assuming you are using a CERC controller, there is no way to recreate the array without initializing it.  That said, the fact that you did recreate the array leaves less hope that you'll get anything back.  Good thing about raidreconstructor is you can try it for free and only pay for it if there is something to recover.
0
 

Author Comment

by:thomasksullivan
Comment Utility
Yes, I reinitiated each drive and then re-established the RAID 5 array. So I probably destroyed the partitions. Is there any hope?
0
 

Author Comment

by:thomasksullivan
Comment Utility
I thought maybe I could re-establish a new RAID 5 with new drives and reinstall the OS. Then using the original drives, recreate a 2nd RAID 5 array and try and run File Scavenger on the drives. Does this sound reasonable or hopeless?
0
 
LVL 32

Expert Comment

by:PowerEdgeTech
Comment Utility
If you MUST recover this data, then call data recovery services like OnTrack or Drive Savers and see what options they can give you.  If it would just be nice to without spending $$$$, then try RAID Reconstructor.  There is always hope ... but probably not much hope by doing it yourself.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 32

Expert Comment

by:PowerEdgeTech
Comment Utility
You could install an OS on another drive/array and see if you can access anything on the the RAID 5, but it's not likely.  The problem is, on this controller, every time you create a new RAID array, it does a background initialization of the array (not to be confused with initializing the drive), effectively overwriting the existing RAID structure with the new one.  Now, if they match reasonably well, you might be able to get some back, but if not, then ... you won't.  I'm not familiar with File Scavenger, so I would recommend rindi's method and RAID Reconstructor if you must try it yourself.
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
It depends on how you reinitialized the array .. some controllers have effectively a short & long initialize (foreground or background).
The short one is nothing more than a parity rebuild.  If you built the drive EXACTLY as before, then you have zero data loss, and everything would be fine.   The long one puts zeros on all data blocks at the same time.

So if the data is visible, you did the short one.  If it isn't, you did the long one.  If you did the long one, then don't bother with raid reconstructor, it is gone in same way as if you wrote all zeros to a non-RAID disk.  A data recovery lab would also be a waste of money.  Technically it could be recoverable, but only by law enforcement and hundreds of thousands of dollars worth of computer time.

0
 

Author Comment

by:thomasksullivan
Comment Utility
It only took about 1 second to initialize the 3 drives when I did it but here is where I am.

I took the 3 drives and put them in another machine. Windows 7 (64)  wanted to initialize them so it could see them and I did. Now that I could see the drives, I downloaded Raid Recovery for Windows and it saw all the drives and I selected the 3 that are in the original Raid 5 array. Using the default settings, it found the RAID 5 array and told me which order the drives were...
Drive 1: DISK2
Drive 2: DISK0
Drive 3: DISK3

However when I selected finish to move to the next window,  the window opened and it is blank.

So I ran File Scavenger 3.0 and told it the proper RAID 5 Drive order and it scanned the drives and recovered all the folders and files but many were corrupt. The main database I needed was recovered and reports the proper size and date etc... but will not open yet.

I am not sure about setting the RAID 5 settings for recovery other than default so I am feeling like I might have some hope here,  Any other help anyone can give with these new facts?
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
you aren't going to be happy .. but this is what happens when you try a DIY solution, in-place with freeware.   a recovery lab would have gotten your data back. highly likely investing a few hundred in runtime.org would have also.

if you did the recovery in place, i.e. instead of cloning on scratch drives ... then the data is gone forever.

a binary editor and XOR parity checker would reveal if your freeware botched the block size, ordering, or both.


0
 

Author Comment

by:thomasksullivan
Comment Utility
I do not mind spending some money, I am just trying to get my data back and came here for help doing so. The File Scavenger I purchased a Professional License for since it supported RAID 5 recovery. It is non destructive to the data on the drives and I have not written to or modified the three original drives other than try to re-setup the original ARRAY.
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
I thought youb reconstructed using the raid recovery ... that is where it went wrong. get that incorrecct and file recovery will sometimes 'recover' but you have full data loss. example, if stripe size is incorrectly guessed as a multiple of what it should be.
get a binary editor and manually inspect a large text  file at least 2 times the stripe size.

if it is wrong, then you have 100 percent data loss.
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Join & Write a Comment

This article is in response to a question (http://www.experts-exchange.com/Networking/Network_Management/Network_Analysis/Q_28230497.html) here at Experts Exchange. The Original Poster (OP) requires a utility that will accept a list of IP addresses …
The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now