Copied files from NAS are corrupt. How to fix?

[bubblebeat]

Hi,

I am seeing a weird and worrying problem. I had a NAS on which I stored all sort of documents (mp3, movies, jpg, pdf...)
I upgraded my NAS by adding a HD and I rebuild the RAID from RAID1 to RAID5.
Before doing so I copied all of my data to various locations, on 2 laptop’s HD (Acer and a Dell XPS)and 2 USB HD.
All seemed OK so I rebuild the array without testing the copied files. I only compared the total size and number of files.
Well, that was a BIG mistake!
I now cannot open some of these files. All seems ok, icon, size and the correct app tries to open the file but nothing happens after.
Movies and mp3 won’t play, word documents are empty (although it seems to have the number of characters and pages OK), PDF won’t open... it is catastrophic.
Documents copied on the Acer laptop are all OK.
Documents copied to the Dell one are corrupt. The USB drives were also used via the DELL.
This seems to be related to the Dell then, I thought of a RAM or CPU pb... but copying stuff from the Dell to the new NAS is OK.
All drives are NTFS, both laptop are XP SP2.
Some of these documents are really valuable to me and I just can’t imagine to lose everything. Is there a software I could use to fix/retrieve these files?
Any help would be GREATLY appreciated. I can send some sample files if needed.

Cheers!

 

[sub mesa]

Memtest86 on both the server and client, but especially the server.

If you require a filesystem with checksumming, ZFS is your only option. It would provide an excellent protection against filesystem corruption.

 

[chunkymonster]

Memtest86 on both the server and client, but especially the server.

If you require a filesystem with checksumming, ZFS is your only option. It would provide an excellent protection against filesystem corruption.

What retail/freeware operating system supports ZFS natively? Specifically, what OS could the OP use that natively supports ZFS, has CIFS services, and can also be used on a NAS?

 

[sub mesa]

The new FreeNAS nightlies do, FreeBSD distributions starting from 7.0 and Linux using the FUSE layer (allowing ZFS to run outside the kernel, due to licence issues with the PUEL/GPL).

For an easy start, using the FreeNAS nightlies in a VM to evaluate its usefulness is an easy and safe way to pioneer into your storage needs. Its also a great opportunity to learn something beyond Windows. For a free VM solution you should try Virtualbox, which works on both windows and linux.

If you're more serious about storage, you could run a true FreeBSD setup with the latest ZFS version, or perhaps a Linux configuration with md-raid5 and XFS/JFS/Ext4 filesystem. All the fancy storage technologies aren't in windows, so you have to choose which path you are going to follow. In each case you should monitor your needs and it depends on how much time and effort you want to spend on it. But change that failing system now, because a corrupting NAS is useless.

 

[evongugg]

I would run Hard Disk diagnostics as well on whatever hard disk you used in the process.

 

[jrst]

Stop everything you're doing, shut down the NAS, and take a deep breath...

Key questions:

1. Do those apparently bad files you copied using the Dell actually contain data that can be resurrected? My first guess is no, they're gone--file size, icons (file name/type) and some metadata notwithstanding. But I'd still suggest keeping a copy of them for the time being just in case (and *don't* copy them to the NAS).

2. Is the data (or at least most of it) on your original RAID-1 disks recoverable? That depends on how the NAS initialized the RAID-5 array, and what's been done to it since it was created. (I assume you initialized it as if you were first installing it when you changed to RAID-5?)

a) If the NAS initialized the RAID-5 array by writing zero's (or whatever its preferred initialization pattern), to all the blocks on all the drives, your data is gone from the NAS, and the only option is to see if there's some hope in (1).

b) However, if the NAS RAID-5 initialization generated/wrote only parity blocks, then your data in those blocks are gone, but data on the other blocks of the two original RAID-1 disks is still there. And since it was RAID-1, there's a chance the data in the overwritten parity blocks on one drive can be recovered from the other drive.

3. So what next? This is not a typical RAID recovery scenario, and it depends on how much time and money you want to spend. It may still all come to naught, but I'd suggest:

a) Pulling at minimum your original two RAID-1 drives out of the NAS--and preferrably all three--and put them aside, and try inspecting each of them using data recovery tools. If anything can be salvaged, it should be apparent fairly quickly. (E.g., if 2.a, you'll get nothing; if 2.b, you should get something.)

b) If 3.a shows promise, then there's the question of how to put the two RAID-1 drives together so you can recover the data on those overwritten parity blocks. That's a much more difficult task, and I'd leave it until you've gone through 3.a to determine whether it's feasible or worthwhile.

 

[bubblebeat]

Hi,

Thanks for the suggestions so far.
I've tried to "fix" some mp3 and I've had no luck so far.
I'll check what's on the original drives this week-end. Keep you updated.

Cheers.

 

[jrst]

Yes, please let us know how it goes. Some recovery tools you might want to look at:

http://www.diskinternals.com/
http://www.z-a-recovery.com/
http://www.runtime.org/

 

[bubblebeat]

I setup a PC with an old MB that had 2 SATA ports and plugged in on of the HD that was part of my original RAID1 array.
I installed the ext3 data recovery tool from DiskInternals, scanned the HD for 20mn and aborted the scan.
The utility did find some files so that's promissing. I will run the full scan on the 2 HD over the week-end and see how it goes.
Not sure how I could recover data on the overwritten parity blocks yet but I'll think about it

Cheers!

 

[jrst]

Good luck. The algorithm for pasting the two RAID-1 drives together and recovering the overwritten parity blocks is pretty simple.

Assuming the array is nominally in the same state as when the RAID-5 initialization was complete. That is, only parity blocks have been written, and otherwise the data on the two RAID-1 drives is OK.

E.g., simplified pseudo-code...

[cpp]d-R1 = original RAID-1 disk-1 (read-only)
d-R2 = original RAID-1 disk-2 (read-only)
d-out = temp/scratch output disk (write)

for ( every block ) {
// Read the same block from d-R1 and d-R2
in-data1 = read-next-block( d-R1 )
in-data2 = read-next-block( d-R2 )
if ( in-data1 == in-data2 ) {
// Data is same from both original RAID-1 drives
// (neither is parity).
write-next-block( in-data1, d-out )
} else {
// Data is different; one is parity, one is data.
// Which is which?
if ( XOR(in-data1, in-data2) == in-data1 ) {
// in-data1 contains the data
// (in-data2 is parity).
write-next-block( in-data1, d-out )
} else if ( XOR(in-data1, in-data2) == in-data2 ) {
// in-data2 contains the data
// (in-data1 is parity).
write-next-block( in-data2, d-out )
} else {
// Houston, we have a problem...
// can't determine what is good data...
// issue a message, write zero's, whatever...
}
}
}[/cpp]
Unfortunately I don't know of any off-the-shelf-tools that provide such. So it's likely going to require a bit of code and raw/block-level access to the drives.

 

[bubblebeat]

Hi,

I finally ended up using a different approach. I tried to restore some file from the RAID1 drives, I could only retrieve images, don’t know why.
Anyway, the program bugged while restoring some JPG and that made me really annoyed, I did not want to rescan the drive and it takes forever.
I concentrated into finding a utility that would ‘repair’ my damaged file instead. After a bit of unlucky trials, I finally found a utility called ‘PhotoRec’ (http://www.cgsecurity.org/wiki/PhotoRec) and it allowed me to get all of my files back. The only problem is that it changed the file’s name and it will take me a while to classify everything but at least I got everything back! 

I now make sure copy/paste is actually doing what it is supposed to do. I may try to a utility that does a CRC check after doing a copy/paste...

Thx again for your help.