Ads

Tom's Hardware > Forum > Storage > NAS/RAID > Data loss after RAID 5 expansion

Data loss after RAID 5 expansion

Forum Storage : NAS/RAID Data loss after RAID 5 expansion

Hi,

I originally had a 3 x 1.5 TB based RAID 5 setup. The HDDs were Seagate 7200 RPM drives. The motherboard is an Asus P5Q, (Chipset Type: Intel P45 Express / Intel ICH10R). When I was running low on space, I decided to expand the array with another 1.5 TB Seagate HDD.

Sadly I did not backup my data before this. Post initiating the RAID expansion, the RAID migration process took about 3 weeks. To complicate things, after the first 2 weeks, the system shutdown for no specific reason. It was not power failure related, as the system is hooked to a UPS. On powering-on the system, my OS (Windows 7 64-bit) did a CHKDSK. The CHKDSK took several hours, and once back in Windows, approximately 850 GB of data, from the 2.72 TB RAID 5 array had gone missing. The drive appeared to have over 900 GB of free space, while previously it had less than 100 GB of free space.

At this point the RAID migration was not done, and had about a week left. Once done I restarted the system as prompted. Again prior to boot-up Win7 did a CHKDSK. Once back in Windows, it displayed a 2.72 TB drive, which was completely free.

What I have done:
1) Tried several data recovery programs: Zero Assumption Recovery / Get Data Back For NTFS 4.0 / iCare Data Recovery Software 4.5 / EASEUS Data Recovery Wizard Professional 5.0.1 / Recover My Files Pro 4.6.8.1012

Some of them are unsuited for recovery from RAID. Most of them show that the HDD is almost full in terms of filesystem structures, but after lengthy scans are unable to find any useful information.

Two programs were able to find around 150 GB of data. On recovery all the files were corrupt and unusable.

What I am yet to do:
1) The Disk Management section (Control Panel-Administrative Tools-Computer Management-Disk Management) now shows a Basic disk with 4191.79 GB. Of which 1397.26 is unallocated. I am yet to extend the partition and use this space.

Assistance Needed:
1) Any suggestions to recover my data?
2) Should I extend the partition to include the unallocated space and re-run the data recovery programs. Will this help?
3) My online research had led me to notes of recovery through Linux. While I’m unfamiliar with the process, is that something that will work? If yes, could I get some guidance on it?

Thanks in advance.

Message edited by virtualdanger on 06-30-2011 at 02:40:26 AM

Reply to virtualdanger

try R-studio r-tt.com, it has the capability of reassemling RAID arrays and its a Windows utility. I would not to anything with the drives until you to a bit for bit image of them to other drives if the data is at all critical.

Reply to tokencode

My understanding is that Ubuntu, among other Linux distros, is able to read data from RAID volumes. You can try downloading and burning an Ubuntu LiveCD and booting from it with the drives attached as individual disks to see if it will recognize your data.

I'm not hopeful, though. It's straightforward enough to write drivers that recognize RAID volumes, but RAID volumes in the midst of a migration is a whole 'nuther kettle of fish. IMHO doing any sort of in-place migration without first making a backup of all the data is very, very ill-advised.

Message edited by sminlal on 06-30-2011 at 01:26:01 PM

Reply to sminlal

Tokencode: Thanks for your suggestions; will give R-Studio a shot. Also, will not extend the partition in Disk Management to allocate the currently unallocated space.

Sminlal: Thanks for your comments; will try to download a Ubuntu LiveCD and give that a shot as well. The RAID migration is complete now. But the confusion was the sys shutdown while it was underway a week or two ago.

Reply to virtualdanger

Tokencode - Downloaded the trial version of R-Studio, and have run the search. After several hours spent on the search, when the program needs to return with results, it stops responding. Still working with it and re-trying though. Will let you know.

Sminal - Downloaded the latest version of Ubuntu, 11.04. Made a Live CD and booted from it. Unfortunately Ubuntu does not recognize the RAID 5 partition. It recognizes 4 separate 1.5 TB drives. It seems to recognize the RAID 0 partition properly though. Which incidentally is on the same controller. Any thoughts and suggestions on next steps?

Reply to virtualdanger

> Any thoughts and suggestions on next steps?

Sorry, you have plumbed the depths of my knowledge of how to recover from failed RAID conversions. My usual recovery method in cases like this is to restore from the backup I made.

Reply to sminlal

With regard to Ubuntu, instead of a LiveCD, will making an install and then updating help me with this RAID 5 identification issue?

As for R-Studio, ran the simple scan firt. After almost 2 days, it returned results which were useless. Re-running the scan now, a detailed one now. Scan is still underway; its been running for little over a day so far.

Reply to virtualdanger

I'm not an Ubuntu expert, but I doubt a full installation will make any difference. As long as you've got the latest LiveCD I'd expect it to have all of the same basic drive and file system drivers as the full version.

Still, aside from time, it's free to try.

Reply to sminlal

No luck with R-Studio. Similar to other data recovery programs, while the scan results were unable to recover the original folder structure, it was able to recover random folders, with sets of files. As with other programs, recovering these folders resulted in folders with files that were corrupt. All files were unusable; be it JPEG Pictures, AVI Videos, XLSX MS Office 2010 Excel Spreadsheets. Double clicking on the recovered files would start the associated program, and then a popup abt a corrupt file would be displayed.

Reply to virtualdanger

check disk already damaged the original file structure, it is no way to restore the original folder structure. Also, you already tried different software but all failed. If the data is really important for you, send it to professional data recovery company.

www.ontrack.com
www.timdatarecovery.com

Reply to jpidata

Virtual Danger, this is becauseyou have your stripe out of order, thats the hardest part of recovering the data. You have to get your stripe in the correct order. Locate a large bitmap file on the drive, since they are written sequentially, this will give you a visual representation of the stripes. Kepp close track of what drive has what piece of the image and you can put the image pieces together like a puzzle and undersand what order the stripe needs to be in. Once you do this, you'll have a full readable directory structure and working files (hopefully)

Reply to tokencode

With 3 drives in RAID 5 I think you really only have 6 different permutations.

Message quoted 1 times

Reply to tokencode

tokencode wrote :

With 3 drives in RAID 5 I think you really only have 6 different permutations.

Tokencode, thanks for your comments. Considering that the drives where never taken out of the system, is it possible for the stripe to be out of order? Physically no changes have been made with the connections since when the array was functional and now.

Reply to virtualdanger

How did you image the drives then? You don't want to use R-Studio on the broken array through the RAID controller, you want a raw read of the contents of each drive to a good drive and then you can play with the images instead of the actual drives. If you're using SATA RAID, connect the drives to strait SATA connection (no RAID) for the imaging. I would say since the data is not readable its entirely possible something like the stripe being out of order occured somehow. If you have not written data to the drives I think you still have a good chance of recovery.

Message quoted 1 times

Reply to tokencode

You want R-Studio to see each drive separately without any RAID abstraction happening by the host controller. When it can see each drive you will have to realign the stripes, once that happens you can read the raw data. You will NOT be able to recreate that drive and access the data as-in, you will instead need to copy that data to another medium first.

Our data-center had a similar situation where we lost an array that contained one of your exchange information stores due to a service processor failure during yearly maintenance. We had the drives packaged and flown back to the states in a suitcase hand-cuffed to one of our techs. There a data restoration service was able to extract the data and provided us two copies on external USB disks. We joke that those ere $25K USB drives (the process was billed to us as $50K).

Message quoted 1 times

Reply to palladin9479

tokencode wrote :

Tokencode; the drives are not imaged as yet. I'm using R-Studio off the original HDDs. The Array is not broken. Please review 1st screenshot. The array with the original volume label 'The Archive' is displaying properly in My Computer. Only problem being, Chkdsk destroyed the index/address enteries. So now it lists as an empty drive. The drives have not been written to. Yes, the drives are all SATA.

So from what i understand, you're suggesting i turn of raid in the bios. Image each drive to a backup drive. Then re-align them in R-Studio using the virtual raid option. And once i get them in order, i should be able to recover the data?

Reply to virtualdanger

palladin9479 wrote :

So I will need to:
1 - make copies of each HDD in the array to another medium (using R-Studio drive image option)
2 - then use R-Studio virtual RAID option to re-align the stripes
3 - Once done I can scan using R-Studio and read raw data

I wish I had $50K to just get this sorted out.

Reply to virtualdanger

Basically yes. It's always safer to work on images then the actual disks, so that if you screw something you can always go back and get a new image.

Message quoted 1 times

Reply to palladin9479

palladin9479 wrote :

Basically yes. It's always safer to work on images then the actual disks, so that if you screw something you can always go back and get a new image.

Thanks for the confirmation Palladin.

The concern now lies in getting additional extra drives for the images. I currently only have 2 x 2 TB HDDs for the recovery purpose.

A question that maybe rather silly - The original array had 3 x 1.5 TB. The total partition space in the OS was 2.73 TB. The 2.73 TB was almost full. I added one additional 1.5 TB drive for the RAID expansion. Since the issues occured after, the partition has not been extended in Disk Managment to make use of the additional space available now.

Irrespective of this, do I still need to make images of all 4 drives? Or could I get away with just 3 images? Also, of the original 3, 1 would have been for parity, being RAID 5, so can I get away with images of just 2? My apologies if these are very obvious questions.

Reply to virtualdanger

You need an image of the three members of the array.

Message quoted 1 times

Reply to palladin9479

palladin9479 wrote :

You need an image of the three members of the array.

Thanks Palladin9479

Reply to virtualdanger

Ask the community Add a reply

Related content

See all topics related to "Data loss after RAID 5 expansion"

Tom's Hardware > Forum > Storage > NAS/RAID > Data loss after RAID 5 expansion

Go to:

Help |
Forum rules

There are 2118 identified and unidentified users. To see the list of identified users, Click here.

Page generated in 0.813 seconds

Please mind

You are about to answer a thread that has been inactive for more than 6 months.
If you still wish to proceed, please ensure that your posting is original and does not duplicate or overlap any prior responses to this thread.

Add a reply Cancel