Sign in with
Sign up | Sign in
Your question

Data loss after RAID 5 expansion

Last response: in Storage
Share
June 29, 2011 11:49:13 PM

Hi,

I originally had a 3 x 1.5 TB based RAID 5 setup. The HDDs were Seagate 7200 RPM drives. The motherboard is an Asus P5Q, (Chipset Type: Intel P45 Express / Intel ICH10R). When I was running low on space, I decided to expand the array with another 1.5 TB Seagate HDD.

Sadly I did not backup my data before this. Post initiating the RAID expansion, the RAID migration process took about 3 weeks. To complicate things, after the first 2 weeks, the system shutdown for no specific reason. It was not power failure related, as the system is hooked to a UPS. On powering-on the system, my OS (Windows 7 64-bit) did a CHKDSK. The CHKDSK took several hours, and once back in Windows, approximately 850 GB of data, from the 2.72 TB RAID 5 array had gone missing. The drive appeared to have over 900 GB of free space, while previously it had less than 100 GB of free space.

At this point the RAID migration was not done, and had about a week left. Once done I restarted the system as prompted. Again prior to boot-up Win7 did a CHKDSK. Once back in Windows, it displayed a 2.72 TB drive, which was completely free.



What I have done:
1) Tried several data recovery programs: Zero Assumption Recovery / Get Data Back For NTFS 4.0 / iCare Data Recovery Software 4.5 / EASEUS Data Recovery Wizard Professional 5.0.1 / Recover My Files Pro 4.6.8.1012

Some of them are unsuited for recovery from RAID. Most of them show that the HDD is almost full in terms of filesystem structures, but after lengthy scans are unable to find any useful information.

Two programs were able to find around 150 GB of data. On recovery all the files were corrupt and unusable.

What I am yet to do:
1) The Disk Management section (Control Panel-Administrative Tools-Computer Management-Disk Management) now shows a Basic disk with 4191.79 GB. Of which 1397.26 is unallocated. I am yet to extend the partition and use this space.



Assistance Needed:
1) Any suggestions to recover my data?
2) Should I extend the partition to include the unallocated space and re-run the data recovery programs. Will this help?
3) My online research had led me to notes of recovery through Linux. While I’m unfamiliar with the process, is that something that will work? If yes, could I get some guidance on it?

Thanks in advance.
a b G Storage
June 30, 2011 5:45:35 AM

try R-studio r-tt.com, it has the capability of reassemling RAID arrays and its a Windows utility. I would not to anything with the drives until you to a bit for bit image of them to other drives if the data is at all critical.
m
0
l
a c 415 G Storage
June 30, 2011 11:25:26 AM

My understanding is that Ubuntu, among other Linux distros, is able to read data from RAID volumes. You can try downloading and burning an Ubuntu LiveCD and booting from it with the drives attached as individual disks to see if it will recognize your data.

I'm not hopeful, though. It's straightforward enough to write drivers that recognize RAID volumes, but RAID volumes in the midst of a migration is a whole 'nuther kettle of fish. IMHO doing any sort of in-place migration without first making a backup of all the data is very, very ill-advised.
m
0
l
Related resources
June 30, 2011 11:32:51 AM

Tokencode: Thanks for your suggestions; will give R-Studio a shot. Also, will not extend the partition in Disk Management to allocate the currently unallocated space.

Sminlal: Thanks for your comments; will try to download a Ubuntu LiveCD and give that a shot as well. The RAID migration is complete now. But the confusion was the sys shutdown while it was underway a week or two ago.
m
0
l
July 4, 2011 9:33:41 PM

Tokencode - Downloaded the trial version of R-Studio, and have run the search. After several hours spent on the search, when the program needs to return with results, it stops responding. Still working with it and re-trying though. Will let you know.

Sminal - Downloaded the latest version of Ubuntu, 11.04. Made a Live CD and booted from it. Unfortunately Ubuntu does not recognize the RAID 5 partition. It recognizes 4 separate 1.5 TB drives. It seems to recognize the RAID 0 partition properly though. Which incidentally is on the same controller. Any thoughts and suggestions on next steps?

m
0
l
a c 415 G Storage
July 4, 2011 9:38:14 PM

> Any thoughts and suggestions on next steps?

Sorry, you have plumbed the depths of my knowledge of how to recover from failed RAID conversions. My usual recovery method in cases like this is to restore from the backup I made.
m
0
l
July 10, 2011 10:46:12 AM

With regard to Ubuntu, instead of a LiveCD, will making an install and then updating help me with this RAID 5 identification issue?

As for R-Studio, ran the simple scan firt. After almost 2 days, it returned results which were useless. Re-running the scan now, a detailed one now. Scan is still underway; its been running for little over a day so far.
m
0
l
a c 415 G Storage
July 10, 2011 2:53:58 PM

I'm not an Ubuntu expert, but I doubt a full installation will make any difference. As long as you've got the latest LiveCD I'd expect it to have all of the same basic drive and file system drivers as the full version.

Still, aside from time, it's free to try.
m
0
l
July 14, 2011 11:06:36 PM

No luck with R-Studio. Similar to other data recovery programs, while the scan results were unable to recover the original folder structure, it was able to recover random folders, with sets of files. As with other programs, recovering these folders resulted in folders with files that were corrupt. All files were unusable; be it JPEG Pictures, AVI Videos, XLSX MS Office 2010 Excel Spreadsheets. Double clicking on the recovered files would start the associated program, and then a popup abt a corrupt file would be displayed.

m
0
l
July 15, 2011 4:05:59 PM

check disk already damaged the original file structure, it is no way to restore the original folder structure. Also, you already tried different software but all failed. If the data is really important for you, send it to professional data recovery company.

www.ontrack.com
www.timdatarecovery.com
m
0
l
a b G Storage
July 18, 2011 3:46:10 AM

Virtual Danger, this is becauseyou have your stripe out of order, thats the hardest part of recovering the data. You have to get your stripe in the correct order. Locate a large bitmap file on the drive, since they are written sequentially, this will give you a visual representation of the stripes. Kepp close track of what drive has what piece of the image and you can put the image pieces together like a puzzle and undersand what order the stripe needs to be in. Once you do this, you'll have a full readable directory structure and working files (hopefully)
m
0
l
a b G Storage
July 18, 2011 3:47:34 AM

With 3 drives in RAID 5 I think you really only have 6 different permutations.


m
0
l
July 18, 2011 6:44:55 AM

tokencode said:
With 3 drives in RAID 5 I think you really only have 6 different permutations.


Tokencode, thanks for your comments. Considering that the drives where never taken out of the system, is it possible for the stripe to be out of order? Physically no changes have been made with the connections since when the array was functional and now.
m
0
l
a b G Storage
July 18, 2011 9:19:36 AM

How did you image the drives then? You don't want to use R-Studio on the broken array through the RAID controller, you want a raw read of the contents of each drive to a good drive and then you can play with the images instead of the actual drives. If you're using SATA RAID, connect the drives to strait SATA connection (no RAID) for the imaging. I would say since the data is not readable its entirely possible something like the stripe being out of order occured somehow. If you have not written data to the drives I think you still have a good chance of recovery.
m
0
l
July 18, 2011 11:23:02 AM

You want R-Studio to see each drive separately without any RAID abstraction happening by the host controller. When it can see each drive you will have to realign the stripes, once that happens you can read the raw data. You will NOT be able to recreate that drive and access the data as-in, you will instead need to copy that data to another medium first.

Our data-center had a similar situation where we lost an array that contained one of your exchange information stores due to a service processor failure during yearly maintenance. We had the drives packaged and flown back to the states in a suitcase hand-cuffed to one of our techs. There a data restoration service was able to extract the data and provided us two copies on external USB disks. We joke that those ere $25K USB drives (the process was billed to us as $50K).
m
0
l
July 18, 2011 10:16:30 PM

tokencode said:
How did you image the drives then? You don't want to use R-Studio on the broken array through the RAID controller, you want a raw read of the contents of each drive to a good drive and then you can play with the images instead of the actual drives. If you're using SATA RAID, connect the drives to strait SATA connection (no RAID) for the imaging. I would say since the data is not readable its entirely possible something like the stripe being out of order occured somehow. If you have not written data to the drives I think you still have a good chance of recovery.


Tokencode; the drives are not imaged as yet. I'm using R-Studio off the original HDDs. The Array is not broken. Please review 1st screenshot. The array with the original volume label 'The Archive' is displaying properly in My Computer. Only problem being, Chkdsk destroyed the index/address enteries. So now it lists as an empty drive. The drives have not been written to. Yes, the drives are all SATA.

So from what i understand, you're suggesting i turn of raid in the bios. Image each drive to a backup drive. Then re-align them in R-Studio using the virtual raid option. And once i get them in order, i should be able to recover the data?
m
0
l
July 18, 2011 10:23:49 PM

palladin9479 said:
You want R-Studio to see each drive separately without any RAID abstraction happening by the host controller. When it can see each drive you will have to realign the stripes, once that happens you can read the raw data. You will NOT be able to recreate that drive and access the data as-in, you will instead need to copy that data to another medium first.

Our data-center had a similar situation where we lost an array that contained one of your exchange information stores due to a service processor failure during yearly maintenance. We had the drives packaged and flown back to the states in a suitcase hand-cuffed to one of our techs. There a data restoration service was able to extract the data and provided us two copies on external USB disks. We joke that those ere $25K USB drives (the process was billed to us as $50K).


So I will need to:
1 - make copies of each HDD in the array to another medium (using R-Studio drive image option)
2 - then use R-Studio virtual RAID option to re-align the stripes
3 - Once done I can scan using R-Studio and read raw data

I wish I had $50K to just get this sorted out.
m
0
l
July 19, 2011 6:52:47 AM

Basically yes. It's always safer to work on images then the actual disks, so that if you screw something you can always go back and get a new image.
m
0
l
July 19, 2011 7:16:50 AM

palladin9479 said:
Basically yes. It's always safer to work on images then the actual disks, so that if you screw something you can always go back and get a new image.


Thanks for the confirmation Palladin.

The concern now lies in getting additional extra drives for the images. I currently only have 2 x 2 TB HDDs for the recovery purpose.

A question that maybe rather silly - The original array had 3 x 1.5 TB. The total partition space in the OS was 2.73 TB. The 2.73 TB was almost full. I added one additional 1.5 TB drive for the RAID expansion. Since the issues occured after, the partition has not been extended in Disk Managment to make use of the additional space available now.

Irrespective of this, do I still need to make images of all 4 drives? Or could I get away with just 3 images? Also, of the original 3, 1 would have been for parity, being RAID 5, so can I get away with images of just 2? My apologies if these are very obvious questions.

m
0
l
July 19, 2011 7:42:35 AM

You need an image of the three members of the array.
m
0
l
July 19, 2011 8:02:12 AM

palladin9479 said:
You need an image of the three members of the array.


Thanks Palladin9479
m
0
l
!