Data Recovery and Disk Utilities Forum @R-TT

Ok Peter

I'll take a look at the memory settings and see if that gets me anywhere if not, I'll revisit the RAID parameters.

I appreciate your help - thanks!

1. did you save the scan results before the enumeration attempt?
if not - it's a good thing to do, then you don't need to re-scan next time, just to load it.

2. check your memory settings in r-studio (tools-settings-memory usage), and switch it to automatic with 90% of physical memory.

3. if you have not assembled raid properly then all this is pointless - most of the data will be corrupted anyway.
so i'd still suggest to use another software to detect the raid parameters and then use that in r-studio

Thanks Peter and Alt

I've taken this up with R-TT help and they had me run the Emergency program and try and enumerate files only on the EXT partition. The program scans fine but when I try to enumerate the files it always hangs the computer and I cannot stop it. I've even bought another 8GB of RAM taking it up to 16GB but it doesn't help. It looks from your comments though that I still haven't rebuilt the RAID correctly so I'm guessing you'd advise concentrating on this before wasting time re scanning?

I appreciate the help!

I would recommend [url=http://www.freeraidrecovery.com] ReclaiMe Free RAID Recovery[/url] for finding MD RAID parameters.

if you assembled the raid as was shown on the screenshot, then it's wrong because you started from 0, when with MD raids you need to start from some offset.

from the last post it seems that the MD partition is this - /dev/sda3 133 243138 1951945693 83 Linux
which starts from sector 243138.
but then there's MD metadata, so there's no way to tell what is the raid offset based on what you posted.

also it seems that r-studio could not parse MD super block (it should appear automatically, but i don't see anything on the screenshot).

at this point i can only suggest to download ufs expolorer demo, and check MD raid parameters from it. then u can enter them into r-studio and do RAW scan again

I have managed to get some parameters using PUTTY from the NAS which is quoted below: here is a guide for those of you who want to obtain this information:

http://nelsoj.uk/manually-repair-qnap-raid4/

From this I understand the settings for R-Studio (quoted lhs) are as Follows with mdadm --detail (quoted in brackets rhs):

Raid type: (Raid Level : raid5)
Block order for: (Layout : left-symmetric)
Parity delay: (not quoted)
First parity: (not quoted)
Number of rows: (not quoted)
Block size: (Chunk Size : 64K)

I am assuming that the above inputs are correct given the data below but still can't get any file system to show on R-Studio. Only RAW Files are listed as in screenshots above. Are my assumptions correct given the data below? I'm using images of the NAS which is still working with a file system but this is not showing up with the R-Studio RAID. If anyone can spot any errors I'd appreciate it as I cannot seem to recover large files with these settings?


[quote]
[~] # fdisk -l /dev/sda

Disk /dev/sda: 2000.3 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sda1 1 66 530125 83 Linux
/dev/sda2 67 132 530142 83 Linux
/dev/sda3 133 243138 1951945693 83 Linux
/dev/sda4 243139 243200 498012 83 Linux
[~] # fdisk -l /dev/sdb

Disk /dev/sdb: 2000.3 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 66 530125 83 Linux
/dev/sdb2 67 132 530142 83 Linux
/dev/sdb3 133 243138 1951945693 83 Linux
/dev/sdb4 243139 243200 498012 83 Linux
[~] # fdisk -l /dev/sdc

Disk /dev/sdc: 2000.3 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdc1 1 66 530125 83 Linux
/dev/sdc2 67 132 530142 83 Linux
/dev/sdc3 133 243138 1951945693 83 Linux
/dev/sdc4 243139 243200 498012 83 Linux
[~] # fdisk -l /dev/sdd

Disk /dev/sdd: 2000.3 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdd1 1 66 530125 83 Linux
/dev/sdd2 67 132 530142 83 Linux
/dev/sdd3 133 243138 1951945693 83 Linux
/dev/sdd4 243139 243200 498012 83 Linux
[~] #
[~] #
[~] #
[~] # mdadm --detail /dev/md0
/dev/md0:
Version : 00.90.03
Creation Time : Wed Sep 10 13:59:21 2014
Raid Level : raid5
Array Size : 5855836800 (5584.56 GiB 5996.38 GB)
Used Dev Size : 1951945600 (1861.52 GiB 1998.79 GB)
Raid Devices : 4
Total Devices : 4
Preferred Minor : 0
Persistence : Superblock is persistent

Update Time : Thu Mar 14 10:58:18 2019
State : active
Active Devices : 4
Working Devices : 4
Failed Devices : 0
Spare Devices : 0

Layout : left-symmetric
Chunk Size : 64K

UUID : 1ecb9d5e:cee6e412:81666188:b4e62e0c
Events : 0.7572

Number Major Minor RaidDevice State
0 8 3 0 active sync /dev/sda3
1 8 19 1 active sync /dev/sdb3
2 8 35 2 active sync /dev/sdc3
3 8 51 3 active sync /dev/sdd3
[~] #
[/quote]

Thanks for your advice guys. I have tried to view JPEG and MOV files. Some JPEG files are a couple of MB but are distorted with missing areas or coloured flashes/corrupted areas. The same goes for MOV files which are in the region of 200MB but play with similar horizontal disparities. I'm not sure whether this is consistent with them being overwritten after being deleted or due to incorrect RAID parameters?

Although the files I'm trying to recover were deleted, the NAS is still in use and does have a valid file structure which can be viewed buy these kosher files do not show up on the R-Studio scan of the images (images of the disks were taken before reusing the NAS). Is that a sure sign that the RAID is not constructed correctly? I'm having a real problem with the RAID setup so any pointers on how to get to grips with that would be appreciated. The autodetect doesn't come up with anything on a 12 hour scan should I leave it further? Cheers!

Mr. Alt is correct.

Your box had ExtFS file system. Regular undelete is not possible there due to the way how FS cleans its metadata during deletion (manual undelete might be possible on Ext4, but this is not the case here).

So you can only do RAW, and only in case if R-Studio supports indirect blocs parsing during RAW scan (question to Mr. Alt).
If it does not support - you need another DR software for any file >48 KB.

I think that your only hope here is file recovery from Raw Files. Try to preview some large jpg files from this location, and if they' can be successfully seen, the RAID parameters are correct.

I'm posting this here as I hope that any replies might be of use to others but apologize if it is slightly off topic? I am not a Pro and have purchased R-Studio to rescue family photos/videos from the NAS after quotes of up to $2000.

I have a QNAP TS-412 NAS configured in RAID 5. The file structure is not good (according to QNAP tech) but there are still files that I can access. I am trying to recover some 1.2TB of deleted files (removed from the recycle bin some time ago and file structure overwritten).

I have cloned the 4 drives and have constructed a Virtual Raid on a PC using R-Studio so no hardware issues!

I have left the R-Studio defaults set at RAID 5, Left Synchronous, 4 rows block size 64KB and (unless I am mistaken) this appears to have worked! I have attached screen shots so results may be seen. First question is how do you really know if these parameters are correct? Auto detect was left running overnight but didn't come up with better results than the defaults.

Assuming the RAID is reconstructed ok, the results of a detailed scan have produced the results in the associated screenshots! Great as I can indeed view some files! Ideally I would like to recover only deleted files as this is what I'm trying to recover. However: if I double click any of the larger "Recognised" partitions I get a time out message and R-Studio stops responding!

1. Have I got the RAID parameters right?
2. Why do I get the timeout?
3. Can I selectively recover only deleted areas of the NAS?
4. Should I use one "source" for recovery such as "Recognized93" which is the full size of the NAS at 5.45TB

Am I on the right track? Help appreciated!