QNAP RAID 5 Deleted files recovery attempt
Posted: Fri Jul 29, 2016 3:13 am
Hello dear erasers, I'm fighting with my RAID5 (3x4TB) QNAP archive.
I deleted a whole folder (3TB) by mistake while I was trying to create a new common share, both HDDs and filesystem are fully working.
Now, I connected the 3 HDDs through USB3.0 dockstations to my Windows 7 laptop, and successfully rebuilt the RAID5 (at least I suppose I did).
I started with the best intentions, trying to autodetect RAID parameters, then I saw that it would have taken ages...So browsking around I found that the most commonly discussed parameters for QNAP RAIDs were Left synchronous/64Kb. Also my last QNAP RAID log confirm these settings.
I started the basic file recovery procedure, since I had no damaged drives and all files I want to get back were on an existing logical disk.
Here comes the first question, is basic file recovery enough or will I have to perform advanced data recovery too?
The result of the scan are a tons of recognized partition, few of them green, a tons yellow, and the last one red. I read all guides and manual of course, and learnt that probably deleted files will be found inside the yellow ones.
Second question, why do I see only recognized partitions, but not the actual filesystem? The RAID is working and it's not damaged, shouldn't I see also the "not deleted" filesystem with real folders and the "existing" files?
By the way, to better understand what I would find into each category of the recognized partitions I enumerated the bigger green partition and the bigger yello partition.
I found a sh**load of files! Most of them irrelevant to my needs, but some of them are the files I was looking for.
I saw also that most of the files are common between green/yellow partition, when prompted I told to rename them, a later check confirmed it. A lot of files are the same, differences are found in integrity since some times one or more copies of a files are damaged and I have to find the best one.
Third question, I have a lot of partitions to scan yet, do I have to suppose that 90% of files within are the same files I already recovered? How is the R-Studio's logic to "assign" files to recognized partitions? I would like to understand if it worth wasting days and days enumerating all partitions or should I stop earlier.
Another point is that R-Studio marks these partitions as 110GB size, but when I recover files each one of them produces 800/900GB of files...So it appears obvius that the majority of files are redundant, if not with 10 partitions I would cover whole NAS storage capacity.
So, my doubts:
1 - Is basic file recovery enough if I have just to recover deleted files from a working filesystem, or will I have to perform advanced data recovery too?
2 - Why do I see only recognized partitions, but not the actual filesystem? The RAID is working and it's not damaged, shouldn't I see also the "not deleted" filesystem with real folders and the "existing" files? This would allow me to focus on deleted files only.
3 - Do I have to suppose that 90% of files within each recognized partition are the same files I already recovered? How is the R-Studio's logic to "assign" files to recognized partitions? I would like to understand if it worth wasting days and days enumerating all partitions or should I stop earlier.
Sorry for my bad english and a huge thank you to whoever wants to help me recovering my beloved data.
Regards.
I deleted a whole folder (3TB) by mistake while I was trying to create a new common share, both HDDs and filesystem are fully working.
Now, I connected the 3 HDDs through USB3.0 dockstations to my Windows 7 laptop, and successfully rebuilt the RAID5 (at least I suppose I did).
I started with the best intentions, trying to autodetect RAID parameters, then I saw that it would have taken ages...So browsking around I found that the most commonly discussed parameters for QNAP RAIDs were Left synchronous/64Kb. Also my last QNAP RAID log confirm these settings.
I started the basic file recovery procedure, since I had no damaged drives and all files I want to get back were on an existing logical disk.
Here comes the first question, is basic file recovery enough or will I have to perform advanced data recovery too?
The result of the scan are a tons of recognized partition, few of them green, a tons yellow, and the last one red. I read all guides and manual of course, and learnt that probably deleted files will be found inside the yellow ones.
Second question, why do I see only recognized partitions, but not the actual filesystem? The RAID is working and it's not damaged, shouldn't I see also the "not deleted" filesystem with real folders and the "existing" files?
By the way, to better understand what I would find into each category of the recognized partitions I enumerated the bigger green partition and the bigger yello partition.
I found a sh**load of files! Most of them irrelevant to my needs, but some of them are the files I was looking for.
I saw also that most of the files are common between green/yellow partition, when prompted I told to rename them, a later check confirmed it. A lot of files are the same, differences are found in integrity since some times one or more copies of a files are damaged and I have to find the best one.
Third question, I have a lot of partitions to scan yet, do I have to suppose that 90% of files within are the same files I already recovered? How is the R-Studio's logic to "assign" files to recognized partitions? I would like to understand if it worth wasting days and days enumerating all partitions or should I stop earlier.
Another point is that R-Studio marks these partitions as 110GB size, but when I recover files each one of them produces 800/900GB of files...So it appears obvius that the majority of files are redundant, if not with 10 partitions I would cover whole NAS storage capacity.
So, my doubts:
1 - Is basic file recovery enough if I have just to recover deleted files from a working filesystem, or will I have to perform advanced data recovery too?
2 - Why do I see only recognized partitions, but not the actual filesystem? The RAID is working and it's not damaged, shouldn't I see also the "not deleted" filesystem with real folders and the "existing" files? This would allow me to focus on deleted files only.
3 - Do I have to suppose that 90% of files within each recognized partition are the same files I already recovered? How is the R-Studio's logic to "assign" files to recognized partitions? I would like to understand if it worth wasting days and days enumerating all partitions or should I stop earlier.
Sorry for my bad english and a huge thank you to whoever wants to help me recovering my beloved data.
Regards.