Raid 0 Data Recovery

Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
Araeven

Raid 0 Data Recovery

Post by Araeven » Wed Jul 20, 2011 8:57 pm

Hi,
A few days ago my Raid 0 failed when i had to clear my BIOS. I have been trying to recover it with other software, when that failed i was pointed towards R-studio.
After reading some of the guides i figured i'd give it a shot and downloaded the demo and started it up.
Now something very confusing is displayed on the Device View. Most of my Drives have the wrong Partitions, if that is the correct description, associated with them.
The Array had been made using 2x 1.5TB Seagate HDD
Here is a Screen Shot: :o
Image

Here is how the actual physical and raid drives were originally:

IntelRaid 0 Vol. is the volume I made using the Intel Matrix on my Mobo.
ST31500341 is correctly displayed as a 1.5 TB Drive
WDC WD1500 is also displayed correctly
SeagateST3300831 should be displaying as my 2nd 1.5 TB Drive
The partition "B" listed under SeagateST33 is actually a PATA 300GB drive. It should not be listed under the SeagateST33
The volume assigned the letter "G" is the only drive i see in "My Computer" besides the WDC WD1500 & the "B" (PATA 300GB)

I'm curiouse, is it still possible to reconstruct this using R-Studio?
I understand that inherently Raid0 is unsafe, however I very willing to try if there is any chance.
Any advice would be greatly appreciated. :)

Thanks,
Araeven

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Raid 0 Data Recovery

Post by Alt » Thu Jul 21, 2011 4:15 am

What is more disturbing, is that R-Studio wrote that it couldn't read sector 0 of one of the disks, which might (might only!) mean that one of the disks has a hardware problem, or something wrong in the RAID controller settings. Can you disconnect all the disks from the failed RAID, run R-Studio again, and see what happen?

Araeven

Re: Raid 0 Data Recovery

Post by Araeven » Thu Jul 21, 2011 6:46 am

By disconnecting the drives from the failed raid, do you mean make them non-members in the Intel Matrix Storage Controller? Or physically unplug the cables on the drives?
Sorry for the confusion, I've never had any HDD problems before this.

Currently only 1 of the 2 1.5TB drives is recognized as a member by the Raid Controller.

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Raid 0 Data Recovery

Post by Alt » Thu Jul 21, 2011 11:40 am

Well, did you connect those disks (that were RAID members) as a RAID or as separate disks? And if as RAID, what happens when you connect them separately?
Another question, did you use the RAID to store a system partition? Because the top Seagate disk on the screen shot shows the partition "Microsoft reserved". What does that mean? A startup partition for Windows 7?

Araeven

Re: Raid 0 Data Recovery

Post by Araeven » Thu Jul 21, 2011 1:12 pm

When I originally installed those two disks I had changed my storage controller in BIOS from IDE to RAID. I have been using the built in Intel Matrix on my Asus P5Q3 Deluxe mobo. Which is the reason my RAID failed when I had to reset my BIOS.
Since the RAID failed i have not connected/disconnected them. They have never been used apart from each other, bought new and installed right away as a RAID 0.
There should be no system information on any of the Seagate Disks. The windows partition has always been on WDC WD1500 (WD 150GB Raptor X).
The RAID volume has been used as storage and Pagefile, I had also installed most of my Applications on that as well due to the increased performance.

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Raid 0 Data Recovery

Post by Alt » Fri Jul 22, 2011 12:08 pm

You need to convert the controller from RAID to IDE, then those Seagate disks should appear as separate hard drives. Then create a virtual RAID from those drives in R-Studio.

Araeven
Posts: 3
Joined: Sat Jul 23, 2011 1:29 am

Re: Raid 0 Data Recovery

Post by Araeven » Sat Jul 23, 2011 2:18 am

Thanks! I never thought that would create any problems.
I constructed an image using the default options in R-Studio. However, while i found some files i got a lot of these errors:
"[FileId: 156009] MFT record child's claimed parent mismatch, aborting"
I will be able to recover some of my music, but my movies and pictures are gone. Got any suggestions on what might be causing the idea?

Thanks you for your help so far :)

Edit: I believe i have found the missing files. They are all found in the "Extra Files" area. Most of the pictures are partially black, i guess that means they are damaged. Is there any way of repairing them?

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Raid 0 Data Recovery

Post by Alt » Sat Jul 23, 2011 5:39 am

How are they "partially black"? Maybe, you post an image here? Because it looks like some RAID parameters may be incorrect. I'd create a RAID in the BIOS and see what parameters are, and specify them in R-Studio. But don't initialize the RAID!, or it may destroy some files.
More safe option is to use the Finding RAID parameters article as a guide to find the RAID parameters yourself. The only exception is that you don't have to find the parity disk.

Araeven
Posts: 3
Joined: Sat Jul 23, 2011 1:29 am

Re: Raid 0 Data Recovery

Post by Araeven » Sat Jul 23, 2011 11:27 am

Alright. I've actually tried to follow that guide before. I am a little confused about a few things. Since the guide only shows one way, but my values differ from the ones in the example.
I've found these values: (some seem strange from what I've read)

Bytes per Sector: 190
Sectors per cluster: 124
Logical Cluster Number for the file $MFT: 6124990635755565538
RAID offset: 0 (I believe anyway, the MBR was at 00 for both disks)
Sectors preceding Partition: 1
Stripe Size; 128 (remembered from BIOS)

MFT location: When i search for "FILE" I can continue to click "FInd Next" and more will continually show up. None of which have "The pattern $.M.F.T. (HEX 24 00 4D 00 46 00 54) shows that this is a correct MFT beginning"
The problem being that i had to start my search from the start. When i entered Logical Cluster Number for the file $MFT as 6124990635755565538 it told me that it was out of range.
Is there any other way of going about this?
I am currently searching for the Value $.M.F.T. in the Hex Editor. (11% complete)

About the images, the Black areas actually are not black, sorry for the misunderstanding, they are more messed up parts of the images.
Here are 2 old screenshots i found in one of those randomly named folders:
Image
Image

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Raid 0 Data Recovery

Post by Alt » Wed Jul 27, 2011 3:28 pm

The values
Bytes per Sector: 190
Sectors per cluster: 124
are totally absurd.

From what I see on the picture, strip (block size are incorrect)
And what about the disk order? I mean which disk is 1-st and which is 2-nd?

Post Reply