File System Recovery

A forum on data recovery using the professional data recovery software R-STUDIO.
muzicman82
Posts: 12
Joined: Mon Nov 07, 2011 1:47 am

File System Recovery

Post by muzicman82 » Sun Apr 15, 2012 11:13 am

Hi all,

I have a OWC Mercury Elite Pro Qx2 RAID enclosure which uses the Oxford 936SE chipset. It has 4x Western Digital Caviar Black drives (2TB) in RAID5. Everything has been fine with this for a year or more. There was 1 large NTFS volume.

The other day, during it's normally scheduled Scandisk, it took forever and proceeded to do what looked like recover almost every file from something. After that, everything seemed fine. A couple days later, I noticed the drive wasn't appearing in Windows. I power cycled the drive and checked Device Manager, and sure enough it was connected. I checked Disk Management, and apparently the partition was lost. CRAP!

In R-STUDIO, it says the drive has a "Microsoft Reserved Partition" from 17kb-128MB, and then "Volume {some long id}" from 129MB-5.46TB.

So I ran an R-STUDIO scan. It found two blocks of recognized data, but neither has all of the data. Am I screwed?

I don't think this is a case of needing to do a RAID recovery since the unit mounts properly, unless that could help?

I have no idea what happened to the data. My only guess is that when I power cycled the enclosure, it didn't see a valid RAID set so it wiped and created a new one?

Ideas would be great!

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: File System Recovery

Post by Alt » Mon Apr 16, 2012 7:22 am

How does Disk Manager see the RAID, as a RAW disk or with a file system, like NTFS?

muzicman82
Posts: 12
Joined: Mon Nov 07, 2011 1:47 am

Re: File System Recovery

Post by muzicman82 » Mon Apr 16, 2012 8:32 am

It says RAW.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: File System Recovery

Post by Alt » Tue Apr 17, 2012 9:01 am

You have to disassemble the RAID and create a virtual RAID out of the disks. This article gives the overall concept on virtual RAIDs: RAID recovery presentation, this help chapter explains how to create a RAID 5: Basic RAID 4 and RAID 5 Operations, and this free program finds required RAID parameters: ReclaiMe Free RAID Recovery.

muzicman82
Posts: 12
Joined: Mon Nov 07, 2011 1:47 am

Re: File System Recovery

Post by muzicman82 » Tue Apr 17, 2012 9:17 am

OK, I will certainly try that. Can you briefly explain why it can't be treated as one volume/disk? That's a little beyond my knowledge of how this stuff works.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: File System Recovery

Post by Alt » Wed Apr 18, 2012 4:28 am

There may be several reasons for that. One, for example, is corrupted RAID service information.
When a RAID controller creates a RAID out of the disks, it writes some service information on it like the disk order, block size, etc. When such information becomes corrupted for some reasons, the controller cannot assemble the RAID anymore, or does that incorrectly. Therefore, Windows cannot access file system information and treats the RAID as an unformatted volume. But the data on the disks remains uncorrupted and can be recovered.
When you create a virtual RAID in R-Studio, you specify those parameters manually, the RAID is assembled correctly, and the data may be retrieved.
Just notice - this is only one reason, there may be others, and it's impossible to determine which one without seeing the actual data on the disks.

muzicman82
Posts: 12
Joined: Mon Nov 07, 2011 1:47 am

Re: File System Recovery

Post by muzicman82 » Sun Apr 22, 2012 4:12 pm

OK, I removed the drives and mounted them individually and created a virtual RAID block. I used 512 byte block size and left synchronous for Oxford 936SE. It found the same files as it did in the enclosure.

I'm guessing this means the data is hosed?

Time to start over I guess.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: File System Recovery

Post by Alt » Mon Apr 23, 2012 8:12 am

muzicman82 wrote: I'm guessing this means the data is hosed?
Most likely, yes.

Post Reply