QNAP RAID 5 Deleted files recovery attempt

Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
Reckless eraser
Posts: 5
Joined: Fri Jul 29, 2016 2:32 am

QNAP RAID 5 Deleted files recovery attempt

Post by Reckless eraser » Fri Jul 29, 2016 3:13 am

Hello dear erasers, I'm fighting with my RAID5 (3x4TB) QNAP archive.
I deleted a whole folder (3TB) by mistake while I was trying to create a new common share, both HDDs and filesystem are fully working.

Now, I connected the 3 HDDs through USB3.0 dockstations to my Windows 7 laptop, and successfully rebuilt the RAID5 (at least I suppose I did).
I started with the best intentions, trying to autodetect RAID parameters, then I saw that it would have taken ages...So browsking around I found that the most commonly discussed parameters for QNAP RAIDs were Left synchronous/64Kb. Also my last QNAP RAID log confirm these settings.

I started the basic file recovery procedure, since I had no damaged drives and all files I want to get back were on an existing logical disk.
Here comes the first question, is basic file recovery enough or will I have to perform advanced data recovery too?

The result of the scan are a tons of recognized partition, few of them green, a tons yellow, and the last one red. I read all guides and manual of course, and learnt that probably deleted files will be found inside the yellow ones.
Second question, why do I see only recognized partitions, but not the actual filesystem? The RAID is working and it's not damaged, shouldn't I see also the "not deleted" filesystem with real folders and the "existing" files?

By the way, to better understand what I would find into each category of the recognized partitions I enumerated the bigger green partition and the bigger yello partition.
I found a sh**load of files! Most of them irrelevant to my needs, but some of them are the files I was looking for.
I saw also that most of the files are common between green/yellow partition, when prompted I told to rename them, a later check confirmed it. A lot of files are the same, differences are found in integrity since some times one or more copies of a files are damaged and I have to find the best one.
Third question, I have a lot of partitions to scan yet, do I have to suppose that 90% of files within are the same files I already recovered? How is the R-Studio's logic to "assign" files to recognized partitions? I would like to understand if it worth wasting days and days enumerating all partitions or should I stop earlier.
Another point is that R-Studio marks these partitions as 110GB size, but when I recover files each one of them produces 800/900GB of files...So it appears obvius that the majority of files are redundant, if not with 10 partitions I would cover whole NAS storage capacity.

So, my doubts:
1 - Is basic file recovery enough if I have just to recover deleted files from a working filesystem, or will I have to perform advanced data recovery too?
2 - Why do I see only recognized partitions, but not the actual filesystem? The RAID is working and it's not damaged, shouldn't I see also the "not deleted" filesystem with real folders and the "existing" files? This would allow me to focus on deleted files only.
3 - Do I have to suppose that 90% of files within each recognized partition are the same files I already recovered? How is the R-Studio's logic to "assign" files to recognized partitions? I would like to understand if it worth wasting days and days enumerating all partitions or should I stop earlier.

Sorry for my bad english and a huge thank you to whoever wants to help me recovering my beloved data.
Regards.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Alt » Fri Jul 29, 2016 9:00 am

QNAP runs under the Linux OS. When Linux deletes a file, it really deletes it. That is, the system removes a lot of important information about the file making file recovery very difficult, using only search for known file types (file signatures). You may learn more about this in our article File Recovery Basics: How Data Recovery Works.
Still, some chances remain.
1. As the file system on the RAID isn't damaged, the partition with that file system should immediately appear as soon as you create the RAID with valid parameters. You should scan the partition rather than the whole RAID. When scanning, you should check only the ext fs file system and only those file types you're looking for. See R-Studio's help Disk scan for details.
If R-Studio cannot fined the file system, either you assemble the RAID incorrectly or something wrong with that partition. Then scan the entire RAID and select a GREEN recognized partition. You should go through green partitions because you need to find a healthy one.
2. Look for the deleted files in the Extra Found Files within the partition. You may sort the found files by their types (extensions)Find and Mark Multiple Files and use File mask and advanced search capabilities to filter out only those files you want to look at.

It's hard to say why there are many recognized partitions found on the RAID without knowing the history of your QNAP device.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Alt » Fri Jul 29, 2016 9:03 am

If possible, please, post a screenshot of the R-Studio main panel after the scan. And don't forget to save the scan info for not having to re-scan the RAID each time you interrupt the file recovery.

Guest

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Guest » Fri Jul 29, 2016 10:06 am

Hello Alt, thank you for your help.

I'm not much into these kind of technologies so please understand my doubts, here is what i did:
1 - I created RAID without autodetection of parameters (it would have taken too long, and I found 64kb block and left synchronous into the QNAP logs before taking off the disks). Before taking off disks I also enumerated them, then rebuilt the right order in R-Studio by checking HDD's serial numbers.
2 - I did the first scan of the virtual raid (double clicked) and saved scan data (took 20hrs), but at this point I didn't see any valid filesystem or folders (so I had doubt about having set the right RAID parameters).
3 - The scan results are 4 or 5 green recognized partitions (one of them is labeled with DataVol1 and is really big, the others have no label), tons of yellow partitions, a single red partition.
4 - I started enumerating files from the biggest green partition (the DataVol1 one), I found a huge number of files, I can recover and successfully read most of them (music and pictures mostly, I'm absolutely sure that most of them are deleted files). I suppose that this fact automatically confirms that my RAID parameters are correct, am I right? But if yes, why I can't see the intact filesystem?

What's the difference between green and yellow partition? It seems that any of them recover the same exact files. It's just a matter of "quality" of these files?
In this case should I go beyond green partitions only in case I don't recover all what I need from green ones?

I'll post a screenshot of my R-Studio as soon as possible.

Thank you...a lot of questions...since I'm planning to spend the weekend recovering and renaming thousands of files I wanna be sure that I'm doing right.

Reckless eraser
Posts: 5
Joined: Fri Jul 29, 2016 2:32 am

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Reckless eraser » Fri Jul 29, 2016 10:29 am

Uhm, I posted a reply but seems disappeared.
I attach the printscreen meanwhile...
You do not have the required permissions to view the files attached to this post.

Reckless eraser
Posts: 5
Joined: Fri Jul 29, 2016 2:32 am

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Reckless eraser » Fri Jul 29, 2016 10:31 am

I've been able to recover some files, shouldn't this confirm with no doubt that I built the RAID with correct parameters?
So I should scan just the green partitions and pass all the others? I thought it was the opposite...

Edit: one more question, what are the vg1 drives listed under devices/disk? They appeared after RAID creation...

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Alt » Mon Aug 01, 2016 8:15 am

Are the successfully recovered files larger than 128 KB? If yes, you indeed created the RAID with correct parameters.

vg are the LVM volumes created by the device. What was the size of the volume on the QNAP? 7.12TB or 3.61 TB? If the first one, look at _2 and scan it. If the second one, look at Recognized128. You do not have to re-scan it, it's been already fully scanned. I thought the partitions appeared when you created the RAID.

Reckless eraser
Posts: 5
Joined: Fri Jul 29, 2016 2:32 am

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Reckless eraser » Mon Aug 01, 2016 3:43 pm

Ok, I recovered all my pictures and .Mp3 files, but it seems that many .FLAC and all .MKV are gone.
Almost all of them are corrupted, I suppose this is normal due to their huge size, MKVs in particular are always over 7Gb.
I recovered just some FLAC (20%) and no MKV Movie.

Does this sound fine for you Alt?
Can I mount disks into NAS again?

This software is badass by the way.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Alt » Wed Aug 03, 2016 7:25 am

It's a little bit hard to make guesses remotely without thoroughly browsing through the data, isn't it?
Well, large files are really hard to recover. If you feel satisfied, maybe it's time to stop and put up with the results.

Reckless eraser
Posts: 5
Joined: Fri Jul 29, 2016 2:32 am

Re: QNAP RAID 5 Deleted files recovery attempt

Post by Reckless eraser » Fri Aug 05, 2016 4:27 am

Yes it is.
After a lot of browsing I decided to drop .mkv movies because of their size, really hard to recover them with no corrupted sectors.
I'm fine with what I recovered, this software is absolutely great value for money.
Thank you for the support.
Cheers.

Post Reply