DATA Recovery (accidental re-initialization of RAID 1)

[Matus_5]

Hello. I am desperate. Please help me. This is what happened:

1: I had two 2GB disks in RAID1 (mirror), through Intel RST (Rapid Storage Technology). I was using this as backup (stupid I now).

2: Later I bought newer PC and I moved the disks here. In the meantime I have read that RAID1 is not good for backup, so I decided not to use it anymore. But I did not cancel the RAID array - I was using both disks separately - one of them I formatted and it was used as backup disk (I started using EaseUS Todo Backup). Everything was fine. To be clear, I will name the disks: D=DATA, E=BACKUP.

3: I found out some of my PC drivers were not up-to-date, so I decided to download all drivers for my PC (motherboard), including this Intel RST, not thinking about what it could cause. After installation of Intel RST and restart, there was windows startup problem and disk checking came up. It stack at some percent for maybe an hour, so I restarted. This repeated many times and after I finally got into windows, I found out that the RAID1 was initialized somehow (by Intel RST) - disks are mirrored, but many data are missing. And some of the data worked, some I could not even open. It looked like it restored RAID with data from my previous PC (3 months ago) - data since then were missing. But, also data from backup (E drive) from EaseUS software were present, but corrupted, so I couldnt recover from them.

4: I lost important data (architectural projects, my firm documents etc), but I rely always on myself (mistake). So, in agony, I tried to use the Recuva software, which recovered me tons of files, but without any structure (200,000 files in one folder), and still the new ones were missing. I restored the files to E drive

5: I decided to call in IT-guy, who of corse told me, that after new data were copied (after data loss), it will be difficult to recover them. He tried to recover the data with EaseUS Data Recovery PRO, but with bad results. Data missing from the 3-months span were missing, and data, which he was able to recover, were not working - file error comes after opening any file (jpg, pdf, dwg...)

6: Any ideas, what could bring me my data back? Is it somehow to restore the state, before this accidental re-initialization of RAID happened? Thank you very much for yout help!!!

 

[ex_bubblehead]

This is the point where you restore from the backups you should have been keeping for just such an occasion. Once files are overwritten there is nothing anyone can do to recover them.

 

[jaslion]

Hello. I am desperate. Please help me. This is what happened:

1: I had two 2GB disks in RAID1 (mirror), through Intel RST (Rapid Storage Technology). I was using this as backup (stupid I now).

2: Later I bought newer PC and I moved the disks here. In the meantime I have read that RAID1 is not good for backup, so I decided not to use it anymore. But I did not cancel the RAID array - I was using both disks separately - one of them I formatted and it was used as backup disk (I started using EaseUS Todo Backup). Everything was fine. To be clear, I will name the disks: D=DATA, E=BACKUP.

3: I found out some of my PC drivers were not up-to-date, so I decided to download all drivers for my PC (motherboard), including this Intel RST, not thinking about what it could cause. After installation of Intel RST and restart, there was windows startup problem and disk checking came up. It stack at some percent for maybe an hour, so I restarted. This repeated many times and after I finally got into windows, I found out that the RAID1 was initialized somehow (by Intel RST) - disks are mirrored, but many data are missing. And some of the data worked, some I could not even open. It looked like it restored RAID with data from my previous PC (3 months ago) - data since then were missing. But, also data from backup (E drive) from EaseUS software were present, but corrupted, so I couldnt recover from them.

4: I lost important data (architectural projects, my firm documents etc), but I rely always on myself (mistake). So, in agony, I tried to use the Recuva software, which recovered me tons of files, but without any structure (200,000 files in one folder), and still the new ones were missing. I restored the files to E drive

5: I decided to call in IT-guy, who of corse told me, that after new data were copied (after data loss), it will be difficult to recover them. He tried to recover the data with EaseUS Data Recovery PRO, but with bad results. Data missing from the 3-months span were missing, and data, which he was able to recover, were not working - file error comes after opening any file (jpg, pdf, dwg...)

6: Any ideas, what could bring me my data back? Is it somehow to restore the state, before this accidental re-initialization of RAID happened? Thank you very much for yout help!!!

It's gone. Overwritten data cannot be retrieved. Raid is not a backup. Unless you kept a backup somwhere these files are lost.

 

[S Haran]

So you are saying before the problem developed one drive had data and the other drive had backups but now they are mirrored. So which one was mirrored the data drive or the backup drive?

If you have a copy of one of your lost files or remember some unique keywords then with a hex editor you could do a hex search on each raw drive. If the search is successful post back there may be some hope.

 

[Matus_5]

So you are saying before the problem developed one drive had data and the other drive had backups but now they are mirrored. So which one was mirrored the data drive or the backup drive?

I cannot really tell, since the mirroring process was probably not complete, so there was mix of both. It lacked logic (at least I couldnt understand the state which they came after the problem).

If you have a copy of one of your lost files or remember some unique keywords then with a hex editor you could do a hex search on each raw drive. If the search is successful post back there may be some hope.

I tried hex search and found some files (via text search), but what is next step, please? Is it possible to recover some files this way? Thanks.

 

[S Haran]

Finding some files is a good sign. There is hope to find more.

It would help to know the extent of the mirroring. Again with a hex editor you can compare random addresses on each drive to see if the data is the same or not.

But in any case there are two ways to proceed, filesystem recovery and data carving. Assuming NTFS try running a NTFS scan with DMDE.com it attempts to reconstruct the filesystem based on MFT fragments.

If DMDE fails to produce good results then the last resort is a scan with Photorec from CGSecurity. It carves data by filesystem type, .doc .pdf etc. Not an ideal solution but better than nothing.

If you get stuck and would like me to look at it for you remotely shoot me a PM.

 

[USAFRet]

Even with the current consumer level data recovery application, getting it all back in its original file structure is nigh impossible. file001, file002, file003....Doesn't do a lot of good.

Backup backup backup
And test that backup procedure, before you actually need it.

 

[S Haran]

USAFRet is right to point out that data carving does not recover the original filename or folder structure. But to be fair it will recover the file extensions like file001.jpg, file002.txt, file003.pdf etc. That is why data crving is always the last resort in any data recovery case. Of course the level of goodness from this approach is for the OP to decide.

After giving this some more thought, if filesystem recovery is not possible, it might be useful to consider data carving by keyword. Normally data carving a whole disk will produce a massive number of random filenames to sort through. So for example if you only care about recovering say pdf files that contained the keyword "John Smith" a script could be written to scan all disk sectors for that keyword and then carve out all the pdf files containing only that keyword.