Braindead-75

Distinguished
Feb 25, 2010
11
0
18,520
Hello,
I run raid, and one drive of 2 degraded so I went into Intell Storage matrix and selected rebuild raid. No questions it just started.... Luckily i had "my Computer" screen open and watched my storage HD (3rd hard drive) Disapear!@#@$&%!!!! No stop button and no undo - real great!!!!I freaked opened the case and unplugged my storage before it could finish. Now when I plug it back in, it relabled my DVDR BD and my storage drive with new drive letters (DVDR is now D: when storage was before)and try Data Recovery software it cant find "D:" Hard Drive or my stuff what do I do oh great pc wizard or wizardess???????
 

Paperdoc

Polypheme
Ambassador
OK, for future reference, you NEVER disconnect a drive while it is in use. Doing that GUARANTEED that your drive's data is badly corrupted and you may never get your data back.

First we'll deal with the drive letter names issue. Your system has re-named things because a drive has disappeared and its former name became available. You can manually change names. You use the Windows tool Disk Management. In its LOWER RIGHT pane you will see all your hardware drive devices. For example, if you RIGHT-click there on the the optical drive now called D: you will have a choice to change its name. Use that to give it any letter name NOT currently in use. If you want it to be F: and that letter is already assigned to some other device, do some temporary renaming and then re-do it so you get all your working devices named as you wish. Exit from Disk Management and reboot so the Registry is updated to this naming system.

Now, what kind of RAID? If was RAID0 and it became degraded, you have a major problem. In that system BOTH drives must be working to get any use out of them, because only half of each file is on one drive - the parts are alternated between the two drive units in the array. Once one drive malfunctions, the very best you can hope for is that the damage is limited to only a very few files you can't recover, and you can get the rest of it. For that reason, anyone who uses RAID0 MUST "get religion" about regular backups to guard against total loss of all data from the array. Given what you have done, though, it is HIGHLY likely that, if you were using a RAID0 array you have lost ALL of its contents and you can't get any of it back unless you have that backup data elsewhere. You may be able to fix whatever the problem is with the hard drive units so they can be re-used, or you may have to replace at least one of them.

IF on the other hand you were using a RAID1 array, there may be hope. In that system both HDD units have identical copies of all the data. Even if one drive fails and you get the Degraded message, the other drive has a complete copy. The usual solution is to use the RAID management tools to isolate the faulty unit and fix or replace it, then rebuild the array. This last step merely means the system will prepare the new disk for use and make a complete copy of data from good old disk to new (or repaired) disk and re-establish the whole RAID1 array ready to use again. So, IF you had been using a RAID1 array you should be able to use the Intel RAID system to break the array into separate disks if necessary, diagnose and fix whatever problems there are on the one faulty disk, then re-establish the array. In doing so you will have to pay attention to how it is named, and you might have to use Disk Management again to set those manually. But at least with RAID1 you have a chance of recovering most or all of your disks' contents. Unless, of course, the whole unplugging-in-the-middle of things operation corrupted BOTH disk unit's data.
 

Braindead-75

Distinguished
Feb 25, 2010
11
0
18,520
Ok so it is Raid1, the degraded drive did get repaired. But the problem is this:
For refrence we will call the raid disks 1&2 = C:, with #3= (should still be D: but as you heard was relabled to F:) being the storage disk.

Raid 1&2 i did get rebuilt with no loss
#3 was my storage and this was my thinking stupid as it is now, with operating and software on (1&2 C:) i would keep data only on storage #3 so when attacked by virus it would think #3 is cd or such so no information would be lost when operating software is attacked. This worked great for 4 years.

But when part of 1&2 got degraded, instead of rebuilding on original drives it went and used #3 (storage) to be secondary raid drive, and wrote over all my files with operating software stuff.
So esssentially I lost all my company data, forms, job pictures, and documents. Not to mention tons of personal pictures songs, etc.

I tried to run a trial version of EASUS Data Recovery Wizard, to see if anything is left of my storage and it seams as if it has been completely wiped out (written over). I can not find one doc or form from storage, only windows icons and operating stuff.

So what is my chances of recovering my storage data, and is there a good program to use? I have checked with a pro and he said I'm looking at $1600.00 for him to recover what he can with no guarantees. Unfortunatly I became too confident in my system's abilities and have not done a back up since November of 08.

How screwed am I?
 

Braindead-75

Distinguished
Feb 25, 2010
11
0
18,520
Ok but when it formated #3it took a 360 gig drive and made it a 250 to match the other mirrored drive. So it now has a secondary partition that is not being used and it does not have a directory \ tree, or any kind of accessable contents for the new partition.

So what if I delete the partition and the mirrored overwrite, and then try to recover? Will it see the files on the disk in un associated sectors or partitions?
Now that there is no misleading recorded files?

Or will it be unreadable alpha-bit soup? Right now I have been quoted $1600 with no guarantee, but why can't I try the same things they will? Mostly it's just software running, but what software and what preparation to the disk? I've tried two now with no success.

So give me a off the hip, hunch, what the h$#l, try this idea.
 

Braindead-75

Distinguished
Feb 25, 2010
11
0
18,520
these programs are meant really to "undelete" files not ones that are written over. so maybe it does not know the files are there due to the new partition and never being deleted? I know I'm grasping but....

At this point I am open to untested ideas.
 

Braindead-75

Distinguished
Feb 25, 2010
11
0
18,520
Ok so i deleted the overwritten partition then went back and searched the drive again with recovery software. It now can find the links to my documents but no documents show yet any ideas?
 

Paperdoc

Polypheme
Ambassador
So you have a 360 GB drive that had a bunch of data and then you over-wrote the first 250 GB of its space to create a new Primary Partition, Format it, and write a whole new set of data there. Then you ran an Undelete operation on that 250 GB Partition and have found references to some of the old files, but can't actually get any of their data back.

Bottom line appears to be you MIGHT get a little of your old data back, but not much, and the odds are not good.

A File System uses several data structures to track what files exist, where their fragments are and in which order do they fit together. I understand that nobody outside of Microsoft really understands ALL of the details of NTFS, and I certainly don't. But for a rough idea of the process, the older FAT32 system did this. First level: there is a Partition Table at the start of the disk with details of exactly what contiguous blocks of the hardware device are assigned to which Partition; each Partition is treated as one "drive" by the OS. Next level (in each Partition): there is a Root Directory of fixed size, plus a File Allocation Table. For each file listed in the Root Directory, there is a record containing the file's name, its size, a date or two, and a pointer to the very first Allocation Unit (group of hardware Sectors) containing its data. There also is a File Allocation Table with enough space to record data for every Allocation Unit on the disk. Each of its entries is actually the pointer to the NEXT Allocation Unit containing file data. The Last entry in the chain of records for a file contains a special character recognized as saying "there are no more Allocation Units - you've reached the end of this file." When you create a file, all this info is filled in. When you delete a file, the very FIRST character of the file's name in the Directory is replaced with a special character to signify this but all the rest of the Directory entry is left unchanged. Over in the FAT, all of the entries associated with this file are re-written to zeros, and that makes them available for use by anything else. At some later time as new files are written, the space in the Root Directory may be overwritten with a new set of info, and the available entries in the FAT (and on the disk data sectors) may be re-assigned and used.

When you create and use a Subdirectory, it actually is simply a special version of a File, and it contains the same type of info in the Root Directory. But the actual tracking of Allocation Units for the files in it are still done with that one central File Allocation Table.

An Undelete operation can work IF certain things happen to be available. First, the Directory entry must be there, so that if you simply can replace the special first character with something else, it has a valid file name again. Then based on the length of the file and its FIRST allocated sector as detailed in the directory entry, the Undelete program can examine the FAT. It has to make an ASSUMPTION, for one thing. It will assume, because it has NO other info to use, that the disk sectors that originally were assigned to the file were just in one long continuous string. So it will look at the FAT entries, starting at the first one (from the directory record), and see whether there is a long string of entries marked with zeroes (meaning they are not in use now), and whether the length of this string matches the calculated disk space needed for the know file length. If the answer is yes to both, it can create a new set of entries in the FAT based on the assumed previous data and your file is restored. Well, maybe - there is no guarantee that the allocation sequence really was as assumed!

So, look at your particular case. You had data on a 360 GB unit; most of it would have been placed in the early part of the HDD, but some might be in the last 100 GB. Then you re-wrote the Partition Table, wrote a new blank Root Directory and Allocation Table for files, and filled in a bunch of data in those structures. In the Allocation Table all of the entries would have been reset to zero to show them ALL as available. Likewise the root directory would probably have been re-written to blanks before filling it up again. But even if it were not blanked out to start, all of the old data there pointed to the starting points of each old file in an Allocation Table that had been zeroed out! So, even if old file names existed, there is NO record of where they were! And of course, there's still that last 100 GB of physical space for which there is NO reference info at all!

A good file Recovery program starts by using those simpler pieces of info. But at some point ti might resort to examining every unallocated disk sector and looking for non-zero data. If it finds a sequence of sectors containing data, with blank sectors before and after it, it could offer that as a potential file. But the software alone can't know whether it's a file or not, or how complete it might be. That takes a trained person to examine and decide. And if any one old file actually is recovered as three or four such sequences in different areas, fitting them together is part of a giant data jigsaw puzzle.

Bottom line is you cannot find software to do the whole job on a disk unit that has had significant data over-writing going on. And the expensive expertise you can hire will only be able to find a small part of your old data. How successful they might be depends heavily on how fragmented your old files were before the disaster.