Jump to content

Raw Harddrive but dont know where to start


Recommended Posts

Well i see that alot of issues with raw data but mine has a twist 

 

i have 2 ssd 120gb in raid to make 1 240gb ssd hd

 

no i not sure what to do to restore of fix the issue even recovering data dont seem easy 

 

im using g parted live witch finds the 2 ssd and the mapped raid ssd but cant recover it or repair 2 error , 1 partition outside of disk and 1 other , 1 ssd is unallocated 1 is ok wid a warning

 

but i duno how it used to be 

 

i have testdisk but duno how to use it on a ssd/raid 

 

testdisk shows 2 ssd and 2 mapped

 

all these fault was cause but chkdsk on pc restart when it crashed 

 

any way i can save or restore data before i cut my losses witch are my appdata folders and my documents ?

 

 

was only 4 days away from my server being up and would of had restore image :(

 

thanks for anyhelp 

Link to comment
Share on other sites


The two SSD's (if setup in RAID) can only have been RAID 0 (which is not strictly speaking a RAID level) or in RAID 1.

 

You need to know how it was setup earlier, if you had the two 120 Gb set up in order that combined they made a 240 Gb device, you have Raid 0 (which is a setting for "speed only" as it provides no redundancy whatsoever).

 

I don't think that Gparted (and  not even testdisk) are suitable tools to recover a striped in RAID 0 setup.

 

You need a specific tool (or do it manually):

http://www.freeraidrecovery.com/library/raid0-recovery.aspx

to find the parameters of the Raid and hopefully recover the data that can be recovered.

 

I don't think that there are freeware tools for raid recovery (but I may well be wrong) apart the mentioned one:
http://www.freeraidrecovery.com/library/data-recovery-vs-raid-recovery.aspx

and DMDE:

http://dmde.com/

http://dmde.com/manual/raids.html

 

I am personally very partial to DMDE, which I find an exceptionally good tool, but it is NOT an "automated" or "automagic" kind of tool.

 

Otherwise, you may try using the former to create a destriped image and then you will be able to run (say) Testdisk, CHKDSK  on the image to attempt recovering the filesystem and, should this not be possible, attempt recovering the files (photorec and similar).

 

jaclaz

Link to comment
Share on other sites

yes raid 0 was set up 

 

currently trying the free http://www.freeraidrecovery.com/library/raid0-recovery.aspx

 

selected the 2 ssd and found sumink gives me the option to write array to disk , hoping it will make the old array to 1 disk 

 

i have no issues paying to fix it tho 

 

if fails ill set it up to my pc (for speed) and try dmde 

 

whats destriped image ? 

Link to comment
Share on other sites

The RAID 0 is the most basically form of multi device striping.

If you have a (very small) filesystem that is made of 8 blocks (in this case blocks the size of the striping, not necessarily the device block size), you will have on a "normal" single disk blocks arranged as:
1st disk 1-2-3-4-5-4-7-8

When you create a Raid 0 you "stripe" the filesystem on two disks, and you will have:

1st disk 1-3-5-7

2nd disk 2-4-6-8

 

 

A destriped image is the result of taking the blocks alternatively from the two devices and arranging them as they would have been on a single disk:

Image: 1-2-3-4-5-6-7-8

 

In "normal" operation of the OS the RAID 0 (be it a hardware raid or a software one) is "transparent" to the user, but when it comes to data recovery, the tool in use may access the device(s) directly or however using algorithms that are not compatible with a non-sequential/multi-device arrangement.

 

If you prefer, once the two devices in a Raid0 have been destriped into a single image, the recovery process is exactly the same if there was not a Raid0, but rather a "normal" single disk/volume.

 

The reasons why *any* filesystem may fail can be mainly caused by:

  1. hardware failure <- which can be due to any of the two SSD involved malfunctioning or to one of the two channels to which they are attached (just as an example think what would happen if one of the two cables connecting the devices has a "false contact" :ph34r:
  2. software failure <- which can be due both to an issue with a Mass Storage driver in the OS or to an incorrect filesystem driver or to a "wrong" write operation caused by *any* malfunctioning software running in it or even to an issue of some kind in the firmware (please read as BIOS) in the case of a "hardware" RAID

Once you have accessed a device (or in your case a couple of devices) in DMDE, you do a "scan" to find which (parts of) filesystems it can find, each and every disk image that was saved as "RAW" (or as VMDK or as VHD/VHDX) on the original volume will be found (DMDE has no way to know it is an image and not a partition/volume).

It is your duty to find (since it was a single partition volume, from the info you posted, it will be easy) which volume is the "previous one" and select it for further analysis (the volume will be in your case the one which starts first and ends last, i.e. the one with biggest extents).

 

Depending on the actual reason why the corruption occurred and to the specific corruption that occurred (i.e. which areas of the filesystem were affected and how large are the affected areas) recovering a corrupted filesystem can be easy or downright impossible, no way to know in advance.

 

Then again, even if the filesystem is unrecoverable, single files in it may be either fully recoverable (contiguous files) or only partially recoverable or unrecoverable.

 

DMDE is a very powerful tool but it implies (besides studying attentively it's manual/help file) an underlying knowledge of the filesystem that you are going to attempt recovering.

 

jaclaz 

Link to comment
Share on other sites

ntfs filesyster was founf on 8th sector (huge) but how irestore it , 

 

ive restores all files from route (so i got my important stuff back)

i have a back up image of the file 

and cloned image to a 2nd drive 

 

so im safe to play now but wana try change from raw , no english videos of this process 64k was only sector serch with no errors and seems so have alllll my data back

 

so what option to restore file 

Link to comment
Share on other sites

No. :no:

In the sense that I strongly doubt that a NTFS filesystem can be found on 8th sector on a hard disk like device.

 

Normally the VBR of first volume on any partitioned device is (depending on the disk setup/partitioning tool used and under which OS) is normally at offset 63 sectors (before Vista) and at offset 2048 sectors (Vista and later).

 

Are you sure about this "8th sector"? 

Are you sure you provided the disks in th eright order (or that they were identified properly)?

Do you have now a non striped image?

 

Check the first sector of the image (or first sector of both devices).

It should be normally a MBR (even if GPT, it would have a "protective" MBR entry).

 

You can access the device or image with DMDE, you should have a situation similar to the screenshot attached (IF the MBR data is still valid).

 

jaclaz

 

 

post-25215-0-94483700-1411923153_thumb.j

Link to comment
Share on other sites

Well, then it's OK, it is the RAID sector (the data in the MBR is about CHS 8/0/1 whilst the LBA is 8 sectors), either is a "peculiarity" of the RAID setup or the disk has been partitioned with a third party tool.

However, the "main" volume is the one corresponding to line:

HD Primary(A) NTFS(07) 238Gb EBCF 8 464 842 744

which is also seemingly in "good shape" (at least when it comes to "primary" descriptors) as you have the EBCF in green.

http://dmde.com/manual/partitions.html

 

You should select that line and then click on "Open volume", the other ones are "false positives".

 

jaclaz

Link to comment
Share on other sites

i found it all but how do i go about restoring it to a single hard drive ? as no option to repair ?

What do you mean?

If you found the actual files (and you need them) you copy them to a new volume.

 

If you want to repair the filesystem on the single image you use CHKDSK, after having found and corrected manually the errors (if any) that you found through analysis of the image.

 

jaclaz

Link to comment
Share on other sites

if i recovery the partition its still raw data so it wont work with chkdsk ? 

do u have skype maybe u could give me a hand

You do not recovery "the partition".

You recovery files from it copying them to another volume.

 

If you want instead to rebuild the file system you need to correct (if needed) errors up to a level where the file system recognizer of the OS can recognize it, it is a manual, long and rather difficult procedure, doable, but not something that you can do unless you have already a deep knowledge of the file system structures.

 

And you might need additional tools, a good hex/disk editor, I personally use good ol' Tiny Hexer:

http://reboot.pro/topic/8734-tiny-hexer-scripts/

and here is another useful tool IMHO:

http://ntfs.com/recovery-toolkit.htm

 

No, I have not Skype, actually I don't even have sound on my PC.

 

jaclaz

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...