Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

Raw Harddrive but dont know where to start

- - - - - raw data restore recover harddrive hd

  • Please log in to reply
9 replies to this topic

#1
Craigst

Craigst
  • Member
  • 7 posts
  • Joined 27-September 14
  • OS:Windows 8.1 x64
  • Country: Country Flag

Well i see that alot of issues with raw data but mine has a twist 

 

i have 2 ssd 120gb in raid to make 1 240gb ssd hd

 

no i not sure what to do to restore of fix the issue even recovering data dont seem easy 

 

im using g parted live witch finds the 2 ssd and the mapped raid ssd but cant recover it or repair 2 error , 1 partition outside of disk and 1 other , 1 ssd is unallocated 1 is ok wid a warning

 

but i duno how it used to be 

 

i have testdisk but duno how to use it on a ssd/raid 

 

testdisk shows 2 ssd and 2 mapped

 

all these fault was cause but chkdsk on pc restart when it crashed 

 

any way i can save or restore data before i cut my losses witch are my appdata folders and my documents ?

 

 

was only 4 days away from my server being up and would of had restore image :(

 

thanks for anyhelp 




How to remove advertisement from MSFN

#2
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,463 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

The two SSD's (if setup in RAID) can only have been RAID 0 (which is not strictly speaking a RAID level) or in RAID 1.

 

You need to know how it was setup earlier, if you had the two 120 Gb set up in order that combined they made a 240 Gb device, you have Raid 0 (which is a setting for "speed only" as it provides no redundancy whatsoever).

 

I don't think that Gparted (and  not even testdisk) are suitable tools to recover a striped in RAID 0 setup.

 

You need a specific tool (or do it manually):

http://www.freeraidr...0-recovery.aspx

to find the parameters of the Raid and hopefully recover the data that can be recovered.

 

I don't think that there are freeware tools for raid recovery (but I may well be wrong) apart the mentioned one:
http://www.freeraidr...d-recovery.aspx

and DMDE:

http://dmde.com/

http://dmde.com/manual/raids.html

 

I am personally very partial to DMDE, which I find an exceptionally good tool, but it is NOT an "automated" or "automagic" kind of tool.

 

Otherwise, you may try using the former to create a destriped image and then you will be able to run (say) Testdisk, CHKDSK  on the image to attempt recovering the filesystem and, should this not be possible, attempt recovering the files (photorec and similar).

 

jaclaz



#3
Craigst

Craigst
  • Member
  • 7 posts
  • Joined 27-September 14
  • OS:Windows 8.1 x64
  • Country: Country Flag

yes raid 0 was set up 

 

currently trying the free http://www.freeraidr...0-recovery.aspx

 

selected the 2 ssd and found sumink gives me the option to write array to disk , hoping it will make the old array to 1 disk 

 

i have no issues paying to fix it tho 

 

if fails ill set it up to my pc (for speed) and try dmde 

 

whats destriped image ? 



#4
Craigst

Craigst
  • Member
  • 7 posts
  • Joined 27-September 14
  • OS:Windows 8.1 x64
  • Country: Country Flag

well ur program of choice just started using duno how to use it , but so far looks good 

 

lots of ntfs volume's , 

 

duno what to do with that tho , found raid 0 ad HD

 

thats good right ?



#5
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,463 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

The RAID 0 is the most basically form of multi device striping.

If you have a (very small) filesystem that is made of 8 blocks (in this case blocks the size of the striping, not necessarily the device block size), you will have on a "normal" single disk blocks arranged as:
1st disk 1-2-3-4-5-4-7-8

When you create a Raid 0 you "stripe" the filesystem on two disks, and you will have:

1st disk 1-3-5-7

2nd disk 2-4-6-8

 

 

A destriped image is the result of taking the blocks alternatively from the two devices and arranging them as they would have been on a single disk:

Image: 1-2-3-4-5-6-7-8

 

In "normal" operation of the OS the RAID 0 (be it a hardware raid or a software one) is "transparent" to the user, but when it comes to data recovery, the tool in use may access the device(s) directly or however using algorithms that are not compatible with a non-sequential/multi-device arrangement.

 

If you prefer, once the two devices in a Raid0 have been destriped into a single image, the recovery process is exactly the same if there was not a Raid0, but rather a "normal" single disk/volume.

 

The reasons why *any* filesystem may fail can be mainly caused by:

  1. hardware failure <- which can be due to any of the two SSD involved malfunctioning or to one of the two channels to which they are attached (just as an example think what would happen if one of the two cables connecting the devices has a "false contact" :ph34r:
  2. software failure <- which can be due both to an issue with a Mass Storage driver in the OS or to an incorrect filesystem driver or to a "wrong" write operation caused by *any* malfunctioning software running in it or even to an issue of some kind in the firmware (please read as BIOS) in the case of a "hardware" RAID

Once you have accessed a device (or in your case a couple of devices) in DMDE, you do a "scan" to find which (parts of) filesystems it can find, each and every disk image that was saved as "RAW" (or as VMDK or as VHD/VHDX) on the original volume will be found (DMDE has no way to know it is an image and not a partition/volume).

It is your duty to find (since it was a single partition volume, from the info you posted, it will be easy) which volume is the "previous one" and select it for further analysis (the volume will be in your case the one which starts first and ends last, i.e. the one with biggest extents).

 

Depending on the actual reason why the corruption occurred and to the specific corruption that occurred (i.e. which areas of the filesystem were affected and how large are the affected areas) recovering a corrupted filesystem can be easy or downright impossible, no way to know in advance.

 

Then again, even if the filesystem is unrecoverable, single files in it may be either fully recoverable (contiguous files) or only partially recoverable or unrecoverable.

 

DMDE is a very powerful tool but it implies (besides studying attentively it's manual/help file) an underlying knowledge of the filesystem that you are going to attempt recovering.

 

jaclaz 



#6
Craigst

Craigst
  • Member
  • 7 posts
  • Joined 27-September 14
  • OS:Windows 8.1 x64
  • Country: Country Flag

ntfs filesyster was founf on 8th sector (huge) but how irestore it , 

 

ive restores all files from route (so i got my important stuff back)

i have a back up image of the file 

and cloned image to a 2nd drive 

 

so im safe to play now but wana try change from raw , no english videos of this process 64k was only sector serch with no errors and seems so have alllll my data back

 

so what option to restore file 



#7
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,463 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

No. :no:

In the sense that I strongly doubt that a NTFS filesystem can be found on 8th sector on a hard disk like device.

 

Normally the VBR of first volume on any partitioned device is (depending on the disk setup/partitioning tool used and under which OS) is normally at offset 63 sectors (before Vista) and at offset 2048 sectors (Vista and later).

 

Are you sure about this "8th sector"? 

Are you sure you provided the disks in th eright order (or that they were identified properly)?

Do you have now a non striped image?

 

Check the first sector of the image (or first sector of both devices).

It should be normally a MBR (even if GPT, it would have a "protective" MBR entry).

 

You can access the device or image with DMDE, you should have a situation similar to the screenshot attached (IF the MBR data is still valid).

 

jaclaz

 

 

Attached Files



#8
Craigst

Craigst
  • Member
  • 7 posts
  • Joined 27-September 14
  • OS:Windows 8.1 x64
  • Country: Country Flag

1qk17d.jpg

 

this is what i get what can i do from there to ? to get ntfs partition to a disk drive



#9
Craigst

Craigst
  • Member
  • 7 posts
  • Joined 27-September 14
  • OS:Windows 8.1 x64
  • Country: Country Flag

on volume 2 it says i can restore on ntfs ?

 

307vrj7.jpg 



#10
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,463 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Well, then it's OK, it is the RAID sector (the data in the MBR is about CHS 8/0/1 whilst the LBA is 8 sectors), either is a "peculiarity" of the RAID setup or the disk has been partitioned with a third party tool.

However, the "main" volume is the one corresponding to line:

HD Primary(A) NTFS(07) 238Gb EBCF 8 464 842 744

which is also seemingly in "good shape" (at least when it comes to "primary" descriptors) as you have the EBCF in green.

http://dmde.com/manual/partitions.html

 

You should select that line and then click on "Open volume", the other ones are "false positives".

 

jaclaz







Also tagged with one or more of these keywords: raw, data, restore, recover, harddrive, hd

1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users