Recovering Data From Raid Disks

[earguy]

A client has given me a computer to recover pics and the unit was set up as a RAID using 3 disk drives. His son set this up and has since passed away and I have been looking for tutorials on how to recover data using Ubuntu LiveCd. I have version 12.04.

Any ideas on a good tutorial, or even instructions, on how to do this successfully? Otherwise, I will recommend that my client send his disks to a data recovery company, though I hate to miss out on the opportunity to earn money and to learn how to recover data from a RAID set up. I don't know if it is RAID 1E or 5. As this is the son's computer, I am assuming RAID 1E, but again, I am unsure. I can see the disks in Ubuntu, but am trying to mount them and retrieve data, but haven't figured it out as of yet.

The computer is a desktop that the son built himself. I do not know the Windows operating system, or even if it has Windows, as a message to boot from CD comes up when I boot the system.

Any advice would be appreciated.

 

[lcoughey]

I'm not sure that this is the time to be messing around trying to learn. Why do you have to recover from the RAID? Did something happen to the system that makes the data no longer accessible?

The best thing to do is get a full sector-by-sector clone of each drive and work from the copies. This rules out any physical damage to the drive and avoids any damage should you make a mistake during the recovery process.

If you would like me to take a look remotely, I'd be happy to do so.

 

[Markverhyden]

I agree with @lcoughey. If you value the customer and their data you should send this out. Nothing wrong with grabbing images and playing around with this. As far as the RAID type. I've never seen 1E in the real world. If you get the images R-Tools does a great job of recognizing and joining RAID parts.

 

[earguy]

I'm not sure that this is the time to be messing around trying to learn. Why do you have to recover from the RAID? Did something happen to the system that makes the data no longer accessible?

The best thing to do is get a full sector-by-sector clone of each drive and work from the copies. This rules out any physical damage to the drive and avoids any damage should you make a mistake during the recovery process.

If you would like me to take a look remotely, I'd be happy to do so.

The computer isn't booting up and the parents want the photos they are sure are on the drives. I tried removing a single drive and connecting it to my work computer but it seemed to not be working (no spinning heard or felt) and the drive wasn't being recognized. However, the array shows up on the Ubuntu desktop and I am assuming (I know, never assume) that the drive is OK physically. But I agree with you, this is probably not the time to learn.

 

[earguy]

I agree with @lcoughey. If you value the customer and their data you should send this out. Nothing wrong with grabbing images and playing around with this. As far as the RAID type. I've never seen 1E in the real world. If you get the images R-Tools does a great job of recognizing and joining RAID parts.

I assume 1E as RAID 5 doesn't make sense to me as this was not a business computer. At least I don't think it was. Of course, I don't know.

 

[earguy]

I'm not sure that this is the time to be messing around trying to learn. Why do you have to recover from the RAID? Did something happen to the system that makes the data no longer accessible?

The best thing to do is get a full sector-by-sector clone of each drive and work from the copies. This rules out any physical damage to the drive and avoids any damage should you make a mistake during the recovery process.

If you would like me to take a look remotely, I'd be happy to do so.

Thanks for the offer to remotely look at the machine. However, I guess I'm going to refer it out to a data recovery company that was recommended to me by someone on this forum a few days ago. DataRecovery.com

 

[lcoughey]

Thanks for the offer to remotely look at the machine. However, I guess I'm going to refer it out to a data recovery company that was recommended to me by someone on this forum a few days ago. DataRecovery.com

Okay...seems like it should be a relatively easy recovery. You shouldn't be paying much more than $1000 USD for this project unless it requires head changes, which I doubt.

Side note: Why is it that forum members always turn down my offer to assist remotely? It makes me wonder how some members can make a business completely based on remote support and I cannot even give it away.

 

[earguy]

Okay...seems like it should be a relatively easy recovery. You shouldn't be paying much more than $1000 USD for this project unless it requires head changes, which I doubt.

Side note: Why is it that forum members always turn down my offer to assist remotely? It makes me wonder how some members can make a business completely based on remote support and I cannot even give it away.

Nothing personal, I assure you. I may very well ask for your assistance in the near future.

 

[DataMedics]

Luke who you've been talking to is actually quite good among pro data recovery guys, just FYI. That is if you don't mind spending $100 to ship to Canada (somehow I can ship to China for less). Or if you want to stay stateside you might also consider www.datasaversllc.com in Atlanta or even my company (I won't spam the link here, you can google the name or just click my signature)

 

[AliceKlaar]

Lots of really good sensible advice above, but if you understand the risks and still want to try...

*** You do this entirely at your own risk***

Use the dmraid package in Ubuntu , "dmraid -h" for help and "man dmraid" for further info.

Use "dmraid -ay" to activate your ntfs raid 0

If it recognizes your chipset "dmraid -r" should show similar to
/dev/sda: raid_disk_id, stripe, ok, XXX sectors
/dev/sdb: raid_disk_id, stripe, ok, XXX sectors
/dev/sdc: raid_disk_id, stripe, ok, XXX sectors

Show the active device Sets in the array with "dmraid -sa" ,
>>
Active
name : raid_disk_id
size : XXX bytes
stride : 32
type : stripe
status : ok <---- good news !!
subsets: 0
devs : 3
spares : 0

Make a directory for the volume like "mkdir /mnt/myraid0"
then mount as read only
"mount -t ntfs ro /dev/mapper/raid_disk_id /mnt/myraid0"

and I think you can dd from here or just browse for files.

Alternatively windows based R-Tools can manage raids .

 

[Vincent Fang]

hock up all three drives and do a r-studio auto raid detect and rebuild. So long as you are not writing anything to it it'll be fine. 90% of the time is the controller or one of the drive fell out of sync. if the raid controller detects an issue and the RAID automatically degrades from 5. RAID 1 the system should still be up and running and at least you should see it from one of the drive. On a RAID 5 it's still up and running with 2 drives until the 2nd drive started to fail. Then the system goes down with 2 drives. It's unlikely a RAID 1E, stripe and mirror, needs 4 drives. Hey it's a virtual rebuild and it ain't going to hurt anything. If all those failed, you got a problem with one or two of the drive(s) and you should image if you know how to continue the recovery process or ship it out (recommended). So long as you are not trying anything too extreme, you should be fine. If you hear any of the drive making strange noises, it's not in your league since there's no learning curve if the drive is at this stage. If that's the case, send them out to the pros.

 

[lcoughey]

Hey it's a virtual rebuild and it ain't going to hurt anything.

Are you sure about that?

I don't recommend anyone follow Vincent's advice unless you are certain that professional data recovery is out of the question. At the very least, clone all drives first and work from the clones.

 

[AliceKlaar]

In that case my suggestion ^^^ was a totally bad idea too.

 

[lcoughey]

In that case my suggestion ^^^ was a totally bad idea too.

But your advice stresses that there are risks before giving suggestions.

 

[DataMedics]

If you're going to attempt DIY RAID rebuild, then as Luke said you need to clone the drives first and work from the clones. You'd be amazed how often we are told by the customer that the RAID failed because of a bad controller and we discover that one or more of the drives actually is full of bad sectors.

If you can clone all the drives and work from them, then go ahead and try doing it yourself. Or have someone like Luke or myself remote in and rebuild it for you (just be willing to offer a little $$$ to cover our time).

 

[Vincent Fang]

Lol, okay not really trying to declare war or anything. Well, you guys are all right with all the concerns. There is always a risk in any data recovery attempt scenario. Imaging the drive is the proper process after the initial evaluation. My recommendation was for the initial assessment process only, where he gets a better idea of what kind of raid and what kind of damages he is dealing with these drives with a quick virtual rebuild attempt. This should be done under 15 minutes or less without any recovery attempt. If the initial evaluation is not going anywhere, the drives should be send out to the pros. The next phase is the imaging process if the drives are okay. The real issue is that likely he won't have the DeepSpar imagers or the PC3000s or any thing similar to deal with this process; he won't be talking about this if he got them. So imaging the drives may be out of the question if any of the drives have a few bad sectors. That quick 15 minute of evaluation should give some insights to determine whether to ship it out or not. Whether is the controller, or drive(s) with bad sectors, the evaluation will tell the truth after that 15 minutes. 3 drives, it's likely either a RAID 5 on all three drives or an OS drive with a RAID 0/Stripe set on the last two drives; although a RAID 1E is also possible.

Rule #1 follow the 3D process if by all means possible to protect the data that is valuable.
http://www.deepspar.com/3d-data-recovery-overview.html

Also these are very valuable,
http://www.r-tt.com/
http://www.drive-image.com/
http://www.r-studio.com/