Recover deleted fol...
 
Notifications
Clear all

Recover deleted folders from five 4 TB drives in RAID-5

14 Posts
4 Users
0 Likes
1,698 Views
(@zul22)
Posts: 53
Trusted Member
Topic starter
 

Hi,

I'm planning to recover accidentaly deleted folders from a Synology RAID-5 array with five drives, each 4 TB.

The RAID storage itself is expected working fine, but I'll clone the drives by precaution.

Given the huge size of the drives, as well as the high number of drives, I wonder about the way to manage this avalanche of terrabytes.

I have available a Dell Optiplex 760 currently running Vista 32 bits, but that I could install with a 64-bit version of Windows 7.
It supports up to three drives on SATA, but of course one SATA socket is used by the disk containing the operating sytem. It also does have an eSATA socket, as well as an Ethernet socket. There are 4 available USB sockets, but unfortunately USB 2.0 ; useless to say that I forget them.

The slots for PCIe expansion cards are free, so that I could possibly use an eSATA or USB 3.0 expansion card.

I also will will have soon a Synology RackStation RS212 supporting up to 16 TB (4 x 4 TB).
I'm not sure if it allows accessing drives individually, but it supports JBOD as well as RAID 0/1/5/6/10.

I also will have in hands the RAID storage from which the folders were erased, but I currently ignore its model.

To "merge" the data to some output drive, I can use RAID Reconstructor.

I wonder about the best strategy to allow the recovery from the deleted folders from such a large RAID array, and the possibilities that the RackStation may offer.

Also, are there tools to reassemble RAID-5 to a unique drive without having to connect all the drives simultaneously ?
Typically some tool that would detect the locations of the parity data, clone the drive jumping over them, and then pick the lacking stripes from the other drives without requiring that all drives being simultaneously connected for the analysis and the cloning.
Something more like "Connect disk 1", "Replace disk 1 by disk 2", "Replace disk 2 by disk 3", a.s.o.

Thanks for your suggestions, either hardware or software.

N.B. As hardware, I also have an IBM x3400 M2 server available, with tons of RAM, but which would require installation with some compatible OS (Windows Server or RedHat for instance). It's a monster and its installation appears to me as complicated.

 
Posted : 18/11/2014 2:00 am
(@mscotgrove)
Posts: 938
Prominent Member
 

You have two issues here

1) Reading the RAID, in I presume a forensically secure way
2) Recovering deleted files and folders

Yes, number one as always is to clone/image each physical drive.

You then need to be able to access the RAID as a logical drive, looking like a single 16TB drive. This might be with the RAID, or by creating a 16TB image file. Or you might end up connecting all 5 drives to your PC with software to read them as a RAID

You do not say what the file system used on the RAID is. Was it a locally attached RAID where NTFS or HFS+ is likely, or a NAS where EXT3/4, XFS or other file systems are likely.

Deleted recovery is very different for each file system

 
Posted : 18/11/2014 3:11 pm
(@zul22)
Posts: 53
Trusted Member
Topic starter
 

Thanks for your reply.

I totally agree, first step is to clone each drive.

I unfortunately don't know yet the file system, and even not the model of the Synology storage.
NTFS or HFS+ would be ok. From my experience, on the counterpart ext3 can be very problematic in case of file deletion.

Maybe could I write the 16 TB to my Synology Rackstation RS212 with four 4TB drives in JBOD.
I'm not familiar with JBOD and wonder if it consumes some space on the storage. I believe no, but I'm not totally sure about this.

If the data are in NTFS, I believe the best way would be creating a virtual image.
Raid Reconstructor allows this. The advantage is that it does not require to copy all the data like when you create an image (with a all the issues of a 16 TB file), but just creates a relatively small file of pointers to the miscellaneous disks. The virtual image can then be read with GetDataBack.

The problem here is hardware how to have access to drives simultaneously.
Probably some PCIe expansion card with eSATA or USB 3.0 ports would be the solution.

Concerning other file systems than NTFS, it would be a pleasure to hear which softwares are able to create and analyse virtual images like thoses that RAID Reconstructor can create.

The problem I see if using software to see the drives as RAID is how to interface them with the data recovery softwares without creating a (virtual) image.

Windows Server seem having native RAID-5 capabilities.

Any other recommandation ?

 
Posted : 18/11/2014 5:27 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Any other recommandation ?

A tool that I am particularly fond of, DMDE
http//softdm.com/
has RAID capabilities
http//dmde.com/manual/raids.html
but cannot say if there is any size limit.

jaclaz

 
Posted : 18/11/2014 6:17 pm
(@zul22)
Posts: 53
Trusted Member
Topic starter
 

Thank you jaclaz!
I had completely forgotten DMDE. I watched the help files and yes, looks capable to do virtual images of RAID arrays. Very nice.

I hesitate with the multi-OS bundles, as the software is available for Windows/Linux/DOS.
Is there sometimes any benefit in the DOS version as compared to the Windows/Linux versions?

 
Posted : 18/11/2014 8:42 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I hesitate with the multi-OS bundles, as the software is available for Windows/Linux/DOS.
Is there sometimes any benefit in the DOS version as compared to the Windows/Linux versions?

Well, I don' t think that *any* DOS utility (or even the OS itself) will be able to manage 4 Tb and if the thingy is NTFS or EXT2/3/4 you would also have issues with filesystem drivers (or lack of them), so I would say that choice is restricted to Windows GUI, Windows Command Line and Linux (Command line).

I only have some experience with the GUI Windows version, but given the complexity/number of options of the tool, I doubt that any command line version could be more handy if not for doing (repeating) some "specialized" action through a batch or similar.

jaclaz

 
Posted : 18/11/2014 8:55 pm
(@zul22)
Posts: 53
Trusted Member
Topic starter
 

Thank you for your feeback. This is wise advice. I think the Windows version will suffice me.
I saw in a video DDME for DOS being used for cloning drives.
Maybe you win some time, but I don't think it's worth getting the DOS version just for this.

The recovery will be for a Synolgy DS 1513+.
So, the file system should be ext4.
https://www.synology.com/fr-fr/products/DS1513+#spec

Concerning DMDE, I'm not sure how to chain the "Construct RAID" step with the data recovery step. Is this easy?

I wonder if the best approach would not be to access the RAID-5 as a virtual volume and scan it with tools like extundelete, R-Linux or ReclaiMe.
This seems a priori possible http//forum.synology.com/enu/viewtopic.php?f=7&t=33128

 
Posted : 18/11/2014 10:10 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Concerning DMDE, I'm not sure how to chain the "Construct RAID" step with the data recovery step. Is this easy?

I am not sure to understand the question.

There is a "Raid costructor" that builds the "virtual RAID" from single disks, this is"before" *any* action, i.e. it is the preliminary step that you have to carry in order to have a "source" to be analyzed.

The tricky part is often to determine the parameters and the disk order (this greatly depends also on the documentation available for the "original" hardware), the good thing of such a virtual assembly is that you can make "random" attempts with different parameters/disk order/etc.

jaclaz

 
Posted : 18/11/2014 10:51 pm
(@zul22)
Posts: 53
Trusted Member
Topic starter
 

Thanks. This answers my question. I just wanted to be sure that the reconstructed virtual RAID can then be selected as source. The reason of my question was that sometimes are programs that offer lot of features, but their miscellaneous parts do not communicate ; they are just a patchwork of features.

I'm aware that the detection of the RAID parameters can be tricky.

I assume that the benefit of a virtual assembly is that the "random" may let you quickly see the results, i.e. access the data if the assembly is valid.

Which DMDE, can you directly browse the virtual RAID if the file system is valid or do you have to perform a full data recovery (i.e. full analysis of the virtual RAID) before you can see the folders and files ?

 
Posted : 19/11/2014 4:12 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

I would try the attach the drives reconstruct the logical RAID approach. The easiest way is probably with USB caddies, or an eSATA enclosure that allows access to individual drives.

One important area you will need to investigate is if the RAID is a single partition, or multiple partitions. Almost anything is possible, it might be for compatibility reasons that the RAID is logically 8 2TB partitions

 
Posted : 19/11/2014 4:42 pm
Page 1 / 2
Share: