Data Recovery Possi...
 
Notifications
Clear all

Data Recovery Possibilities

14 Posts
7 Users
0 Reactions
1,383 Views
(@hank69er)
New Member
Joined: 19 years ago
Posts: 1
Topic starter  

I have a few hypothetical questions to pose to you.

1) If I have 5 unknown disks, what is the likelihood I could recover data from them? The disks were hardware RAID5 but I don't know that. I also don't know what order they were in or what controller version was writing to them. If I were an expert, what tools would I use to discover the above answers and then recover all the data? Could I cause any damage to the data in trying to figure these questions out?

2) Same question, different spin. I know the disks were RAID5 and I know the order but I don't have a similar server or controller to read that data. Could I corrupt data by mounting to a different server and controller?

Thanks in advance. Doing some Risk Management stuff for school.


   
Quote
(@xx0033)
Trusted Member
Joined: 20 years ago
Posts: 93
 

I would be shocked if it was not possible to retrieve the data from that RAID configuration.

Your assumption that is RAID 5 is probably correct however, an expert would let you know within minutes of looking at the disks.

Regards,

Simon

www.disklabs.com


   
ReplyQuote
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
 

You have 5 disks? That might not be RAID 5…

A RAID 5 uses three disks
DRIVE 1__________DRIVE 2__________DRIVE 3
Parity A__________Data A__________Data A
Data B__________Parity B__________Data B
Data C__________Data C__________Parity C

You will need, as you are aware, at least two of the three drives.

Usually, RAID controllers will write their BIOS details on the first drive.


   
ReplyQuote
(@xx0033)
Trusted Member
Joined: 20 years ago
Posts: 93
 

RAID 5 can use pretty much any amount of hard drives, but the minimum is 3.

Take a look at www.raids.co.uk, there is a reasonable tutorial on RAIDs there.

Simon


   
ReplyQuote
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
 

If you are looking for a data recovery tool for RAID recovery, would you expect a data recovery company to tell you their secrets?


   
ReplyQuote
(@xx0033)
Trusted Member
Joined: 20 years ago
Posts: 93
 

Depending on the quality of the data recovery company, will depend on the quality of their results.

We (Disklabs), recently got give 15 fire damaged, fire brigade damaged, and impact damaged hard drives in a box and were asked to 'get the data off that lot'. 7 days later, the data was all recovered from 3 different RAID 5 configurations. 100% recovery.

For those interested, it was covered on the BBC, and the video is currently available on YouTube, Disklabs RAID data recovery from a fire on the BBC video.

The idea is to get a copy of all the original disks, then to build a virtual RAID. Experience will tell the Technician what configuration, stripes etc have been used to set the RAID up, otherwise its a lot of timely trial and error.

I hope that helps?

Simon


   
ReplyQuote
(@jtsmith)
New Member
Joined: 18 years ago
Posts: 1
 

5 unknown disks. Well any smart data recovery company would mirror the drives first then work from the mirrors. It would apparent if the drives were set up as a RAID or if they were separate drives. Without knowing the order it's a situation of trial and error. Obviously the more drive the more time consuming. My company had a situation where we had a 10 drive RAID 5. Somehow between us and shipping to the data recovery company (CBL) the order got mixed up or removed from the drive caddies (which were labelled) It took a couple of weeks but CBL data recovery was able to recover all of our data. If you ever need data recovery I highly recommend them
http//www.cbltech.com


   
ReplyQuote
(@xx0033)
Trusted Member
Joined: 20 years ago
Posts: 93
 

5 unknown disks. Well any smart data recovery company would mirror the drives first then work from the mirrors. It would apparent if the drives were set up as a RAID or if they were separate drives. Without knowing the order it's a situation of trial and error. Obviously the more drive the more time consuming. My company had a situation where we had a 10 drive RAID 5. Somehow between us and shipping to the data recovery company (CBL) the order got mixed up or removed from the drive caddies (which were labelled) It took a couple of weeks but CBL data recovery was able to recover all of our data. If you ever need data recovery I highly recommend them
http//www.cbltech.com

If however, the data recovery company were REALLY good [Removed by moderator - advertising] then they would be able to use the mirror disks, (quite correct), and read the headers and system areas of the hard drive to work out how the RAID was configured and in which order the disks should go in, so that they dont have to go down the 'trial and error' route.

)


   
ReplyQuote
NeGrusti
(@negrusti)
Active Member
Joined: 19 years ago
Posts: 18
 

For those interested, it was covered on the BBC, and the video is currently available on YouTube,

On your video the labels on the drives are not even the slightest brown color… What temperature we are talking about? Let's say what temperature of the hdd casings? Were the MOLEX connectors melted?


   
ReplyQuote
azrael
(@azrael)
Honorable Member
Joined: 19 years ago
Posts: 656
 

Same question, different spin. I know the disks were RAID5 and I know the order but I don't have a similar server or controller to read that data. Could I corrupt data by mounting to a different server and controller?

Personal experience, many moons ago, in a non-forensic role - allows me to tell you that if you plug them in in the wrong order to the _same_ server and controller, that you can pretty much kiss your data goodbye, and spend your weekend tape shuffling to restore from backup … 😯

It may be that things have improved since then, but I'd suggest experimentation first to be sure ! wink


   
ReplyQuote
Page 1 / 2
Share: