Efficient PhotoRec Operation on RAID 5 Disks

[PBS67]

Hi

I have a QNAP NAS running RAID 5 on 4 x 2TB HDS5C3020ALA632. A file of about 1.2TB was deleted by accident and the file record has been overwritten numerous times but the NAS still operates fine with the remaining files. I presume therefore that the RAID does not require rebuilding. I have been running PhotoRec on the "free" (deleted) sector and it has indeed been retrieving lost photo's and videos which were the vast majority of the deleted files. Unfortunately at the last count PhotoRec was estimating nearly 3 months to completion and this figure was growing.

I would welcome advice on how to accelerate this process. I have been advised to remove the four drives from the NAS, clone them to new drives and mount the clones on a Linux based PC (maybe by booting my WIN 7 PC in Linux with Hiren's Boot CD?) for faster performance. I'm not too sure how to do this so I've reproduced my intended method and hope that some kind person will give me some guidance on what to do or what not to do! I am not an IT professional!

1. Remove drives from NAS.
2. Clone drives to preserve state of original NAS drives. Is it best to clone the drives using something like AOMEI Backer Upper or transfer disk images to the new disks?
3. Mount Drives on higher performance PC. I have bought a 4 port SATA 3 extension card for this. The PC is currently set up with WIN 7. To minimize overall aggravation, should I boot it in Linux with Hiren's Boot CD or what so that it recognizes the Linux MD RAID? Or; can I avoid the whole Linux issue and mount theses drives in WIN 7?
4 Once the drives are mounted, is it a straight forward matter of running PhotoRec on the four drives? Or because they are no longer in the NAS do I have to take extra steps before PhotoRec recognizes that the four drives are part of a RAID 5 Ext 4 setup?
5. Recovery is to be on a 5th mounted Drive.

I'd appreciate some advice on this and also recommendations for alternative approaches if other software/hardware configs may be more appropriate. I cannot afford the circa $2000 USD data recovery costs that I've been quoted.

Cheers,

PBS67

[data-medics]

2. Clone drives to preserve state of original NAS drives. Is it best to clone the drives using something like AOMEI Backer Upper or transfer disk images to the new disks?

Actually, a program like ddrescue is better since it can handle bad sectors should the issue arise. However, if the drives are fully healthy AOMEI should be fine just so long as you get a full sector clone. It really makes no difference whether you use images or physical disks as long as you're getting full clones.

should I boot it in Linux with Hiren's Boot CD or what so that it recognizes the Linux MD RAID? Or; can I avoid the whole Linux issue and mount theses drives in WIN 7?

I wouldn't use Hiren's I'd probably use something more like Knoppix, Debian, Parrot, etc. to boot the computer. You can't mount the RAID in Windows per se, but there are data recovery programs such as Recovery Exporer and R-Studio that can read the Linux RAID metadata and automatically assemble it in the software.

4 Once the drives are mounted, is it a straight forward matter of running PhotoRec on the four drives? Or because they are no longer in the NAS do I have to take extra steps before PhotoRec recognizes that the four drives are part of a RAID 5 Ext 4 setup?

Most likely Linux will automatically assemble the four drives and give you a mounted volume to browse. You won't be scanning the four drives individually you'd be scanning the assembled RAID volume.

I personally wouldn't use photorec at all. There are programs out there for $70-80 that can get you far better results. Since you're not a Linux user, this is probably your best bet since it'd also enable you to do this in Windows which you're familiar with. Give demos of Recovery Explorer and/or R-Studio a try and see if it's worth the purchase.

Just be sure that if you do mount the drives in Windows you don't Initialize or Format the disks. This will seriously complicate recovery for you.

[irepair]

I personally wouldn't use photorec at all. There are programs out there for $70-80 that can get you far better results. Since you're not a Linux user, this is probably your best bet since it'd also enable you to do this in Windows which you're familiar with. Give demos of Recovery Explorer and/or R-Studio a try and see if it's worth the purchase.

Just be sure that if you do mount the drives in Windows you don't Initialize or Format the disks. This will seriously complicate recovery for you.

I would actually avoid mounting the drives in Windows at all by opening >diskpart in cmd.exe and running the following commands before connecting any drives:

Code:

automount disable
automount scrub

(Keep in mind after doing this you will need to use diskpart to manually mount any volume in Windows)


Now run logical data recovery software on the clone, like R-Explorer/R-Studio as suggested by data-medics and see what you find.

[PBS67]

data-medics

Thanks very much for taking the time to give me such a comprehensive reply! I'll look into the software options and let you know how I got on!
Thanks also irepair: I appreciate your advice!

[PBS67]

I'm about to clone each of the 4 HDD's before starting recovery with R-Studio. Just to be clear on the above advice: If I disable automount as advised, does it remain disabled after the PC is shut down (as I need to power down the PC before connecting donor HDD's to SATA connectors).

After the PC is powered up with the donor HDD connected, can I clone using the imaging module in R-Studio or do I have to mount the donor HDD manually (Linux MD RAID 5 Ext 4) before R-Studio cloning can begin? I don't want to be figuring this out and inadvertently damage data!

[PBS67]

Hi Guys

I have removed the four drives from my RAID 5 NAS as described above and commenced imaging on to new drives. Unfortunately (would you believe it) disk 2 is now clicking and cannot be imaged. I have successfully made images of disks 1, 3 and 4.

My question now is: given that the files I was attempting to recover were raw on the deleted "free" area of the NAS, do i need to get disk 2 repaired by a Pro or should the raw files be recoverable using R-Studio and the 3 serviceable drives?

Advice appreciated!

[northwind]

You can recover a RAID5 array with one drive missing. So, ideally you don't need drive 2 to be present.
However, if any of the other drives has problems too, then expect this to fail and/or end up with older data.

[Iurii]

Hi Guys

I have removed the four drives from my RAID 5 NAS as described above and commenced imaging on to new drives. Unfortunately (would you believe it) disk 2 is now clicking and cannot be imaged. I have successfully made images of disks 1, 3 and 4.

My question now is: given that the files I was attempting to recover were raw on the deleted "free" area of the NAS, do i need to get disk 2 repaired by a Pro or should the raw files be recoverable using R-Studio and the 3 serviceable drives?

Advice appreciated!

Please connect 3 drives. Run software and check results. You may share screenshots here for next advises.

[Amarbir[CDR-Labs]]

Hi Guys

I have removed the four drives from my RAID 5 NAS as described above and commenced imaging on to new drives. Unfortunately (would you believe it) disk 2 is now clicking and cannot be imaged. I have successfully made images of disks 1, 3 and 4.

My question now is: given that the files I was attempting to recover were raw on the deleted "free" area of the NAS, do i need to get disk 2 repaired by a Pro or should the raw files be recoverable using R-Studio and the 3 serviceable drives?

Advice appreciated!

Please connect 3 drives. Run software and check results. You may share screenshots here for next advises.

Well,
The Pro Is Here ,Is This You Shula Sir

[Iurii]

Hi Guys

I have removed the four drives from my RAID 5 NAS as described above and commenced imaging on to new drives. Unfortunately (would you believe it) disk 2 is now clicking and cannot be imaged. I have successfully made images of disks 1, 3 and 4.

My question now is: given that the files I was attempting to recover were raw on the deleted "free" area of the NAS, do i need to get disk 2 repaired by a Pro or should the raw files be recoverable using R-Studio and the 3 serviceable drives?

Advice appreciated!

Please connect 3 drives. Run software and check results. You may share screenshots here for next advises.

Well,
The Pro Is Here ,Is This You Shula Sir

Yep, it is me. Known as Iurii Shulha in Facebook and as Yuriy Shulga in Skype and most of E-mails My branch is logical data recovery, including DVR/CCTV. (sorry for such kind of flood)