Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 1 of 1
  [ 16 posts ] 
  Previous topic | Next topic 
Author Message
einstein9
 Post subject: 2 RAID cases Opinions required..
PostPosted: August 29th, 2019, 7:10 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2798
Location: Kuwait
Dear RAID Experts... (This includes you Vlad. aka: Dr.Kiev if interested)

I have 2 cases & need the expert advice

A-16 drives
B- 8 SAS (looks someone played with it....etc)

If someone is willing to have a look & let me know "if possible" to get the requirements out of both and let me know...

replies in PM Only

Thank you

have a good day

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
Iurii
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 29th, 2019, 9:11 
Offline

Joined: December 10th, 2018, 11:56
Posts: 149
Location: Ukraine
Connect all drives to one computer and check it... RAIDs are simple nowadays... :)
16 drives RAID may takes up to 4 hours.
8 drives RAID less than hour....
Top
 Profile  
 
Amarbir[CDR-Labs]
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 29th, 2019, 10:15 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3471
Location: CDRLabs @ Chandigarh [ India ]
einstein9 wrote:
Dear RAID Experts... (This includes you Vlad. aka: Dr.Kiev if interested)

I have 2 cases & need the expert advice

A-16 drives
B- 8 SAS (looks someone played with it....etc)

If someone is willing to have a look & let me know "if possible" to get the requirements out of both and let me know...

replies in PM Only

Thank you

have a good day


Sir ,
Lurii is one of the developers of UFS Explorer ,His knowledge in RAID is no less then anyone ,You can pm him and he can have a peek .I have taken his support 2 to 3 times for cases ,Great man with good understanding ,Regards

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com
Top
 Profile  
 
khaja_345
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 29th, 2019, 11:44 
Offline

Joined: June 9th, 2014, 4:44
Posts: 24
Location: India
einstein9 wrote:
Dear RAID Experts... (This includes you Vlad. aka: Dr.Kiev if interested)

I have 2 cases & need the expert advice

A-16 drives
B- 8 SAS (looks someone played with it....etc)

If someone is willing to have a look & let me know "if possible" to get the requirements out of both and let me know...

replies in PM Only

Thank you

have a good day



i think he means private massage
Top
 Profile  
 
S.Haran
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 30th, 2019, 16:48 
Offline

Joined: February 16th, 2016, 21:07
Posts: 43
Location: Boston, USA
If the client can provide you with a copy of sample file that is known to exist on the RAID pre-failure then I have an automated reverse engineering technique that attempts to reconstruct the RAID based on the sample file. A good sample file is in a compressed format (.jpg .mp3 etc.) larger than (the max chunk size * number of drives).

I find this especially useful to avoid wasting a lot of time on non-recoverable cases.

_________________
On-Line Data Recovery Consultant. RAID / NAS / Linux Specialist.
Serving clients worldwide since 2011
FreeDataRecovery.us
Top
 Profile  
 
fzabkar
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 30th, 2019, 20:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
AFAIK, the $LogFile metafile in NTFS is usually large (64MB) and contiguous. The file consists of RCRD records, each of which is usually terminated in sequentially numbered words. I recently used two segments of this file to locate the two halves of a spanned volume. It's not an infallible method, but it proved ideal in my case.

_________________
A backup a day keeps DR away.
Top
 Profile  
 
einstein9
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 31st, 2019, 2:35 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2798
Location: Kuwait
S.Haran wrote:
If the client can provide you with a copy of sample file that is known to exist on the RAID pre-failure then I have an automated reverse engineering technique that attempts to reconstruct the RAID based on the sample file. A good sample file is in a compressed format (.jpg .mp3 etc.) larger than (the max chunk size * number of drives).

I find this especially useful to avoid wasting a lot of time on non-recoverable cases.


As i said someone played with it (what they did? not 100% sure yet)

for some reason i disagree with you here about wasting time, I already Did Found few (not needed files) but am looking @the other Arrays
which am sure its there and consists of the requirements.

Its like a Puzzle to refresh your brain and wipe out the dust from it.

fzabkar wrote:
AFAIK, the $LogFile metafile in NTFS is usually large (64MB) and contiguous. The file consists of RCRD records, each of which is usually terminated in sequentially numbered words. I recently used two segments of this file to locate the two halves of a spanned volume. It's not an infallible method, but it proved ideal in my case.


Its really not as easy as it looks..

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
fzabkar
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 31st, 2019, 2:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
einstein9 wrote:
fzabkar wrote:
AFAIK, the $LogFile metafile in NTFS is usually large (64MB) and contiguous. The file consists of RCRD records, each of which is usually terminated in sequentially numbered words. I recently used two segments of this file to locate the two halves of a spanned volume. It's not an infallible method, but it proved ideal in my case.


Its really not as easy as it looks..

It seems a very plausible approach to me, although you would need to be careful.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00004000  52 43 52 44 28 00 09 00 F9 09 80 03 00 00 00 00  RCRD(...ù.€.....
00004010  01 00 00 00 0C 00 01 00 C8 0F 00 00 00 00 00 00
00004020  EA 09 80 03 00 00 00 00 D3 0D 00 00 00 00 00 00
........                          ^^^^^
00004FF0  01 00 00 00 00 00 00 00 1B 00 01 00 28 00 D3 0D                    <-- 0xDD3
                                                    ^^^^^

00005000  52 43 52 44 28 00 09 00 F0 0B 80 03 00 00 00 00  RCRD(...ð.€.....
00005010  01 00 00 00 0C 00 02 00 D8 0F 00 00 00 00 00 00
00005020  F0 0B 80 03 00 00 00 00 D4 0D 00 00 00 00 00 00
........                          ^^^^^
00005FF0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 D4 0D                    <-- 0xDD4
                                                    ^^^^^

00006000  52 43 52 44 28 00 09 00 F6 0D 80 03 00 00 00 00  RCRD(...ö.€.....
00006010  01 00 00 00 0C 00 03 00 B0 0F 00 00 00 00 00 00
00006020  EA 0D 80 03 00 00 00 00 D5 0D 01 00 00 00 00 00
........                          ^^^^^
00006FF0  00 00 00 00 00 00 00 00 26 00 00 00 00 00 D5 0D                    <-- 0xDD5
                                                    ^^^^^

_________________
A backup a day keeps DR away.


Last edited by fzabkar on August 31st, 2019, 2:53, edited 1 time in total.

Top
 Profile  
 
einstein9
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 31st, 2019, 2:53 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2798
Location: Kuwait
@ fzabkar

Would u like to try?

trust me... its not as easy as it looks.

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
fzabkar
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 31st, 2019, 2:59 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
Search for the RCRD records on each drive, collect all the segments, identify the corresponding LBAs, upload the bits and pieces and let us assemble the $LogFile. That's assuming your file system is NTFS.

_________________
A backup a day keeps DR away.
Top
 Profile  
 
Arch Stanton
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 31st, 2019, 9:04 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 913
Location: Nederland
This always strikes me as a very straight forward approach: https://youtu.be/Fw4cdQxIG84

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
fzabkar
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 31st, 2019, 16:14 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
Arch Stanton wrote:
This always strikes me as a very straight forward approach: https://youtu.be/Fw4cdQxIG84

I agree. In fact I was tempted to ask whether ReclaiMe had been tried.

https://www.reclaime.com/library/how-to-recover-raid.aspx

_________________
A backup a day keeps DR away.
Top
 Profile  
 
lcoughey
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: August 31st, 2019, 18:52 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2520
Location: Ontario, Canada
Entropy analysis with reclaime pro is super useful for quickly determining drive order and block size

_________________
Luke
Recovery Force Data Recovery
Top
 Profile  
 
DR-Kiev
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: September 1st, 2019, 2:12 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1080
Location: Angel Data Recovery
Winhex much faster, if you know how. XOR/RS blocks easily recognizable even by eyes, and button F2 is for entropy made, you can check each particular block with that option in case if eyes fail.

_________________
Angel Data Recovery
Top
 Profile  
 
einstein9
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: September 1st, 2019, 3:04 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2798
Location: Kuwait
lcoughey wrote:
Entropy analysis with reclaime pro is super useful for quickly determining drive order and block size


You need to know that really i wasted alot of time with this case and got some results (not the requirements)
but i did my homework very well,,,,

Someone here had a look too, got almost the same results as mine with better results but again case is totally damaged
its good from time to time to get similar cases just to train your brain better to understand what really happened.


@fzabkar , Arch Stanton , again
This someone can tell you how good/bad is my skills now with Raid cases (if he wishes)

Thank you all again for the recommendation & comments...

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
einstein9
 Post subject: Re: 2 RAID cases Opinions required..
PostPosted: September 3rd, 2019, 2:12 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2798
Location: Kuwait
I believe something went missing from here, it doesn`t matter actually but i guess the point is clear now.

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 16 posts ] 

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: Google [Bot] and 171 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group