Thecus N3200PRO Deleted Folder

[daRecoM]

Hi all,

Media: Thecus N3200PRO NAS.

My client has accidentally deleted a folder with approx. 10GB of data, according to him it didn't really finished the entire removing process as it had been running extremely slow. The folder went missing after he cancelled the process

I found out that Disk# 1 & Disk# 2 have massive of bad sectors, so I cloned both HDDs to another good HDDs and use it to
rebuild the RAID system in R-Studio. Apparently it doesn't work due to unsupported file system issue (I guess). I have tried UFS explorer too, without avail

I then plug this 3 HDDs back to Thecus box and yes I see all data without problem, but not the one my client had deleted accidentally.

I have seen it somewhere, someone actually said unlike many other file system XFS does not keep any deleted files once removed. Is that true?

This box doesn't support SSH (it was and the file was out there for a short while) so I can't SSH into the box and do the search.

Please advice

Thanks in advance.

[Cleanroom]

UFS Explorer should recognize the file system. Try the soft raid option under raid.

[DR-Kiev]

All Thecus raid's i had saw , was used Ext3 FS.
If it realy XFS, try UFS Explorer Full scan , but firstly you should manage array correctly.
In all Thecus Nas's MAIN FS starts not from the begining (you should find this offset) .
Order parity : Left Synch (standart)

[BadMac]

As Dr-Kiev says. The FS will be Ext2/3, even though the manual says XFS. The deleted data can be recovered by UFS Explorer.

How do I know. I have a 4100 behind me right now which had a directory deleted.
I cloned the 4 disks, destriped using Linux. Scanned with UFS and I can see the deleted stuff, although in this case the drive was used for 2 months after the directory was deleted so there are damaged and missing files (280Gb out of 1Tb used). Deleted files/directories being copied off right now for analysis.

[daRecoM]

Hi DR-Kiev

All Thecus raid's i had saw , was used Ext3 FS.
If it realy XFS, try UFS Explorer Full scan , but firstly you should manage array correctly.
In all Thecus Nas's MAIN FS starts not from the begining (you should find this offset) .
Order parity : Left Synch (standart)

Thanks so much for the information. I have do some screen capture on the system over here, based on the findings and info suggested I think I have set the RAID up correctly. Nevertheless, what I don't quite understand is the statement you have mentioned earlier "In all Thecus Nas's MAIN FS starts not from the begining (you should find this offset)". It would be very much appreciated if you could elaborate it further.

Thanks in advance.

Hi BadMac,

As Dr-Kiev says. The FS will be Ext2/3, even though the manual says XFS. The deleted data can be recovered by UFS Explorer.

How do I know. I have a 4100 behind me right now which had a directory deleted.
I cloned the 4 disks, destriped using Linux. Scanned with UFS and I can see the deleted stuff, although in this case the drive was used for 2 months after the directory was deleted so there are damaged and missing files (280Gb out of 1Tb used). Deleted files/directories being copied off right now for analysis.

I cloned the drives and open them up in UFS explorer. I rebuild the RAID system in UFS explorer and i see 3 "Linux RAID Partition". None of these partitions are accessible, so I'm running a full scan of the data partition now. What I'm worry is that would it gives me the deleted file in raw format? It normally does if the partition couldn't be explore.

Please advice.

Attachments

Thecus.pdf

(108.03 KiB) Downloaded 462 times