Accidental Format of RAID-0

[Unknownforce]

So I accidentally did a Windows command prompt "format /fs:FAT32" on my RAID-0 NTFS partition with all my important stuff, and no backup... Long story short, I was in remote desktop, didn't realize which screen I was on and kaboom. I realized it somewhere between 1 and 3 minutes into the format and Ctrl+C cancelled it.

I've ran through MANY utilities... they pretty much keep bringing back the same results, which seem to be only getting like "half" of what I'm expecting. I had about 900GB or so on the drive, and it's getting only about 300GB of info, half of which is fairly garbled...

My question here is this: Would be it beneficial for me to do a QUICK format of NTFS on the raid so that it might better find the results I'm looking for? It just seems like it can't read the raid properly as a whole... it's pulling things from what looks like partitions that were on a single drive before I put the two into a RAID-0...

Any suggestions here would be greatly appreciated.

Thanks!

[jono-ats]

My question here is this: Would be it beneficial for me to do a QUICK format of NTFS on the raid so that it might better find the results I'm looking for?

NO!

Make bit clones of the drives and work with those, if you want to change anything at all. Never work directly with a failed RAID.

[drHDD]

There is good software for your case - RAID Recovery for Windows.

And If you can give access by Teamviewer. I could look your problem.

[data-medics]

My question here is this: Would be it beneficial for me to do a QUICK format of NTFS on the raid so that it might better find the results I'm looking for?

NO!

Make bit clones of the drives and work with those, if you want to change anything at all. Never work directly with a failed RAID.

Agreed, writing any data to the drives is absolutely counter productive. The idea is to preserve as much data as still remains on the set. Any legitimate data recovery software will not need you to format the drives, doing this will only write potentially contradictory information which is likely to further skew things and may well overwrite more data.

Out of curiosity, what software are you using to attempt recovery from the RAID 0? You do realize that the data is striped, right? So you can't just attempt to run any software against one drive at at time, you have to build a virtual array.

[Unknownforce]

I am not running against a single drive. The array itself is intact still, nothing is wrong with the RAID, it reports properly to Windows as 1.82TB (2x1TB drives). I've run through the following:

Z-A Recovery
Active Partition Recovery/File Recovery
TestDisk/PhotoRec
iCare Data Recovery
GetDataBack for NTFS
DiskInternals NTFS

PhotoRec seems to be doing the best here at getting things that others can not. The obvious problem there, is that there are no filenames and no folder structure what-so-ever with PhotoRec. The other thing I've noticed it doing is splitting files incorrectly, mainly text files, which on this drive I had so many "text" files as I had drivers with ini/inf files, old style games with massive amounts of files that were nothing more than simple text files, c/h/cpp files from my programming work. Virtual Disks from VMWare and VirtualBox, ISO files, the list goes on and on.

I'm going to let it finish up, it's been running for the last 2 days basically... it hasn't been 2 days real-time scanning, it's just taken that long so far to get through prompts. It ends up stopping on a few things here and there, which I come back to hours after the prompt shows up to simply press continue or something of that nature.

It's my best hope I think. I will just have to sift through the tens of thousands of garbage text files. My main concern is some of my script files, some programming work, pictures, and PDF files that have my personal information in them.

[day1data]

I would use either reclaimme or r-studio.
Then your probably only chance is a raw recovery (eg. no file structure or file names).

RAID is pretty unforgiving once formatted. You will have to sift through a lot files. Try selective file extension search if you know what your looking for.

[drHDD]

If your raid are still working like before and no one program helped, so there is something else which prevents to get data in useful format. If you have winhex or something like this open raid in it, go to the end of raid and search like in a picture in attach.

Attachments

[Unknownforce]

If your raid are still working like before and no one program helped, so there is something else which prevents to get data in useful format. If you have winhex or something like this open raid in it, go to the end of raid and search like in a picture in attach.

Yes, the RAID is still a RAID. Still reads as 1.82 TB to Windows, WinHex sees it as a RAID, as does most other programs I've worked with thus far. I found that Hex location, sector 3,907,035,135 of 3,907,039,232.

What should I do with that?

[Dmitri]

So I accidentally did ... "format /fs:FAT32" on my RAID-0 NTFS partition ... somewhere between 1 and 3 minutes into the format and Ctrl+C cancelled it.

If the description is correct, then I believe the damage isn't too heavy and didn't reach the MFT. No more than a few GBs of data should be lost.

I've ran through MANY utilities ...

The proper one is
http://www.ufsexplorer.com/download_stdrr.php

Anyway, should you not find the data you're after, I can connect and look into this recovery remotely.

[drHDD]

Yes, the RAID is still a RAID. Still reads as 1.82 TB to Windows, WinHex sees it as a RAID, as does most other programs I've worked with thus far. I found that Hex location, sector 3,907,035,135 of 3,907,039,232.

What should I do with that?

Please give us content of those sectors.

[Unknownforce]

Yes, the RAID is still a RAID. Still reads as 1.82 TB to Windows, WinHex sees it as a RAID, as does most other programs I've worked with thus far. I found that Hex location, sector 3,907,035,135 of 3,907,039,232.

What should I do with that?

Please give us content of those sectors.

Just that single sector? or from 3907035135 till the end?

[drHDD]

Sorry, it was a little bit misunderstanding. Just that single sector. Thanks.

[Unknownforce]

Sorry, it was a little bit misunderstanding. Just that single sector. Thanks.

Code:

EB 52 90 4E 54 46 53 20  20 20 20 00 02 08 00 00
00 00 00 00 00 F8 00 00  3F 00 FF 00 00 08 00 00
00 00 00 00 80 00 80 00  FF 97 E0 E8 00 00 00 00
00 00 0C 00 00 00 00 00  02 00 00 00 00 00 00 00
F6 00 00 00 01 00 00 00  89 27 99 E0 34 99 E0 8A
00 00 00 00 FA 33 C0 8E  D0 BC 00 7C FB 68 C0 07
1F 1E 68 66 00 CB 88 16  0E 00 66 81 3E 03 00 4E
54 46 53 75 15 B4 41 BB  AA 55 CD 13 72 0C 81 FB
55 AA 75 06 F7 C1 01 00  75 03 E9 DD 00 1E 83 EC
18 68 1A 00 B4 48 8A 16  0E 00 8B F4 16 1F CD 13
9F 83 C4 18 9E 58 1F 72  E1 3B 06 0B 00 75 DB A3
0F 00 C1 2E 0F 00 04 1E  5A 33 DB B9 00 20 2B C8
66 FF 06 11 00 03 16 0F  00 8E C2 FF 06 16 00 E8
4B 00 2B C8 77 EF B8 00  BB CD 1A 66 23 C0 75 2D
66 81 FB 54 43 50 41 75  24 81 F9 02 01 72 1E 16
68 07 BB 16 68 52 11 16  68 09 00 66 53 66 53 66
55 16 16 16 68 B8 01 66  61 0E 07 CD 1A 33 C0 BF
0A 13 B9 F6 0C FC F3 AA  E9 FE 01 90 90 66 60 1E
06 66 A1 11 00 66 03 06  1C 00 1E 66 68 00 00 00
00 66 50 06 53 68 01 00  68 10 00 B4 42 8A 16 0E
00 16 1F 8B F4 CD 13 66  59 5B 5A 66 59 66 59 1F
0F 82 16 00 66 FF 06 11  00 03 16 0F 00 8E C2 FF
0E 16 00 75 BC 07 1F 66  61 C3 A1 F6 01 E8 09 00
A1 FA 01 E8 03 00 F4 EB  FD 8B F0 AC 3C 00 74 09
B4 0E BB 07 00 CD 10 EB  F2 C3 0D 0A 41 20 64 69
73 6B 20 72 65 61 64 20  65 72 72 6F 72 20 6F 63
63 75 72 72 65 64 00 0D  0A 42 4F 4F 54 4D 47 52
20 69 73 20 63 6F 6D 70  72 65 73 73 65 64 00 0D
0A 50 72 65 73 73 20 43  74 72 6C 2B 41 6C 74 2B
44 65 6C 20 74 6F 20 72  65 73 74 61 72 74 0D 0A
00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
00 00 00 00 00 00 8A 01  A7 01 BF 01 00 00 55 AA

[Unknownforce]

A side question here... I have a 2 TB drive that I'm doing a bit level clone to. However, there's a (obvious?) problem here. The 2x1TB RAID has 10064 more sectors than the single drive has. So I can't do a full 1:1 clone...

Now, I found a range of 10064 sectors that are 00's before, inside, and after... So, I've copied up to that point, and after that point in sequence to the new drive. I copied sectors 0 through 1406 to the new drive. (1406 is the last sector with any bytes other than 00 in it for quite a ways, much more than 10k sectors...) after that I did another copy and started at the position of the source at 11471 (10064+1407) and the position at the destination at 1407, and I'm running it until it fills the drive up to the last possible sector. That way the sectors at the end of the disk would read correctly if read "backwards" so-to-speak.

Basically I omitted a set of 10064 zero sectors. (assuming my math is all correct and I've properly accounted for the 0 sector)

I am assuming the partition tables will not be correct after this since it will probably reference sectors that don't exist and have a bigger size in the partition table than is possible on that drive...at any rate this will likely not function properly.

Any idea what I would have to "fix" in order for it to read correctly on this single drive with the difference in sectors? Or is there a "better" way to do a proper clone when the destination is "short" in sectors like this?

Also, is this at least a viable "backup" assuming I restore it properly to the RAID, if things go poorly?

Thanks for all your guys' input.

At least I'm learning a lot from this.

[dick]

If you don't have enough storage space on your 2tb drive what you can do is create compressed image files of each raid drive. You can do this in R-studio.
This is not the best option but will probably work. The problem with this method is you will be limited to using R-studio for any potential recovery so it would be better to find more storage space!

[Unknownforce]

It's just 10064 sectors short. I would think that simply omitting the 0's would work. Maybe not to restore directly from what with the partition table differences and whatnot, but say if I fubar the original, I could always simply clone it back from this backup in the same manner and ensure those same 10064 sectors were zero'd out and skipped as they should be and it would be exactly as it used to be... Granted it's not the most speed efficient method, but I think I at least have it entirely backed up in RAW format.

But maybe I'm wrong on that... I'm not sure, which is why I'm here.

[Alt(R-TT)]

If Windows sees the formatted RAID as RAID, and the format took only one-two minutes, there must be a lot of remnants of the formatted file system. I suggest you scan the RAID (the RAID itself, not the disks/virtual RAID created from them) with R-Studio. There must be many things it should find.

[drHDD]

So last ntfs boot sector in right place for your 2tb volume. Now give as content of sector 6293504.
And don't worry about 10064 sector tail. It doesn't affect to anything.

[Unknownforce]

So last ntfs boot sector in right place for your 2tb volume. Now give as content of sector 6293504.
And don't worry about 10064 sector tail. It doesn't affect to anything.

That sector is all 0's

[drHDD]

Could you search for hex pattern 46494C4530 in the begining of sector from that point and up and tell us where you will find it (or may be not)?