Accidental Format of RAID-0

drHDD wrote:Could you search for hex pattern 46494C4530 in the begining of sector from that point and up and tell us where you will find it (or may be not)?

No such pattern going up. Should I search down? Is there a way in WinHex to search for any bytes other than 00? Maybe I can find the first sector that has bytes after the 0's start.

EDIT: Oops spoke too soon, I had it on count occurrences and thought it wasn't finding anything, there were 4 of them, let me find each one.

Sector 341:

Code:: 46 49 4C 45 30 00 03 00 1B 63 00 02 00 00 00 00 03 00 01 00 38 00 01 00 88 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 07 00 00 00 03 00 00 00 02 00 00 00 00 00 00 00 10 00 00 00 60 00 00 00 00 00 18 00 00 00 00 00 48 00 00 00 18 00 00 00 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 68 00 00 00 00 00 18 00 00 00 01 00 50 00 00 00 18 00 01 00 05 00 00 00 00 00 05 00 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 07 03 24 00 56 00 6F 00 6C 00 75 00 6D 00 65 00 40 00 00 00 28 00 00 00 00 00 00 00 00 00 06 00 10 00 00 00 18 00 00 00 9C 02 91 61 D3 FB 6D 4C A9 0A A4 6F CE E2 AB 52 60 00 00 00 18 00 00 00 00 00 18 00 00 00 04 00 00 00 00 00 18 00 00 00 70 00 00 00 28 00 00 00 00 00 18 00 00 00 05 00 0C 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 03 01 80 00 00 00 00 00 80 00 00 00 18 00 00 00 00 00 18 00 00 00 03 00 00 00 00 00 18 00 00 00 FF FF FF FF 00 00 00 00 00 00 18 00 00 00 05 00 0C 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 01 02 84 00 00 00 00 00 80 00 00 00 18 00 00 00 00 00 18 00 00 00 03 00 00 00 00 00 18 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00

Sector 339:

Code:: 46 49 4C 45 30 00 03 00 40 4F 00 02 00 00 00 00 02 00 01 00 38 00 01 00 58 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 04 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 10 00 00 00 60 00 00 00 00 00 18 00 00 00 00 00 48 00 00 00 18 00 00 00 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 70 00 00 00 00 00 18 00 00 00 02 00 52 00 00 00 18 00 01 00 05 00 00 00 00 00 05 00 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 06 00 00 00 00 00 00 00 08 03 24 00 4C 00 6F 00 67 00 46 00 69 00 6C 00 65 00 00 00 00 00 00 00 80 00 00 00 48 00 00 00 01 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 FF 3F 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 32 00 40 E1 62 0B 00 00 FF FF FF FF 00 00 00 00 20 00 00 00 20 02 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 80 00 00 00 48 00 00 00 01 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 FF 3F 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 32 00 40 E1 62 0B 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00

Sector 337:

Code:: 46 49 4C 45 30 00 03 00 FA 4E 00 02 00 00 00 00 01 00 01 00 38 00 01 00 58 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 10 00 00 00 60 00 00 00 00 00 18 00 00 00 00 00 48 00 00 00 18 00 00 00 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 70 00 00 00 00 00 18 00 00 00 02 00 52 00 00 00 18 00 01 00 05 00 00 00 00 00 05 00 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 06 00 00 00 00 00 00 00 08 03 24 00 4D 00 46 00 54 00 4D 00 69 00 72 00 72 00 00 00 00 00 00 00 80 00 00 00 48 00 00 00 01 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 11 01 02 00 00 00 00 00 FF FF FF FF 00 00 00 00 20 00 00 00 20 02 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 80 00 00 00 48 00 00 00 01 00 40 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 11 01 02 00 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00

Sector 335:

Code:: 46 49 4C 45 30 00 03 00 B4 4E 00 02 00 00 00 00 01 00 01 00 38 00 01 00 A0 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 02 00 FF FF 00 00 00 00 10 00 00 00 60 00 00 00 00 00 18 00 00 00 00 00 48 00 00 00 18 00 00 00 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 68 00 00 00 00 00 18 00 00 00 03 00 4A 00 00 00 18 00 01 00 05 00 00 00 00 00 05 00 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 D5 CF E4 68 6D FA CF 01 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 06 00 00 00 00 00 00 00 04 03 24 00 4D 00 46 00 54 00 00 00 00 00 00 00 80 00 00 00 48 00 00 00 01 00 40 00 00 00 06 00 00 00 00 00 00 00 00 00 3F 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 31 40 00 00 0C 00 FF FF B0 00 00 00 50 00 00 00 01 00 40 00 00 00 05 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 08 10 00 00 00 00 00 00 08 10 00 00 00 00 00 00 31 01 FF FF 0B 11 01 FF 00 FB DF 0B 01 E0 FF FF FF FF FF FF 00 00 00 00 00 00 04 00 00 00 00 00 31 40 00 00 0C 00 FF FF B0 00 00 00 50 00 00 00 01 00 40 00 00 00 05 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 08 10 00 00 00 00 00 00 08 10 00 00 00 00 00 00 31 01 FF FF 0B 11 01 FF 00 FB DF 0B 01 E0 02 00

Unknownforce wrote:No such pattern going up. Should I search down? Is there a way in WinHex to search for any bytes other than 00? Maybe I can find the first sector that has bytes after the 0's start.

EDIT: Oops spoke too soon, I had it on count occurrences and thought it wasn't finding anything, there were 4 of them, let me find each one.

Please do same search down. Those sectors, which you are found not useful for us.

drHDD wrote:
Unknownforce wrote:No such pattern going up. Should I search down? Is there a way in WinHex to search for any bytes other than 00? Maybe I can find the first sector that has bytes after the 0's start.

EDIT: Oops spoke too soon, I had it on count occurrences and thought it wasn't finding anything, there were 4 of them, let me find each one.

Please do same search down. Those sectors, which you are found not useful for us.

Sector 224773492:

Code:: 30 32 40 45 52 52 5F 46 49 4C 45 30 11 00 00 A4 09 00 00 09 30 19 B2 45 52 52 5F 57 49 4E 33 32 57 57 57 30 11 00 00 44 14 00 00 07 30 13 EC 45 52 52 5F 43 4F 4D 57 30 11 00 00 10 13 00 00 07 30 02 EA 45 52 52 5F 43 41 42 57 CC 10 00 00 78 17 00 00 09 00 B6 49 46 69 6C 65 47 72 6F 75 70 57 57 57 94 11 00 00 68 10 00 00 13 38 25 7C 49 53 65 74 75 70 46 69 6C 65 45 72 72 6F 72 49 6E 66 6F 57 94 11 00 00 3C 19 00 00 09 00 02 68 4C 61 73 74 45 72 72 6F 72 57 57 57 80 0C 00 00 98 07 00 00 09 00 1E 02 45 72 72 6F 72 49 6E 66 6F 57 57 57 80 0C 00 00 A8 04 00 00 0D 00 7C 2B 49 6E 69 74 69 61 6C 69 7A 65 4C 6F 67 57 57 57 FF FF FF FF 80 07 00 00 04 00 4B B9 70 4C 6F 67 80 0C 00 00 F8 15 00 00 11 00 AE 48 43 72 65 61 74 65 52 65 67 69 73 74 72 79 53 65 74 57 57 57 80 0C 00 00 20 17 00 00 12 00 2C 3D 43 72 65 61 74 65 53 68 65 6C 6C 4F 62 6A 65 63 74 73 57 57 B8 0B 00 00 1C 04 00 00 08 00 42 DF 43 41 42 46 69 6C 65 73 B8 0B 00 00 FF FF FF FF 07 00 52 A1 4F 70 65 6E 43 41 42 57 FF FF FF FF 98 17 00 00 15 00 1C 12 62 73 74 72 53 65 74 75 70 4C 61 75 6E 63 68 65 72 4E 61 6D 65 57 57 57 F8 11 00 00 50 0A 00 00 0C 38 55 65 49 53 65 74 75 70 4D 65 64 69 61 32 F8 11 00 00 80 12 00 00 0F 00 A8 92 49 6E 74 65 72 6E 65 74 4F 70 65 6E 43 41 42 57 FF FF FF FF 88 1A 00 00 04 00 A8 B9 55 73 65 72 FF FF FF FF A4 1A 00 00 09 00 A8 AB 50 72 6F 78 79 55 73 65 72 57 57 57 FF FF FF FF B4 11 00 00 0D 00 FE 9E 50 72 6F 78 79 50 61 73 73 77 6F 72 64 57 57 57 5C 12 00 00 3C 11 00 00 0C 38 56 65 49 53 65 74 75 70 4D 65 64 69 61 33 5C 12 00 00 FF

I'm going to guess that this isn't what we need either, looks like it's part of a compressed file or something else, maybe a disk image.

So it's look like format kills file records and there is no way to get files in useful format back. Information about names, sizes, file fragmentation and etc are gone. And that is why no one utility helped. I am sorry.

drHDD wrote:So it's look like format kills file records and there is no way to get files in useful format back. Information about names, sizes, file fragmentation and etc are gone. And that is why no one utility helped. I am sorry.

Well, I appreciate your time. And everyone's responses. I will just use Active Partition Recovery to do a low level file recovery, at least I'll have most of the content, just no structure. Will take me some time to sift through 200k pictures and 500k text files, but I dug my own grave. Time to invest in some automatic backup.

Thanks all.

Unknownforce wrote:I will just use Active Partition Recovery to do a low level file recovery, at least I'll have most of the content, just no structure. .

If you use Active@ File Recovery Pro, it will put the recovered files into folders named according to the meta data of the recovered files. Should take less time.

Hi!

Sorry to come so late in the discussion.

So I accidentally did a Windows command prompt "format /fs:FAT32" on my RAID-0 NTFS partition (...)

The FORMAT command was used without the /q (Quick format) option.
Hence, data were truely erased (overwritten) during a few minutes.

I realized it somewhere between 1 and 3 minutes into the format and Ctrl+C cancelled it.

If the write speed was around 100MB/s, which is a realistic approximation for classical drives, you should have lost about the first 12 Gigas in 2 minutes.

I've ran through MANY utilities... they pretty much keep bringing back the same results, which seem to be only getting like "half" of what I'm expecting. I had about 900GB or so on the drive, and it's getting only about 300GB of info, half of which is fairly garbled...

Instead of blindly running many utilities --which make things even worse if you installed them on the target RAID system-- you must understand that RAID 0 splits the data flows in two parts, which are then written to the drives. Before performing a data recovery, you must put together (aka reassemble) the stripes coming from both drives.
Some tools like Raid Reconstructor from Runtime allow you to create a virtual image. You can then run the recovery over the virtual image with GetDataBack.
The hardest part (especially if you're doing it for the first time) is to guess the size of the stripes, as well as order settings (disk order, offset, ...). This can be quite time consuming.
In no case should the RAID reconstuction attempts be done on the original drives.
You should clone them first for two reasons:
- reducing risks of additional errors
- reducing the risk due to mechanical fatigue, as several attempts of RAID-0 reconstruction can be intensive for the disks

I assume that your garbled content could come from the fact that your recovery sofwares are not reassembling the stripes or at least not correctly. Possibly are the stripes large enough so that you can read small files that are fully contained into a single stripe (on one disk) and this would explain why you get about 300 GB of data out of 900.

My question here is this: Would be it beneficial for me to do a QUICK format of NTFS on the raid

NO!
I agree with what other users told above. For successful data recovery, you must clone your drives and in no case write any byte of data on them.
As you seem being novice in the field of data recovery, there is a risk of you mixing the input and output disks during the cloning, especially if your input and output drive have the same capacity. Furthermore, for the cloning, you need a software that doesn't fail on defective sectors.

I would suggest that you ask a data recovery professional which already has performed RAID-0 recoveries.

SOSdonnees wrote:Hi!
I assume that your garbled content could come from the fact that your recovery sofwares are not reassembling the stripes or at least not correctly. Possibly are the stripes large enough so that you can read small files that are fully contained into a single stripe (on one disk) and this would explain why you get about 300 GB of data out of 900.

It's look like you didn't read topic. Author have raid untouched and fully working and he searched for ntfs records and didn't find them, so there is nothing to do for pro.

LarrySabo wrote:
Unknownforce wrote:I will just use Active Partition Recovery to do a low level file recovery, at least I'll have most of the content, just no structure. .
If you use Active@ File Recovery Pro, it will put the recovered files into folders named according to the meta data of the recovered files. Should take less time.

Yeah, Active Partition Recovery is doing this. Photos/Images, Videos, Adobe files, etc. Each has it's own folder split by the file type and extension.

Thanks!

SOSdonnees wrote:Hi!

Sorry to come so late in the discussion.
So I accidentally did a Windows command prompt "format /fs:FAT32" on my RAID-0 NTFS partition (...)

The FORMAT command was used without the /q (Quick format) option.
Hence, data were truely erased (overwritten) during a few minutes.

I realized it somewhere between 1 and 3 minutes into the format and Ctrl+C cancelled it.

If the write speed was around 100MB/s, which is a realistic approximation for classical drives, you should have lost about the first 12 Gigas in 2 minutes.

Correct, I fully realize what had happened, and know that I lost quite a bit, and in reality, it was more like 150-190MB/s

SOSdonnees wrote:
I've ran through MANY utilities... they pretty much keep bringing back the same results, which seem to be only getting like "half" of what I'm expecting. I had about 900GB or so on the drive, and it's getting only about 300GB of info, half of which is fairly garbled...

Instead of blindly running many utilities --which make things even worse if you installed them on the target RAID system-- you must understand that RAID 0 splits the data flows in two parts, which are then written to the drives. Before performing a data recovery, you must put together (aka reassemble) the stripes coming from both drives.
Some tools like Raid Reconstructor from Runtime allow you to create a virtual image. You can then run the recovery over the virtual image with GetDataBack.
The hardest part (especially if you're doing it for the first time) is to guess the size of the stripes, as well as order settings (disk order, offset, ...). This can be quite time consuming.
In no case should the RAID reconstuction attempts be done on the original drives.
You should clone them first for two reasons:
- reducing risks of additional errors
- reducing the risk due to mechanical fatigue, as several attempts of RAID-0 reconstruction can be intensive for the disks

I assume that your garbled content could come from the fact that your recovery sofwares are not reassembling the stripes or at least not correctly. Possibly are the stripes large enough so that you can read small files that are fully contained into a single stripe (on one disk) and this would explain why you get about 300 GB of data out of 900.

I don't think I need to reconstruct the RAID, because the RAID is still intact. I didn't split the drives and THEN format, I ran the format against the volume that was composed of the RAID. So the RAID itself was never altered.

I also wasn't actually doing any WRITE commands with ANY of the utilities I tried at that point. I only ran utilities to see what results I could get from each one. I knew better than to write anything as the entire drive was considered RAW anyway. I do have a backup clone of the RAID. (2 of them actually)

SOSdonnees wrote:
My question here is this: Would be it beneficial for me to do a QUICK format of NTFS on the raid

NO!
I agree with what other users told above. For successful data recovery, you must clone your drives and in no case write any byte of data on them.
As you seem being novice in the field of data recovery, there is a risk of you mixing the input and output disks during the cloning, especially if your input and output drive have the same capacity. Furthermore, for the cloning, you need a software that doesn't fail on defective sectors.

I would suggest that you ask a data recovery professional which already has performed RAID-0 recoveries.

Yes, I am a novice to data recovery, but I also understand some low level programming and how data is stored in many devices. I actually used to be a developer for the android phone scene, both software and hardware wise. So I'm not a complete noob here, lol. My drives also do not have any defective sectors.

I only asked that about the format because I thought that it might help push the tools into reading the file structure properly as it was. But in reality, it already was reading them correctly, I had made the assumption that it was reading the drive separately, that's obviously not correct. The RAID is still considered a single drive. I was also not using many of the tools as they should be used in this case, like against the device rather than the broken partition.

I made my normal amount of mistakes going through each tool, again, never writing anything. But now I have learned a little more about how NTFS actually functions and stores data, and drHDD is correct that the $MFT is gone, by a long shot. The format 00'd everything out for quite a ways, far past the $MFT. I won't be able to directly recover the filename/folder structure, but I can at least recover the data, as the format didn't get very far, Maybe 10-30GB.

The broken files were just coming from PhotoRec, which I don't really trust anyway. I'm going to use Active Recovery, as it's getting far better results anyway. There's also several hundred thousand "text" files that were originally stored on this drive. (they didn't have the extension .txt but they were still just plain text files, macros, scripts, batch files, etc.)

I'm content with sifting through them. I know which ones are most important to me, and I know what the content is in them, so it will be fairly easy to recover what I'm looking for. The majority of the content was stuff that I can find online, so I'm not worried about it. And it's recovering my important PDF's.

So I've learned plenty from this experience. First and foremost, keep a backup of my important stuff, and secondly, be a little more cautious with format command when using my remote desktops.

I don't think I need to reconstruct the RAID, because the RAID is still intact. I didn't split the drives and THEN format, I ran the format against the volume that was composed of the RAID. So the RAID itself was never altered.

Thanks for the details.

I had read that the RAID was still working but wondered why the recovered contents were garbled.

As quite a lot was destroyed, I would suggest you using GetDataBack, as it will allow you to retrieve lost files (when the $MFT was partially destroyed) as well as duplicates. Hence, you could possibly recover older versions of a file if it was lost.
You can also avoid recoverying useless files like .exe, .dll, .inf, .sys, a.s.o. by exluding some file extensions.

I assume that you installed the utilities on another partition than the RAID one.

Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0

Re: Accidental Format of RAID-0