MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 5 posts ] 
Author Message
 Post subject: Thecus N3200PRO Deleted Folder
PostPosted: February 10th, 2011, 0:33 
Offline

Joined: January 2nd, 2009, 4:18
Posts: 74
Hi all,

Media: Thecus N3200PRO NAS.

My client has accidentally deleted a folder with approx. 10GB of data, according to him it didn't really finished the entire removing process as it had been running extremely slow. The folder went missing after he cancelled the process

I found out that Disk# 1 & Disk# 2 have massive of bad sectors, so I cloned both HDDs to another good HDDs and use it to
rebuild the RAID system in R-Studio. Apparently it doesn't work due to unsupported file system issue (I guess). I have tried UFS explorer too, without avail

I then plug this 3 HDDs back to Thecus box and yes I see all data without problem, but not the one my client had deleted accidentally.

I have seen it somewhere, someone actually said unlike many other file system XFS does not keep any deleted files once removed. Is that true?

This box doesn't support SSH (it was and the file was out there for a short while) so I can't SSH into the box and do the search.

Please advice

Thanks in advance.


Top
 Profile  
 
 Post subject: Re: Thecus N3200PRO Deleted Folder
PostPosted: February 10th, 2011, 13:20 
Offline
User avatar

Joined: June 23rd, 2008, 11:26
Posts: 511
Location: Austin, TX
UFS Explorer should recognize the file system. Try the soft raid option under raid.


Top
 Profile  
 
 Post subject: Re: Thecus N3200PRO Deleted Folder
PostPosted: February 11th, 2011, 4:59 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1091
Location: Angel Data Recovery
All Thecus raid's i had saw , was used Ext3 FS.
If it realy XFS, try UFS Explorer Full scan , but firstly you should manage array correctly.
In all Thecus Nas's MAIN FS starts not from the begining (you should find this offset) .
Order parity : Left Synch (standart)

_________________
Angel Data Recovery


Top
 Profile  
 
 Post subject: Re: Thecus N3200PRO Deleted Folder
PostPosted: February 11th, 2011, 7:31 
Offline

Joined: April 1st, 2009, 19:46
Posts: 34
Location: South Pacific
As Dr-Kiev says. The FS will be Ext2/3, even though the manual says XFS. The deleted data can be recovered by UFS Explorer.

How do I know. I have a 4100 behind me right now which had a directory deleted.
I cloned the 4 disks, destriped using Linux. Scanned with UFS and I can see the deleted stuff, although in this case the drive was used for 2 months after the directory was deleted so there are damaged and missing files (280Gb out of 1Tb used). Deleted files/directories being copied off right now for analysis.


Top
 Profile  
 
 Post subject: Re: Thecus N3200PRO Deleted Folder
PostPosted: February 15th, 2011, 22:04 
Offline

Joined: January 2nd, 2009, 4:18
Posts: 74
Hi DR-Kiev

DR-Kiev wrote:
All Thecus raid's i had saw , was used Ext3 FS.
If it realy XFS, try UFS Explorer Full scan , but firstly you should manage array correctly.
In all Thecus Nas's MAIN FS starts not from the begining (you should find this offset) .
Order parity : Left Synch (standart)



Thanks so much for the information. I have do some screen capture on the system over here, based on the findings and info suggested I think I have set the RAID up correctly. Nevertheless, what I don't quite understand is the statement you have mentioned earlier "In all Thecus Nas's MAIN FS starts not from the begining (you should find this offset)". It would be very much appreciated if you could elaborate it further.

Thanks in advance.

Hi BadMac,

BadMac wrote:
As Dr-Kiev says. The FS will be Ext2/3, even though the manual says XFS. The deleted data can be recovered by UFS Explorer.

How do I know. I have a 4100 behind me right now which had a directory deleted.
I cloned the 4 disks, destriped using Linux. Scanned with UFS and I can see the deleted stuff, although in this case the drive was used for 2 months after the directory was deleted so there are damaged and missing files (280Gb out of 1Tb used). Deleted files/directories being copied off right now for analysis.


I cloned the drives and open them up in UFS explorer. I rebuild the RAID system in UFS explorer and i see 3 "Linux RAID Partition". None of these partitions are accessible, so I'm running a full scan of the data partition now. What I'm worry is that would it gives me the deleted file in raw format? It normally does if the partition couldn't be explore.

Please advice.


Attachments:
Thecus.pdf [108.03 KiB]
Downloaded 461 times
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 5 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 59 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group