Hey all.

Having difficulty on a job that should be fairly straight forwards but coming up empty so far.

RAID 1+0 4 Drives.

Client went into his business and noticed server was off. Rebooted and got disk read error. Swears blind he never rebuilt it because it wouldn’t let him.

From a HP ML150 on board SATA raid.

Drives check out OK individually. We looked at them in WinHex and did a comparison test between all 4 up to 10GB in. The only difference was a small bit at the start of each drive (Which you can see in the pictures). Other than that, everything was identical. We also went to random points at the drive and manually checked for differences but found none. We did this about 10 times.

... unless I’ve missed a detail somewhere...shouldn’t there only be two drives that match each other out of the four?
When tried to reconstruct in various tools we see two partitions, (apparently should be three). Trial and error with various parameters has given us bits and pieces of file trees but the data is all messed up.

I’m thinking that the client has done some fiddling and somehow managed to take out the other half of his RAID

Any help would be appreciated.

Have attached some screen shots in rar.

_________________
DataWreck Data Recovery Services
www.DataWreck.co.uk

Check sector 133114590 on all drives

_________________
You don't have to backup all of your files, just the ones you want to keep.

Yes, if it's RAID 10 there should be two pairs of identical drives.

Seems like another case of clients being "economical with the truth" in the hope that that will make the job easier, cheaper and quicker!

Good luck!

P.S. might be worth asking "dr-kiev" to take a look and confirm

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

seen one of these last week. I think they take out the drives and don't put them back in the correct order, end up with 4 identical drives and no data.

Ouch

_________________
You don't have to backup all of your files, just the ones you want to keep.

contact Dr.kiev here

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Checked sector 133114590. Same on all 4 drives, guessing they should be different.

I'm thinking he's swapped drives 2+3 around and rebuilt. So 1 would write to 3 a copy of 1. and and 2 would write a copy of 2 (which is the same as 1) to drive 4.... so we end up with three copy's of drive 1...

Why do people mess...
Any way thanks for your help guys.

_________________
DataWreck Data Recovery Services
www.DataWreck.co.uk