Replacement HDD in Raid0 override current drive

[stevezau]

Hi All,

I have a Raid 0 setup w/ 2x 1TB drives.. single 1TB NTFS partition. The computer has the Intel ICH0 (or what ever it is) fake raid.. So it's really software.. anyway

I took out one of the 1TB drives as I needed it to move some data around on another pc of mine.. When i was finished i figured i could just plug the hdd back in and raid would just mirror the data back onto the 1TB drive.. Instead the raid0 took the new drive as being the primary or more up-to-date version and started to override the data.. I realised this within a few mins and quickly shutdown.

It's overridden the partition, metadata for NTFS etc.. I'm not really sure what to do from here..

Can anyone recommend some recovery software?? I need to recover all different types of files.. Hoping to keep the filenames..

I've tried a few recovery options but nothing that has given me the filenames..

Thanks !

[lcoughey]

You have certainly created quite a mess for yourself. I'd recommend R-Studio...you can run a full scan of the drive with the demo version and need only register if you like the results. Your mistake has likely killed most of the original MFT and you are likely only going to recover the newer data in a RAW format by file type.

[loki]

Hi All,

I have a Raid 0 setup w/ 2x 1TB drives.. single 1TB NTFS partition. The computer has the Intel ICH0 (or what ever it is) fake raid.. So it's really software.. anyway

I took out one of the 1TB drives as I needed it to move some data around on another pc of mine.. When i was finished i figured i could just plug the hdd back in and raid would just mirror the data back onto the 1TB drive.. Instead the raid0 took the new drive as being the primary or more up-to-date version and started to override the data.. I realised this within a few mins and quickly shutdown.

It's overridden the partition, metadata for NTFS etc.. I'm not really sure what to do from here..

Can anyone recommend some recovery software?? I need to recover all different types of files.. Hoping to keep the filenames..

I've tried a few recovery options but nothing that has given me the filenames..

Thanks !

I think your confusing raid0 & raid1?
You first mention that its raid0 (which is striped ie parts of data is written to both drives) with 2x 1Tb drives as a single 1Tb partition? If its a raid0 ie striped then you should have a 2Tb partition? Are you sure its not a raid1 ie mirrored? http://en.wikipedia.org/wiki/RAID

Firstly you need to clarify if is it raid0 (striped) or raid1 (mirrored)

If raid1 ie mirrored then you should do a sector by sector image of the drive you didnt use to move data arround as the sectors would of been overwritten on that drive. Then try to recover any data off the image you made using software like R-Studio. If the MFT has been overwritten then you will lose the file names & folder structure as this info is stored in the MFT & your only option then is a RAW recovery.

If its raid0 ie striped & considering you overwritten sectors on the other drive then recovery will be very low ie maybe files that are smaller than stripe size?


Loki

Update: I See Luke has also replied while I was typing

[lcoughey]

Nice catch on the RAID 0/1 conflict Loki! I didn't mention it, but I agree that a full sector-by-sector clone should be made sooner than later, just to avoid any further mishaps.

[stevezau]

Sorry.. I meant to say RAID1 not 0!! Mirroring..

For conversation sake lets name the hdds:

-Good drive = the hard drive that was left in the raid..
-Bad drive = the drive that was taking out of the raid to do other functions.. This drive was formatted with a new NTFS and used to backup files off another system.. This drive was then plugged back into the raid where the raid then decided this drive was the newer or more up to date drive and started mirroring to the good drive..

Now good drive has the same NTFS name as the bad drive had (Im guessing this means the MFT was replaced). The good drive also displays some of the files which existed on the bad drive but not all of them as i stopped the mirroring within a couple of minutes.

I've read that there is a backup MFT right?? How does the NTFS decide where to place the backup MFT?? I'm assuming the good drive still has a backup MFT of the file system i want to recover.. I need to figure out how to get this MFT off some how? I'm a bit worried that the good drive now has a master MFT and two backups MFT's depending how far the mirroring got...

I'll take a look at R-Studio..

Thanks for your help so far..

[loki]

Using winhex & the formula: start of MFT x sectors per cluster + sectors before partiton you can work out the sector of the MFT

ie in my case as an example:

$MFT (786432 x 8 + 208845 = 6500301)
$MFTMirr (16 x 8 + 208845 = 208973)

As you can see the $MFTMirr is located before the $MFT so in your case the $MFTMirr has most like already been over written. Also the $MFTMirr is not a complete backup of the $MFT it is only the first 4 records.

As previously mentioned your by Luke & myself you will need to do a RAW recovery but you will lose the file names & folder structure.



Loki