Buffalo NAS Data Recovery

[whoathere]

Hi all, total newb here.

I'm having some issues that are really starting to bug me. A few months ago, I was transferring some photos from our iMac to our Buffalo NAS. Halfway through the transfer (only about 1GB of data) the process stopped, and I began getting an error on the NAS.

The NAS is a 2TB (2x1TB) configured in RAID 1. The error had me thinking a firmware issue, so I began investigating that, but I had a heck of a time getting Mac OS to mount the NAS. Only when plugged directly into the computer can I get any access to the firmware, but it would only last a second before the NAS would default back into "limp" mode, or whatever you want to call it. This made me think I had an issue with the drives. So, I removed one of the drives, same issue, then swapped drives, same issue. Next, I took the drives to a friend who is a hobbyist when it comes to data recovery. He was able to tell that it was mostly photos, which it is. He was able to see .jpeg, but not the .nef (Nikon raw format). His recovery work showed almost 900GB of data, which is impossible, and the majority of the recovery was not usable anyway(see attachment). He did find that the drives passed physical diagnostics. He ran the drives through another program later and found 120gb of data, much more in line with what I would expect.

So, I have a few questions. 1) What could have happened to have both of these drives freak out? 2) is there anything that I can do to try my own recovery? (trial software that I've downloaded do recognize the drive, even though OS X gives an error) 3) I only have macs, which I'm guessing limits my options. Is a PC something that would essentially be required for this task?

It seems as though the data should be able to be recovered to a degree. He said he found a few bad sectors on the drives, but nothing catastrophic. I just want to recover the data, don't necessarily need it right now, and then I'd like to get the NAS up and running again.

Any thoughts?

Attachments

[DR-Kiev]

It was Raid0 not raid1

The NAS is a 2TB (2x1TB) configured in RAID 1.

Pictures which you showed to us, were recovered from one drive in raw mode, of course they should be corrupted in this case.
Need to recreate array as raid0 with proper stripe size and correct order, using proper software.

[whoathere]

It was RAID 1. As I said the Linkstation is the 2x1TB configuration which when mounted in Mac OS would only show 1TB available.

My thought is that the first drive faulted somehow and then it seemlessly transitioned to the 2nd drive without any notification to me. Then when the 2nd drive went, it no longer worked.

[fzabkar]

Take each of your recovered photo files and compare the size of each file against the number of stripes in the image. This will tell you the stripe size.

[whoathere]

So you think there's no way this was RAID1?

Would it make sense that some photos were recovered perfectly fine then? Maybe 5% of the total recovered completely normal.

[labtech]

Would it make sense that some photos were recovered perfectly fine then? Maybe 5% of the total recovered completely normal.

It is possible - it depends on the stripe size

[whoathere]

OK. I'm at the office now, I will look into this more when I get home.

I only have one SATA->USB so I might not be able to do much for a few days if I need to rebuild the array simultaneously

[whoathere]

Theoretically, if have recovered the data from both of these drives separately, would the stripes from Image 001 on Disk 1 be the same as the stripes on Image 001 on Disk 2?

Reason I ask is because my friend who took a shot at recovering the data hosted all of the data online and the data from Disk 1 is the exact same as Disk 2. All of the striped photos look the same.

[labtech]

Then it sounds like it really is a RAID 1 config. Seems like somehow the data from one drive synced to the other, rendering both with corrupt copies.

The only way to make good sense of set up and further investigation is to work with healthy images. So, best course of action is to image those drive to a healthy medium and ideally with advanced imaging equipment.

Your friend should have advised of this. Working directly on the drive with scans and such is not a good idea.

[lcoughey]

It is probably because he didn't know how to deal with XFS, which I assume is the file system. After getting clones of the drives, look at the clone with UFSExplorer

[DR-Kiev]

Theoretically, if have recovered the data from both of these drives separately, would the stripes from Image 001 on Disk 1 be the same as the stripes on Image 001 on Disk 2?

Reason I ask is because my friend who took a shot at recovering the data hosted all of the data online and the data from Disk 1 is the exact same as Disk 2. All of the striped photos look the same.

May be it was converted from raid0 to raid1 and data from one drive was mirrored to another.

[Dmitri]

May be it was converted from raid0 to raid1 and data from one drive was mirrored to another.

That's a feasible explanation, btw. We've seen such issue with a Buffalo NAS.

[whoathere]

I shouldn't have said the data is the exact same, the photos I was comparing are the same. He has the data he pulled in 2 places, one for each drive. There are 32xx items (photos and documents) recovered from drive 1 and there are 35xx recovered from drive 2. Now I'm not saying that this means they aren't the same because he could have used two separate methods and one method pulled slightly more data. I'm not sure.

I configured as a RAID 1 when I originally set everything up. I suppose it might be possible that during the freak out while the disks were still in the buffalo, it wrote files from disk 1 to disk 2.

I can't imagine he mirrored from disk 1 to 2. the fact that you say you've seen this before from buffalo NAS kinda pisses me off, but life goes on.

One thing I did notice is that the images that look to be striped are all .nef (Nikon raw format) and the ones that recovered fine are all JPEG. However, not all jpegs recovered.

I'm going to clone them both tonight and work with UFSExplorer.

[whoathere]

Another thing I've failed to mention is that I'm just looking at what he hosted, which could have accidentally been data from the same disk. So I really need to get these clones

[data-medics]

Take each of your recovered photo files and compare the size of each file against the number of stripes in the image. This will tell you the stripe size.

You're giving away my secret to RAID recovery here! I've been doing that for a long time.

[fzabkar]

Take each of your recovered photo files and compare the size of each file against the number of stripes in the image. This will tell you the stripe size.

You're giving away my secret to RAID recovery here! I've been doing that for a long time.

It seems obvious to me. Hardly a trade secret.

[whoathere]

I have both images now cloned to new drives. Will take a look this weekend to see if they are indeed mirrors, or if they are different. The first drive recovered 132gb containing 14,598 files. Which seems about right (random files on there though should have been a few mb of documents and the rest photos, but it had all sorts of stuff). Drive 2 wasn't quite finished when I left this morning.

Copied using UFS explorer.

[michael chiklis]

data-medics this is not a secret
https://www.youtube.com/watch?v=hnyjzwRA1ww
https://www.youtube.com/watch?v=Mu1s5DSzvEU

[whoathere]

Figured I would come back and post what happened. Ended up dumping both .img files into UFS Explorer. It built the raid and I was able to recover the data. I'm not sure if anything was lost, but more than 95% of the data was recovered. It was about 250gb of data in total that recovered.

Thanks for everyones help!

[lcoughey]

Great news! I think your friend should take up a new hobby and you can take up data recovery as your hobby.