Seagate Ironwolf Pro Win Span 4 Drives 1 Missing

[SilverSurferNHS]

Hello,
I am aware of the stupidity of going with a simple windows span for 4 gigantic disks and have rectified that for all future storage use by making a dedicated failure tolerant and fully backed up NAS.
That being said, i feel that i am quite close to recovering what remains of the 4 disk span (1 drive failed). This was a Windows GPT Dynamic Span Volume across 4 disks on Seagate (broke my rule of never using seagate due to a really bad failure rate history) Ironwolf Pros. They're probably fine in a failure tolerant environment, but this idiot was thinking cheap at the time.

Using DMDE I see the following:

I do not know which order these go in, however i do know that Disk 1, which i have placed first, lets me see file directories of that first drive.
I also know that 1 drive is missing, so the order of the two in the middle or maybe end, i need help figuring out, or some help in general about how to recover what i can from this. I might have to use the null disk?

This is what i see when i click OK with that drive order.

I don't think it sees the rest of the files outside of the directories from that first drive. Is that a drive order issue? Do i need to do a full scan? The bad drive was sent off to get "recovered" via warranty and i think i'm just going to get flat "recovered" files back with no names or directories, but i'd like to recover most of what i can from this array.

I would be grateful for any advice or help that can be gleamed from what i've given so far. I would even paypal compensation if that is acceptable to do here in exchange for helping me figure this out further. I'm technical, but in sysadmin and application support, not directly in data recovery outside of using recuvva to get stuff off flash media back in the day.
I have GetData Back, DMDE Pro and Minitool Partition Wizard Pro with Recovery at my disposal so far. If someone recommends a tool that gets us closer, i'll buy it.

Much appreciation in advance.

[fzabkar]

AIUI, the $MFT is on the first drive. Therefore, if DMDE has correctly stitched together the members of the spanned volume, you should be able to recover all those files that exist on the first 3 drives. The only problem would be if the MFT is fragmented, and if one of these fragments exists on your missing drive.

As you say, the files on the last drive will probably be subject to a raw recovery. It would have been better if you had been able to stipulate that the drive be cloned.

[Arch Stanton]

I remember doing this, as experiment, too long ago to remember exactly. I used null disk to make up for missing member which is required if missing disk is not last member.

1st 'member' contains MFT. If MFT is fragmented you should be able to work out if next fragment is on same physical drive or a next as MFT is self refencing. So decode runs for $MFT itself (DMDE does this for you, you do need to convert offset + (cluster * sect/clus) to LBA but ballpark figures are good enough to determine what drive fragment will be on). If fragment is on some next drive, you can also pinpoint that drive (use special sector search tool for example).

1st member contains NTFS boot record towards start of the drive.

4th member contains NTFS (backup) boot records towards end of drive. If you find no drive contains BBS, your 4th disk is missing.

So, if lost member is known, it should be possible to work out disk order since you have 1st, last and missing disk already.

Code:

1. NTFS BS -- MFT -----------------------------
2. Missing? NULL ------------------------------
3 ---------------------------------------------
4 -------------------------------------NTFS BBS

These are quick first thoughts. I may be missing something (obvious)

[Lardman]

As per the reddit thread on this - the easiest way I've found to do this is with r-studio.

It will give you the drive span IDs and make a pretty good job of auto arranging the virtual volume up to the missing member. Beyond that you can manually assign position. There's no point in making life difficult with DMDE just because it's cheaper.

I'm still testing different methods of failure.

[Arch Stanton]

As per the reddit thread on this - the easiest way I've found to do this is with r-studio.

It will give you the drive span IDs and make a pretty good job of auto arranging the virtual volume up to the missing member. Beyond that you can manually assign position. There's no point in making life difficult with DMDE just because it's cheaper.

I'm still testing different methods of failure.

Ah! Already thought, "that's odd, another one of those?!" ...

[fzabkar]

Does the LDM Metadata partition (34 - 2081) contain all the information required to assemble the span? If so, then examining it with a hex editor would allow you to manually identify the order, wouldn't it?

[Arch Stanton]

Does the LDM Metadata partition (34 - 2081) contain all the information required to assemble the span? If so, then examining it with a hex editor would allow you to manually identify the order, wouldn't it?

I don't know yet. I started reading here, https://flatcap.github.io/linux-ntfs/ldm/index.html, but too tired now. Tools like Klennet Recovery can work with the database, so I assume, yes.

[SilverSurferNHS]

Thank you for your insights. Yes, that was me. I just got news that the recovery failed on the bad drive. As dim-whited as it was to have a 4 drive span with no failure tolerance, i at least had the foresight to use Backblaze and i was relatively current with that backup. I can get about 70 percent back that way, and combine that with what i can get out of these remaining drives. I'll use automation tools to fill in what i can't get back and focus my time on finding things automation can't get for me.

I'll try to restore these this week with DMDE.