HDD GURU FORUMS

Hi

Received here a NAS controller with 4 disk each 500GB, three partiton each configured in Linux. Total 1.5TB of data on storage media. Client said that one disk heated up inside the controller and he was not able to access this and gave an error. He called his service company who shut down the controller and took it to their office.

LOL - the service company then proceeded to take all 4 disk out of the controller and put them all in a freezer for 3 days. They then reinstalled the disk back to the controller and tried to turn it on with same error on the controller. According to the repair company they did not try to rebuild or do anything else with this controller and returned it to the client.

I was able to clone all four disk and got a good clone on each one of them. I tried to determine the order of these disks but now they are out of order.

In doing search on some of the different possible configurations on the disk order I have found that I can see some of the photos on the disk. But here is problem. There are photos on the disk that have three separate parts to them. It is one photos on the top, second or middle is another, and last section is another. Or I have photos that can see half the photo and the second half the photo is only grey. Know it is disk order problem on this one .

The repair company said that they just replaced the original disks back to the NAS and tried to start it. They claim they put them back in same order they took them out. They did not mark the disk in anyway to know if the order they replaced them inside the NAS was correct or not. They also claim they did not try to reconstruct this RAID with another disk so they say that all disk returned to client in the NAS are original disk and they did not do anything on this one.

Any suggestions as to how without going through 64 possible combinations of this to find what might possible be the disk order on these disk. I have verified the clones of all disk against winhex and have gotten all disks cloned. Any ideas or suggestions on this one.

I think i can help you, but i need to run.
Please stay in MSN today.

Janos

Update:

Controller is a Thecus N4100 which is a standard setup using Admin Web GUI interface. It is a RAID 5 they have configured this one with and used a 64K strip size. It is done in the menu of this controller and interface. I have spoken with the company who sold this box to the client and they said that the configuration inside is standard according to the software. All they had to do was choose the disk, choose RAID type, left strip size as default of 64K then configure. After configuration they set up files and folders and the rest inside of here.

This is a Linux based NAS using three partition inside the HDD with XFS.

I am using USF Explore it can support this system and configuration. But due to the fact that the disk were removed I believe they were not put back in order. I also believe that the repair company that did this is not saying all that they did with this controller.

Finding on this one:

I have run through the 64 possible configurations on this. Results and findings are all the same. I can find documents all non accessable. I can find photos but strange thing is they are all the same no mater what configuration I have used. There are a few photos that have the starting of one photo at the top, then after is another photos starting right after this and the end is all grey. All other photos found are all the same and same photos in each configuration. They are the starting of the photo about half the photo and the end of the photo is all grey.

Has anyone ever recovered data from one of these NAS servers before and can give me some idea as to where to look and what to use to figure this one out. It almost looks like the repair company tried to do a rebuild of this system and considering one disk was bad inside the other three disk tried to rebuild on this and now I am only finding the data on the disk they did not try to play around with. Is this one possible becasue on 64 combinations there should of been other findings than the same results on all the 64 combinations on this one.

Any ideas please. Thanks

Based on your story, i think this case is 100% recoverable.
But not easy.
I am sure, i can help, but it would be great to have in my lab.
With remotely this is hard.

Janos

It is not possible to send this off the island it belongs to a Government agency and they refuse to send it off these islands. So if this is the case will continue to look for solution to this problem to recovrer it here.

With only 3 drives, you can just try all combinations, but with 4 drive, there are 4!/0! possible arrangements. You can quickly reduce this to only 4 by finding MBR in hex, thus telling you 1st drive and other will have 1st parity. then you only need to play with other two drives' order.

pcrecovery wrote:With only 3 drives, you can just try all combinations, but with 4 drive, there are 4!/0! possible arrangements. You can quickly reduce this to only 4 by finding MBR in hex, thus telling you 1st drive and other will have 1st parity. then you only need to play with other two drives' order.

This arrray, have 1 MBR / drive (all 4 MBR) and XFS.

Janos

Discovered the problem of the RAID. The repair company removed all 4 disk. Now disk 0 super block is errased and no longer exists on this. It almost looks like they tried to format this disk. Disk 1 the super block is changed completely and does not match disk 2 and 3. It appears the only two disk that belong this is raid now are disk 2 and 3. The repair company from what it looks like seems they have taken disk 0 and 1 out of this controller and either tried with another raid system to fix these drives, tried to copy a sections from another disk on top of the original data or tried with another NAS to rebuild using these two disk only.

Is it still possible or highly unlikely that any data can be found on the remaining two disk of this raid array. I am only able to find bits and pieces of this data and not sure if it will even be possible to find any good information from these disk now. Has anyone ever had this problem before and been able to use only two disk inside a raid to find any data off of them at all.

Thanks for any ideas or suggestions on this one.