Hi. I am new to this board and have been reading for hours before registering and more hours after registering trying to find some answers and help. I have 2 640 GB WD Caviar Black drives that were in a RAID0 array with 2 partitions. 1 986ish GB part and 1 205ish GB part. 205 Part had windows 7 on it, the rest was just storage. On a 3rd hard drive not part of the array I was running Windows XP Pro.

I was using BCEdit for multibooting, took the winxp out of the menu, rebooted and all was good, no menu, just booted into Win7 fine. I figured I was safe to format the 3rd IDE drive with xp on it. Boy was I wrong. NTLDR missing problems and the like endured. In my bios i deleted mbr on array and deleted array. Put Win7 on IDE drive and re did array in bios, used Hiren's Boot CD in windows and used DiskGenius to recover the partitions I had in the array, I have the 986GB partition back, but none of the files work and the 205 gig part would just show up as unallocated, so I formatted the unallocated back to NTFS just to get a drive letter to try and do some recovery with. I have been using R-studio to try and recover the data. out of the 7-800 gigs of data I can live without there is about 7 gigs of photos of my son from when he was born and when my wife was pregnant. I have attatched 2 files of what I am getting back as photo data.

I have some understanding of why the picture is the way it is, but I do not completely understand what to do with R-Studio to get it to recover the files correctly, what I am really looking for in the hex info and such. Please help me guys, I see Dr. Kiev is a RAID genius and recovery expert, any and all insight will be so helpful. Oh, also after I recovered the 986 gb part, chkdsk ran for AWHILE and did some MFT security id replacing and some other stuff. Am I just totally f**ked?

I don't have time for a long reply. As you might have guessed by now, you've made some mistakes in your steps so far, compared to those appropriate for data recovery - specifically reformatting and running chkdsk. This may exceed the complexity which can sensibly be assisted via a web forum, so you need to consider the risks of doing any more DIY recovery attempts yourself (i.e. you could make things even worse).

I have 3 questions, based on a quick review of your story so far - of course other readers may have more or different questions / suggestions:

a) Did you reconstruct the RAID 0 volume identically to how it was before? If so, and given that some image data still exists (so the disks were not zerofilled during the volume (re-)creation), then I don't see RAID as being part of your problem.

b) You seem to say that you re-formatted the 205GB partition. You don't mention re-formatting the 986GB partition. Is that correct? I'm not sure we have all the steps listed, that you performed...

c) Where are the photos that you want to recover - on the 986GB partition or the 205GB partition, or both?

a) afaik it is reconstructed identically.

b) DiskGenius was able to recover the partition of the 986gb partition so it was not formatted.

c) the 205GB partition was showing up as unallocated space in DiskGenius and other programs, the partition just could not be recovered. The pictures were on the 986 partition. Both the partitions were in the array between the 2 640GB drives. At the time 986GB was drive E: and 205GB was C:

Thanks for the update.

You didn't need to re-format the 205GB partition to perform recovery when using appropriate tools, but as I understand you, that's now irrelevant since you don't need to recover anything from that partition.

Somehow in the steps you have done, you seem to have damaged the filesystems in both partitions, but specifically we're interested in the photos in the 986GB partition. The corrupted ("jumbled") large image in your first post is typical of large files which were fragmented in the filesystem, and which are being recovered using a raw recovery (i.e. without using the original (correct) filesystem information). The thumbnails are much smaller and are typically contained within just one cluster or two clusters, so they are often not corrupted, as you can see.

Without knowing exactly what DiskGenius did, I can't be sure of the exact step where filesystem damage occurred - if I had to guess, it might be the chkdsk step, but it could be something that DiskGenius did. However, this situation is now beyond what I would try to assist with remotely via a web forum.

If you decide to do any more DIY recovery attempts, then as a minimum (and even this has risks for the inexperienced or the unlucky), I would clone the whole of that raw RAID volume onto a 1.5TB (or larger) disk in which you have confidence (i.e. well-tested and checked). Then you can perform further DIY recovery attempts from that clone, without changing the original disks (any more than they already have been).

I would probably also make clones of the individual disks themselves (in a different, non-RAID equipped system), just in case there was a difference (compared to the original) in how you re-created the RAID volume which might be able to be reversed, although based on what you've said, this is unlikely.

IMHO a suitably experienced engineer who has the disk in front of him, has a greater chance of success.

Perhaps other readers will have more time to spend attempting a remote recovery. Good luck!

P.S. Looking at the R-Studio screenshot, I'm surprised about the device you seem to have chosen for it to work on. Isn't the 986GB "drive F:" the appropriate drive letter to choose?

what you see is the scan information done on the NVIDIASTRIPE 1.16TB. F and G are the drive letters now of what used to be F: = E: G: = C:

when i set up my raid it asks what size to use, 32k, 64k, etc up to 512k or there is the Optimal option, which i think i used when i originally set up the array, so thats what i went with to reconstruct it. would it hurt to delete the array and set it up again with different cluster size and maybe the data wont be jumbled? Would this create more problems? This is the first raid setup i have ever had, its been setup for a year or 2 so its hard to remember the exact settings i used. If I can recover these photos they will be put on flash drives and optical disks and another hard drive non-raid.

I figured the picture is jumbled because the data was spread across the 2 drives in the array, you say a damaged filesystem. CHKDSK deleting indexes and security id's and such for awhile probably didn't help. So a partition on a array works as it would on a non RAID setup? That doesn't make a whole lot of sense to me, especially since the partition is 986GB between 2 640GB drives.

If you are now less certain that you chose the same RAID setup, and if you accept the risks of DIY, then as I said before, I would clone the individual disks now (using a non-RAID controller) before doing anything else. That way, you have a chance to get back to the current situation, if you do make things worse.


I don't understand you. If it helps: After you have created a RAID volume (i.e. something that appears to the OS as a block device, like any other disk), then you can (and in your case, you did) partition the total space (in your case 1.16TB) in the same way as you can partition any other block device / disk. If that doesn't answer your underlying question, please explain the question again, preferably in a different way, and perhaps I (or someone else) will understand what question you're asking.

Well i'll just keep these drives the way they are for now. I'll have to pick up a 2TB drive when I have the extra cash. I tried imaging the array with R-Studio with max compression onto a 1TB drive I have laying around. Didn't work obviously. I really have no option but DIY, there is no way I could afford a professional.

RAID is not assembled correctly. Absolutely image both disks and work with images through R-Studio or whatever

Yes, this is also bad, but obviously at least some parts of your pictures still exist.

_________________
You don't have to backup all of your files, just the ones you want to keep.

Looking carefully to the both pictures you gave, it easy to understand your mistakes :

You mixed drives order , second drive should be first , and other way around.
Block size = 64kb =128 sectors , this setting is correct.
Thats why r-studio found Boot sector (your green Recognized4) offseted (128sectors+63sectors).
And thats why on the big photo, top part of woman's head goes after middle part.

About thumbnails pictures, Vulcan is right.

_________________
Angel Data Recovery

so, if I swap the disks order it will be fixed?

@DR-Kiev,

Thanks very much for the input. As you explained, I should not have believed that the RAID volume had been rebuilt using identical parameters.

@thederk,

Of course I'm not speaking for DR-Kiev but I'll give my opinion to your question of "so, if I swap the disks order it will be fixed?". My answer would be: Perhaps, depending on what filesystem damage has been caused by you running chkdsk on a filesystem which was (at that time) corrupted by the incorrect RAID volume reconstruction.

As mentioned earlier, to try to minimise the risks of making the situation worse by further recovery attempts, I would clone the underlying disks first (in a non-RAID system), so that hopefully you can get back to this point, if needed. Of course it's up to you what risk mitigation steps you want to take - your data; your risk; your choice.

ok. Thanks for your input guys. I will hold off until I get a 2TB drive to hold the images before trying anything else. I will try swapping the order in the array at that point after both drives are fully imaged.