Hi

I received a WD MyStudio II, that works on RAID 0, I believe.

It has inside two WD5000AAVS and working on a Apple system.

One of the HDD developed bad sectors so the system crashes and can't get the files.

Do you think that only doing an image of both drives to another pair of HDD's will the system work?
Or it's better to create images, create the raid and the data?

The client already bought a new WD Studio 3TB. Will a image of the 500GB HD made to the 1,5TB HD will restore everything?
Thanks

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

Hopefully you can get a good image.

_________________
www.datarecoveryne.com

I would image both drives, set the RAID to my machine and recover the data to that new 3TB drive.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Already doing it.

Thanks

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

Hi again

Something is not going very well.

So I imaged the bad drive (I imaged the bad 500GB to a Samsung 1TB HDD). Now I connected to my PC, start R-Studio and tried to create a virtual RAID with those 2 HDD's. After a Scan of the raid, I got nothing opening.
I must say that the partitions are from a Mac system (HFS+). Can't R-Studio handle it?

Thanks

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

Those drives are encrypted by the SATA to USB / FW800 PCB. You have to connect your drive images to this PCB to un-encrypt the data.

_________________
http://www.datasaversllc.com

But if they were encripted, I shouldn't see anything for instance with Winhex, right??

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

Correct!

_________________
http://www.datasaversllc.com

Hi,

If you make a RAW search, you can check easily if they are encrypted or not.

Hi

After the Scan with R-Studio I got several RAW folders, but almost all the files were corrupted...
The image of the bad drive was 99% sucessfull and the other drive is OK.
Can this be because of the virtual RAID be wrongly made?

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

If you got RAW results, it's not encrypted, as if it was, you wouldn't see any data.
So I think it might be wrong RAID rebuild.

Agree

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

If you cant work it out manually then you could try & see if Reclaime Free RAID Recovery can work out the settings http://www.freeraidrecovery.com/
If so then input those settings in R-Studio.

Loki

Weird. It looks like you set the RAID parameters wrong, and that explains why all your files are corrupted.

But on the other hand, I think Yianni is right, these are encrypted. No?
Look into the enclosure pcb and see what chip it manipulates. Also, when you connect a drive to winhex do you see scrambled data?

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

PM Sent....

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

hi guys. this week im on holidays eheh. so next week ill continue that work.
i had put reclaimfree workink but couldnt complete on time. ill give it a second shot next week.

p.s. message sent from the beach eheheh

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

You will see portion of the readable data thru Winhex in a beginning of the drive and rest of the drive will be scrambled.
Learn how encryption works and you will understand where you've made a mistake.

_________________
www.datarecoveryne.com

Hi Guys

I'm back from my holidays

So, working again on this case.

Here are some images of the drives done with Winehex.

So, if they were encrypted, I couldn't see the sectors data, right?

Thanks

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

Two samples are clearly not encrypted. Other two not sure, if encrypted it would be random characters, can't say without analysing pattern.

The two readable samples are both from Sector 0...

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se