Hi

I have a Lacie 2Tb external disk (similar to this, but without the eSATA port http://www.lacie.com/download/datasheet ... dra_en.pdf, so I think it's model 301352)

It was originally set to 'Fast' mode, i.e. 2Tb RAID-0 striped over two 1Tb SATA disks.

It was then switched to 'Safe-100' mode (accidentally), i.e. 1Tb RAID-1 mirrored.

It was immeditaely switched back to 'Fast' mode, but it was too late - the damage was done. It's now just seen as a 2Tb unpartitioned volume.

I have forensically imaged each of the two 1Tb disks and am trying to re-assemble the RAID structure using WinHex. I have tried the following stripe sizes in sectors :

32
64
128
256
512

For each stripe size, I swapped the order of the image, i.e. Left disk - Image 1 - Disk1, Right Disk - Image 2 - Disk 2 then visa versa

Unfortunately, though there is clearly data there in raw mode (when 128 stripe size selected), their is no recognised partition, and subsequently no folder structure or file structure.

Firstly, does anyone know for sure what stripe size is used by these disks when set to RAID-0? Also, do they have a header size? If so, do you know what it is in sectors? If I know that, I can at least get off to the right start even if I don't have the Partition system restored yet.

Whilst I realise I can try to carve files out using file header signature analysis, ideally I want the full system back if possible.

The good news is I have an identicall model of the disk, also set as 'Fast' (RAID-0), so if you guys could tell me which parts to copy from the valid disk into my reassembled virtual RAID disk, I might be able to get the full partition structure back?

Any help, warmly recevied. Thanks

Ted

How important is the data on the unit? If it is worth the money, send it to a professional and let them sweat it out.

In the few seconds it was setup as a RAID 1, it had enough time to blow the partition information away and setup as a mirror.

Here is what you need to determine:
- What is the block size?
- What is the drive order?
- What is the file system?

Once you know this, you'll need to virtually reconstruct the stripe and then do a complete scan. You will not be able to use WinHex to put things together and have them pop up right away. You may find that R-Studio may be a better program for this task. Just be prepared to spend an entire day scanning the drive to find out that something is not right and having to start all over again.

Good luck!

_________________
Luke
Recovery Force Data Recovery

I'm not sure how one can "accidentally" switch something that requires a special key to manipulate.



With any luck, only the first bunch of sectors were nuked, so the rest of the data happily lives in the remainder of the disks. Depending on the definition of "immediately", you will have to skip N sectors from the start of the disks (areas mangled by switching).

Kudos on working with copies, have fun for the remainder of the week re-assembling the data. Again, you could get lucky and be done in a day

Thanks guys....

Firslty, using the other identical disk, and taking each of the disks out, connecting them to a write-blocker, and again using WinHex, I was bale to easily recontruct that RAID - the settings were

Stripe size is 128
Header size is 0
Left disk is Disk 1 and the right disk is Disk 2
Block size is 512 bytes
Filesystem is NTFS ver 3.1

So my damaged disk should, in theory, be the same.

So now it comes down to salvaging the partition.

With regards to the 'immediately' - the system was switched, allowed to configure itself, and then identified by Windows as a 'New Device'. It was then powered off and switched back to RAID-0. My point is that no new data was written to it and no re-partitioning by the user was done. Therefore, as you say above, the data should all be in tact - it's just that the partition is messed up. In theory, I should be able to copy the first 63 sectors from the valid disk and write that to WinHex's assembled RAID...I think?

The 'accidentally' refers to the switching of the switch without realising what the switch was for.

Good news...whilst R-Studio was doing it's scan, I downloaded and ran 'Partition Find & Mount, via your homepage (http://hddguru.com/content/en/software/ ... and-Mount/).

That found the partition, mounted it, and I'm currently happily copying out the essential files!! I can't believe it. A simple (and free) little utility like that does what everything else could not. Amazing. I'm so pleased.

When the copy has finished I'm going to try copying the first 63 sectors, plus the following 6 sectors from the backup model (as the hash value of those sectors matches exactly the same sector sequence found 1/3 of the way through my re-assembled imaged RAID, so I could just use that in fact) to Sector 0 - 69 of the damaged RAID to see if that actually does get it up and running as I had hoped.

I'm just so releived that for now I've got my data back!

Thanks for all your help gents

A very 'lesson learned' Ed.

It worked as well!!

I copied sectors 0 - 63, plus the following 6 sectors, plus an additional 5 that appeared to contain something specific to this model of RAID from the working disk using WinHex. I then unplugged the working disk and plugged in the faulty one. I then copied the hex values (by changing WinHex into it's write mode) direct to the disk. Safely powered it off, then back on, and bang - Drive H:\ fully accessible via Windows Explorer.

I'm very proud!! I'd love to know how much that would have cost me if I'd have sent it to a data recovery professional. I admit I was lucky to have a second model of the same disk, but all the same, for someone who doesn't do this day to day, I am quite proud of myself.

Thanks again for your help, and for the forum. I will be sure to save this site for the future.

Ted

Good job. Maybe you will perform regular backups now eh?

Wow! Great job Ed. I figured you would eventually recover the data, but repairing the volume...that is awesome!

_________________
Luke
Recovery Force Data Recovery