RAID 0 , data recovery - ADVANCED TOPIC ! (Asus P4C800E-D)
The story:
I had a RAID 0 array on my Asus P4C800 mb.
2 Seagate SATA drives, each one of 120 GB's.
Then the motherboard died (no bios post codes, no video). I RMA-ed the mb.
In the meantime,while i was waiting for my RMA to come back, i wanted to access the data on my SATA Raid 0 array. I got another Asus mb from someone i knew. I dont remember the model, i think It was a P4P800.
I hooked up my RAID 0 array (that i made on my P4C800) to the P4P800, and it DID NOT recognize it.
Being a newbie to RAID 0:
In desperation, i created a new array using my 2 HDs, on the P4P800 mb. I did not initialize the array. But im SURE i used a different stripe size and different drive order than my original array was, because i DO NOT KNOW the drive order and stripe size i originally used. .... Of course It didnt work - the os did not boot....
Now ... i got my P4C800 mb RMA back from Asus.
I hooked up my SATA drives to the RAID, and it recognized an array, however.. its the array i made on the P4P800 mb, and im sure it has a different Stripe Size, and possibly different Drive order.
Not a newbie anymore:
I spent about 40 hours on research before i even started the recovery process now. I know about MBR, NTFS partition, 55 AA, MFT, clusters etc...
NOW:
Of course I want to recover my data. I can **SEE** the data IS still there on the RAID.
I can see it, and even got some text documents back, by searching with a disk editor, for text, finding the clusters, saving them and putting them toghether.. particularly development code file.. my one yr worth of work. This was a painfull process and took me around 20 hours..Searching for 6 bytes within 240GB, takes about 20-30 min, even on this fast pc...
The process i used to recover that was this:
-Install winxp to different drive and boot from there
-Hook my raid array to the raid controller
-Use a disk aditor, with WRITE DISABLED, on the RAID 0 device.
-seach for "ascii words" within the whole 240 gb raid drive.
-It finds clusters
-I decide if its part of the file, save it, put the file back toghether
-Of course i have to know what to search for, and what the original looked like...
Now since i'm positive my data is still all there, and since there were no write operations to the disk (except whatever the RAID controller writes when creating/deleting arrays - which should be minimal) i should be able to recover all my data.
The key question:
Is it possible to determine what my original drive arrangement was, and what the original stripe size was?
Once i figure that out, i can probably use any of these programs to rebuilt the NTFS partion and the MBR.
Using programs like R-Studio or Virtual Lab (and the rest), right now that wont work. Even though they find the NTFS partition table, and the MFT, the clusters the MFT point to, will of course be out of alignment, because the controller is reading off stripes of a different size than the original, and possible the wrong drive order.
How do i find the drive order and stripe size? Again, i can see the data is all there, but since the array now has a different stripe size, and drive order, the clusters referenced in the MFT (ntfs master file table) are of course pointing to the wrong data.
The array originally, was partition on a single partition, (the entire drive), by the Windows XP Pro setup. (NTFS partition), default cluster size.
Figureing out the original DRIVE ORDER:
in my current drive order, and using a 32k (or larger) stripe size, and searching for "NTFS" or "missing", (see refence at www.ntfs.com) I can find the FIRST NTFS boot sector at offset (hex) 7E00 (after 31.5KB) from the beginning of the disk.
Can someone out there that had his RAID partitioned by windows xp setup confirm this is indeed where the first NTFS boot record is.
If the NTFS boot sector should indeed be at offset 7E00, then it means i have the correct drive order...
Figuring out original stripe size:
This, of course, is the real pain...Any ideas?
Is my drive order assumption correct?
Now how do i figure out the stripe size?
Any more ideas/ things to try?
I had a RAID 0 array on my Asus P4C800 mb.
2 Seagate SATA drives, each one of 120 GB's.
Then the motherboard died (no bios post codes, no video). I RMA-ed the mb.
In the meantime,while i was waiting for my RMA to come back, i wanted to access the data on my SATA Raid 0 array. I got another Asus mb from someone i knew. I dont remember the model, i think It was a P4P800.
I hooked up my RAID 0 array (that i made on my P4C800) to the P4P800, and it DID NOT recognize it.
Being a newbie to RAID 0:
In desperation, i created a new array using my 2 HDs, on the P4P800 mb. I did not initialize the array. But im SURE i used a different stripe size and different drive order than my original array was, because i DO NOT KNOW the drive order and stripe size i originally used. .... Of course It didnt work - the os did not boot....
Now ... i got my P4C800 mb RMA back from Asus.
I hooked up my SATA drives to the RAID, and it recognized an array, however.. its the array i made on the P4P800 mb, and im sure it has a different Stripe Size, and possibly different Drive order.
Not a newbie anymore:
I spent about 40 hours on research before i even started the recovery process now. I know about MBR, NTFS partition, 55 AA, MFT, clusters etc...
NOW:
Of course I want to recover my data. I can **SEE** the data IS still there on the RAID.
I can see it, and even got some text documents back, by searching with a disk editor, for text, finding the clusters, saving them and putting them toghether.. particularly development code file.. my one yr worth of work. This was a painfull process and took me around 20 hours..Searching for 6 bytes within 240GB, takes about 20-30 min, even on this fast pc...
The process i used to recover that was this:
-Install winxp to different drive and boot from there
-Hook my raid array to the raid controller
-Use a disk aditor, with WRITE DISABLED, on the RAID 0 device.
-seach for "ascii words" within the whole 240 gb raid drive.
-It finds clusters
-I decide if its part of the file, save it, put the file back toghether
-Of course i have to know what to search for, and what the original looked like...
Now since i'm positive my data is still all there, and since there were no write operations to the disk (except whatever the RAID controller writes when creating/deleting arrays - which should be minimal) i should be able to recover all my data.
The key question:
Is it possible to determine what my original drive arrangement was, and what the original stripe size was?
Once i figure that out, i can probably use any of these programs to rebuilt the NTFS partion and the MBR.
Using programs like R-Studio or Virtual Lab (and the rest), right now that wont work. Even though they find the NTFS partition table, and the MFT, the clusters the MFT point to, will of course be out of alignment, because the controller is reading off stripes of a different size than the original, and possible the wrong drive order.
How do i find the drive order and stripe size? Again, i can see the data is all there, but since the array now has a different stripe size, and drive order, the clusters referenced in the MFT (ntfs master file table) are of course pointing to the wrong data.
The array originally, was partition on a single partition, (the entire drive), by the Windows XP Pro setup. (NTFS partition), default cluster size.
Figureing out the original DRIVE ORDER:
in my current drive order, and using a 32k (or larger) stripe size, and searching for "NTFS" or "missing", (see refence at www.ntfs.com) I can find the FIRST NTFS boot sector at offset (hex) 7E00 (after 31.5KB) from the beginning of the disk.
Can someone out there that had his RAID partitioned by windows xp setup confirm this is indeed where the first NTFS boot record is.
If the NTFS boot sector should indeed be at offset 7E00, then it means i have the correct drive order...
Figuring out original stripe size:
This, of course, is the real pain...Any ideas?
Is my drive order assumption correct?
Now how do i figure out the stripe size?
Any more ideas/ things to try?
0
Comments
( i'm really not being sarcastic, good luck!
this software works. very well. not cheap tho. 30 day trial is nice