Ad
Ad
Ad
Pages: [1]   Bottom of Page
Print
Author Topic: Help! Deleted a folder and files on a NAS/RAID5  (Read 3593 times)
Phil Indeblanc
Sr. Member
****
Offline Offline

Posts: 1104


« on: August 14, 2012, 03:20:20 AM »
ReplyReply

As the title says.... I mistakenly deleted a file from my RAID5 Server .
Much to my surprise, I have been misdirected by a number of Data recovery software developers showing steps using their sw to recover. And after much frustration on the first one I tried, it was taking far too long to scan the drives (4TB, and it was doing 5mb/sec, and sometimes 90mb/sec), and another wasn't able to read the data. Then reading more I learned that on a functioning RAID5 you can use any data recovery software to "undelete" the files. ?

 Any info or clarity of it is pretty much non existent on the web.  I simply need to get the files I deleted.

What do I do?( Crossing my fingers I didn't screw up the RAID by taking them out and connecting them direct to a PC to try the 2 recovery sw I used).


I want to be sure to do the right thing since the longer the server is up running, the more likely it will overwrite the deleted data.
I realized my mistake right away and turned it off.
« Last Edit: August 14, 2012, 03:23:45 AM by Phil Indeblanc » Logged

If you buy a camera, you're a photographer...
tived
Sr. Member
****
Offline Offline

Posts: 691


WWW
« Reply #1 on: August 14, 2012, 05:04:19 AM »
ReplyReply

Hi, very sorry to hear about your misfortune.

I am in a similar boat to yourself, execpt I had a drive fail in a Raid-5, when replaced with a new drive, it failed to rebuild. Now I have 8TB of data that needs recovering

However, i am going to use a service called www.runtime.org they helped me before recovering a RAID-0 that failed  some years ago, and successfully recovered my files.

Yes, they sell their software, but they also do a data recovery, which last time cost me US$300, which wasn't too bad, considering I could have lost a client

I hope you recover - all the best

Henrik
Logged
Phil Indeblanc
Sr. Member
****
Offline Offline

Posts: 1104


« Reply #2 on: August 14, 2012, 09:51:14 AM »
ReplyReply

Hi Henrik,

thanks for replying. I read about their software recovery. They support EXT2. That was the second software I tried and it wasn't able to mount. But it turns out from other reading that I don't need any RAID type recovery if my RAID is issue free. I read that I can use any basic data recovery software. I think this maybe as the formatted file type is NTFS, and since the way the NTFS is striped across the drives and still intact it would be accessible? I'm not sure.

This is something I am unfamiliar with, but kind of makes sense. But at the same time, I am hesitant to boot up my server since I don't want the possible recoverable files to be further overwritten.  

My RAID is in the Ext3 order and RunTime does not support this. however iRecover claims it does. I tried it, and my 1st drive didn't get recognized by Windows OS. this is either how it is, or I have a problem. I checked hardware and wires looked intact. Perhaps one of my SAT connections on the moboard was not configured or ? (as some are for making a sw RAID for windows...I know a bit confusing). But it didn't see the drive. So now I put them all back in the server and about to boot up. At this point I hope I didn't mess up anything further
« Last Edit: August 14, 2012, 10:34:35 AM by Phil Indeblanc » Logged

If you buy a camera, you're a photographer...
Phil Indeblanc
Sr. Member
****
Offline Offline

Posts: 1104


« Reply #3 on: August 14, 2012, 11:04:56 AM »
ReplyReply

A: I use a standard data recovery SW to get the files back after I boot up the server and if the RAID is all intact.
(I need to verify which Data recovery sw works, and how to approach doing it to minimize any further damage of files as I try to recover from the server running). Or some recovery sw will have me take the drives out, and connect to another computer as it accesses the data. Hopefully there is one that doesn't have to scan through 4TB to do it, as this can take days?

B: Rebuild the RAID to recover. Which I think is unnecessary.  This option is a tough one as the speed for recovery is painfully slow with the one I tried supporting Ext3 (iRecover from DIYrecovery)....It was at a rate of 200mbs, then it dropped to 100mbs and then trickled down to about 4.5mbs. I gave it an hour or so, showing 0% progress since I have 4TB to scan. I think it builds some filetable the SW can recognize to recover the files. There are others that claim to be fast and then those that don't support Ext3, and so on.

C:  I ditch the files I deleted and hope the rest is still intact when I run the server.

I have other jobs on the RIAD
Logged

If you buy a camera, you're a photographer...
Justan
Sr. Member
****
Offline Offline

Posts: 1875


WWW
« Reply #4 on: August 14, 2012, 12:26:15 PM »
ReplyReply

My recommendation is to contact the vendor of the RAID controller to seek authoritative advice.

Fwiw, as far as doing file recovery, a RAID partition is often – but not always - hidden from the OS, so file recovery software may be able to work on it without issue. Again it's iffy so check with the manufacturer of the RAID controller.

I don’t know how to advise on data recovery once the array has been broken down.
Logged

tived
Sr. Member
****
Offline Offline

Posts: 691


WWW
« Reply #5 on: August 14, 2012, 06:48:53 PM »
ReplyReply

Hi Phil,

I did take my drives off the controller and placed them into another machine when I did my recovery, I marked the order of the drives. I guess what they do is that they reverse engineer the RAID.

Do contract the manufactor of your controller, it can't hurt, but I doubt it will help.

Windows will not see the RAID in that failed state, which is why you have to use some of those softwares that are available.

I encountered another problem myself - my spare computer where I mounted the failed RAID-5 does not want to start up, its just nothing but fun (-NOT) these days. So frustrating.

I do hope you find a solution, and let us know how it all turns out, what worked and what didn't as it will be really helpful to the rest of us.

All the best

Henrik
Logged
chrismurphy
Jr. Member
**
Offline Offline

Posts: 77


« Reply #6 on: August 15, 2012, 04:55:39 PM »
ReplyReply

I simply need to get the files I deleted.

RAID data recovery is not simple. Ever.

Quote
What do I do?( Crossing my fingers I didn't screw up the RAID by taking them out and connecting them direct to a PC to try the 2 recovery sw I used).

What is this RAID 5 server make and model?

Other than deleting a folder of files, I don't understand exactly what was done next. RAID 5 stripes data across the disks. Each individual disk contains (useless) fragments of files; in fact an individual disk contains fragments of the file system. So there is no possible way a data recovery utility can do anything useful with a single member of an array: unless file sizes are smaller than the RAID stripe size, which is pretty small 32KB to 128KB.

Next, there is no standard way RAID 5 is implemented. Each implementation of RAID 5 (or RAID 6 for that matter) are completely unique to whatever created and manages the RAID. That same implementation is the only way for member disks to be combined into a functioning array. e.g. A RAID 5 array created with an Intel RAID controller card, will not be usable with an HP SmartArray controller card, and neither will be interoperable with linux mdraid (software RAID 0,1,4,5,6,10).

So the disks almost certainly need to be in the server that's implementing the RAID. It is possible to mount the RAID read-only and perform disk recovery operations on it without causing any change to the state of the array.

The situation you are in right now is actually very fragile because you don't know the state of the array. I don't know the state of the array. If you don't have backups and you don't understand the details of how RAID functions internally, you almost certainly need to have data recovery people look at this. It is very easy for RAID 5 arrays to become inconsistent and self-destruct if you don't know exactly what you're doing.

You can be a bit more risk taking if you have backups. If you don't have a backup for RAID 5, well that's just asking for data loss just like it is any other primary storage without a backup. RAID 5 is strictly about data availability it's not in any sense a kind of backup strategy.
Logged
lfeagan
Full Member
***
Offline Offline

Posts: 208



« Reply #7 on: August 15, 2012, 05:22:02 PM »
ReplyReply

1. Stop removing disks from your array, that isn't going to do any good.
2. Mount the partition with your data read-only so there are no writes to it.
3. Use file recovery software appropriate for your filesystem and hope you get what you are looking for. There is usually quite a bit to dig through.

P.S. I certainly hope you didn't put your OS on the same partition as your data.
Logged

Lance

Nikon: D700, D800E, PC-E 24mm f/3.5D ED, PC-E 45mm f/2.8D ED, PC-E 85mm f/2.8D, 50mm f/1.4G, 14-24 f/2.8G ED, 24-70 f/2.8G ED, 70-200 f/2.8G ED VR II, 400mm f/2.8G ED VR
Fuji: X-Pro 1, 14mm f/2.8, 18mm f/2.0, 35mm f/1.4
Phil Indeblanc
Sr. Member
****
Offline Offline

Posts: 1104


« Reply #8 on: August 15, 2012, 07:02:23 PM »
ReplyReply

Well....I really appreciate the feedback, and I boot the server back up with the discs and all is fine.

I didn't realize it could be so complicated to access the data out of a RAID! (RAID 5 in parity)

Chris, the servers I use are Intel SS4200E, and it has its own Linux based OS that is ONLY web folder sharing access. It came with a backup software called Retrospect, which I didn't use as I had intended on having Acronis do backups. Unfortunately, I had yet to do so :-) (I know!)

Anyway, I read that ext3 is only an overlay to the LVM structure. This is a bit Spanish for me (I mostly don't understand it)... I cannot use most or ANY recovery software. specially since this OS server is shared access, I can't do much as to accessing mounted drives. 

If I can't have a way of undeleting that file, I will be dumping everything off the 4TB and then installing WinHomeServer which I have a copy of..(I was considering FreeNAS).
Then move the content all back on.   Just to be clear, the array is perfectly fine. As I said, I simply deleted a file I want to retrieve. Nothing failed, nothing stopped working.

As far as the file goes...I still don't know what to do

I hope some details above can help someone see a option.

thanks
Logged

If you buy a camera, you're a photographer...
chrismurphy
Jr. Member
**
Offline Offline

Posts: 77


« Reply #9 on: August 15, 2012, 08:17:07 PM »
ReplyReply

...it has its own Linux based...
Quote
...Anyway, I read that ext3 is only an overlay to the LVM structure...

LVM is the linux logical volume manager. Physical volumes are added to a volume group, and then logical volumes are created from the volume group. Thus it aggregates multiple physical devices (disks or arrays, or any combination thereof), and allows that space to then be divvied up however you want into logical volumes.  Those logical volumes are "virtual" but they are still treated as block level devices. That is you specify a size for them, and you can format them NTFS, JHFS+ or in this case one of the linux native filesystems, ext3.

Another feature of LVM is the snapshot, which allows you to create another instance of a volume. The original instance can remain mounted read-write, and continue to be used/modified. The 2nd instance, the snapshot, will be frozen in time and will not be modified at all.

So LVM is a volume manager. And Ext3 is the file system, analogous to NTFS or JHFS+. However, Ext3 is not a file system that I'd expect any Windows or Mac OS based file undelete or recovery program to have any idea what to do with. And in fact it's rather tedious and complicated to do file recovery on ext3 even within linux natively.

Quote
specially since this OS server is shared access, I can't do much as to accessing mounted drives.

Well, there are many ways to go about this: telnet or ssh is included on even 1MB firmware for wireless routers I use, so I'd think your RAID box likely has one or both. But getting ext3grep installed is non-trivial, but possible. That's the best bet. It is possible to take the drives out, installed in a PC, boot the PC from a linux Live CD, manually assemble the RAID, and then use the Live CD's package manager to install the latest and greatest ext3grep (even though it is a LiveCD it uses memory as a virtual disk so you can install software packages booted from a LiveCD, they of course vanish upon reboot or shutdown).

Quote
If I can't have a way of undeleting that file, I will be dumping everything off the 4TB and then installing WinHomeServer which I have a copy of..(I was considering FreeNAS).
Then move the content all back on.

I don't understand what this means. Installing these things on what? This Intel box? Do you realize the stock box has 512MB of RAM and no video port? I don't understand what this is about.

Quote
Just to be clear, the array is perfectly fine. As I said, I simply deleted a file I want to retrieve. Nothing failed, nothing stopped working.

Yeah I understand. But you seem to think that deleting a file is a simple event, as is undeleting it. File systems are not at all designed with this in mind. Any possible recovery is purely incidental to what they were designed to do, which is actually to reuse freed up disk sectors relatively quickly. It is much more difficult recovery deleted directories than it is recovering deleted files.

There is one other possibility here, which is maybe the logical volume can be exported read-only via iSCSI. And then with the SmallTree free iSCSI initiator (think it's still free), you can then point a conventional file recovery program to that disk and have it start scanning sector by sector for familiar patterns, i.e. images and documents. It will not understand the file system, but such utilities can frequently find files based on their content's pattern. The caveat is files often aren't in one continuous set of sectors, they can strewn all over the disk (fragmentation), so the files may be useless or difficult to get the various pieces located and then concatenate them together.

Quote
I hope some details above can help someone see a option.

Do a google search for ext3grep and see if this is way outside your realm of interest level. If it is, you will either need professional data recovery service, or abandon this data.
« Last Edit: August 15, 2012, 08:21:03 PM by chrismurphy » Logged
chrismurphy
Jr. Member
**
Offline Offline

Posts: 77


« Reply #10 on: August 15, 2012, 09:03:58 PM »
ReplyReply

Something more likely is a way to get the ext3 volume exported via iSCSI, which this box might be able to do through the web GUI, as many NAS are able to do this. Then use a LiveCD to boot any PC on the network to find that iSCSI volume, since linux distros often come with iscsi initiators. Then install and run ext3grep –dump-name, and ext3grep –restore-file.

This looks easier than the other URL. You have one file to recover, not a whole folder.

Find out if this array/NAS can do iSCSI. How are you connecting to it anyway?
Logged
lfeagan
Full Member
***
Offline Offline

Posts: 208



« Reply #11 on: August 15, 2012, 11:41:07 PM »
ReplyReply

Foremost is a useful tool for recovering a file of a known type. Even with good tools, recovery on ext3 is non-trivial. Photorec is excellent and I highly recommend giving it a try.

If only you had a backup... A good tool for making Time Machine-like backups is rsnapshot, extremely configurable, works against a network of machines, and reasonably space efficient.

A list of tools for ext3 recovery: http://www.linuxquestions.org/questions/linux-software-2/recovering-a-deleted-file-on-ext3-almost-there-441914/#post3546564
« Last Edit: August 15, 2012, 11:46:05 PM by lfeagan » Logged

Lance

Nikon: D700, D800E, PC-E 24mm f/3.5D ED, PC-E 45mm f/2.8D ED, PC-E 85mm f/2.8D, 50mm f/1.4G, 14-24 f/2.8G ED, 24-70 f/2.8G ED, 70-200 f/2.8G ED VR II, 400mm f/2.8G ED VR
Fuji: X-Pro 1, 14mm f/2.8, 18mm f/2.0, 35mm f/1.4
Pages: [1]   Top of Page
Print
Jump to:  

Ad
Ad
Ad