Recover Data from Mirrored Drive

[mwfischer82]

Hello,

I am looking for a way to recover data from a mirrored RAID 1 drive
that was removed from a Dell Server. Windows will not recognize it,
nor will any utilities that I use in my day to day.

The net is overflowing with tools that "claim" to be able to read the
data, but I really don't know where to start.

Again, I don't want to rebuild the Array, or make it boot, I just want
to try to recover some data from it. I am in desperate need of some
users' folders.

If it is better to just send to data recovery, let me know.

Thanks,
Mike

 

[John McGaw]

Hello,

I am looking for a way to recover data from a mirrored RAID 1 drive
that was removed from a Dell Server. Windows will not recognize it,
nor will any utilities that I use in my day to day.

The net is overflowing with tools that "claim" to be able to read the
data, but I really don't know where to start.

Again, I don't want to rebuild the Array, or make it boot, I just want
to try to recover some data from it. I am in desperate need of some
users' folders.

If it is better to just send to data recovery, let me know.

Thanks,
Mike

If the drive was mirrored, not striped, and is actually not damaged it
is difficult to imagine why it would not be readable. When you say that
Windows does not recognize it, what are the symptoms? Is it recognized
in any way by the computer's BIOS? You don't say what sort of drive it
is, but if it is an IDE, is the jumpering set properly for the computer
you are connecting it to? I know all of this might seem basic but they
are questions worth asking, just in case.

 

[kony]

Hello,

I am looking for a way to recover data from a mirrored RAID 1 drive
that was removed from a Dell Server.

Put the drive back in the same system. Something is wrong
if it is not *more* than just a RAID1 drive as RAID1 by
itself doesn't require anything in particular, each member
of a RAID1 is readable in any other system that would be
compatible with the drive (if it had not been RAIDed at
all).

Windows will not recognize it,
nor will any utilities that I use in my day to day.

What about the other member of that array?
Are you saying the other drive has definitely been
determined to have failed? At that point, was the array
offline or still accessible to retrieve the data?

The net is overflowing with tools that "claim" to be able to read the
data, but I really don't know where to start.

You don't need any special tool. Maybe this drive has
failed but a good start is to put it back in the original
system or run the manufacturer's diagnostics on it. If you
don't have access to original system anymore, use a system
with the same raid controller.... but I dont' think that's
the problem since as written above, a drive from a RAID1
needs nothing special to read it.

Again, I don't want to rebuild the Array, or make it boot, I just want
to try to recover some data from it. I am in desperate need of some
users' folders.

Was it encrypted? Perhaps a bit more background of the
whole situation is in order. Start with "one day our server
which had worked fine, suddenly...." "then we...." "and
while drives were in same system still we tried ...".

 

[John McGaw]

Put the drive back in the same system. Something is wrong
if it is not *more* than just a RAID1 drive as RAID1 by
itself doesn't require anything in particular, each member
of a RAID1 is readable in any other system that would be
compatible with the drive (if it had not been RAIDed at
all).

snip...

Something came to me in the shower a few minutes ago: it would be very
easy to pull the wrong drive from a machine if there was not some
positive indication given of which drive of a pair had failed. This
could explain a drive that was totally unresponsive in another computer.

 

[kony]

snip...

Something came to me in the shower a few minutes ago: it would be very
easy to pull the wrong drive from a machine if there was not some
positive indication given of which drive of a pair had failed. This
could explain a drive that was totally unresponsive in another computer.

Agreed, by accident it could happen but IIRC just about any
RAID manager software or bios should indicate which drive
was faulty... plus, if the good drive had not been pulled,
being in the system still, the array should still be online
if that drive worked, unless it was then merely a matter of
changing jumpers.

 

[mwfischer82]

To answer these questions, yes, I know this was the bad drive from the
array. Nothing was done to it once removed, so it still considers
itself part of an array, and this is why Windows won't read I think.
BIOS recognizes it, as well as a program called getdataback for ntfs.
This software seems to read the drive, but will not let me do anything
afterwards, like actually see any filenames. (Note: not using the
licensed version, just the trial)

Again I am testing it in just a WINXP machine. The server has had the
drive replaced and the RAID mirror repaired with new hardware.

I guess what I am saying is, is there a way to make this drive
accessible to windows, IE, remove the RAID info. I don't think it is
so corrupt/damaged that it won't be readable. The drive spins quietly
and sounds fine.

Thoughts?

 

[kony]

To answer these questions, yes, I know this was the bad drive from the
array.

So you have the bad drive and are trying to recover data
from it? Why? The whole point of the array was that the
data is still on the good drive.

Nothing was done to it once removed, so it still considers
itself part of an array, and this is why Windows won't read I think.

No, as already written it is not a factor that it was a
member of an array. The whole point of RAID1 is that it's
two identical copies for redundancy, that both of the drives
are able to supply all data when not in the array. If the
drive you have is the one that failed, what is it you don't
understand? You have a failed drive, so just like if it
were never in an array it's unusable. That is unless I
misunderstood your first sentence above.

BIOS recognizes it, as well as a program called getdataback for ntfs.
This software seems to read the drive, but will not let me do anything
afterwards, like actually see any filenames. (Note: not using the
licensed version, just the trial)

Please back up and completely describe the whole situation
again. Using different wording. You had a RAID array with
two working drives and then what? One drive fails, or drops
out of the array for whatever reason, you still have one
working drive to get the data off of. That one working
drive is readable in any system that supports the drive. It
has nothing to do with whether it ever was or wasn't in an
array and you do not need any kind of recovery software to
get the data off of the working drive.

As for the other, seemingly failed drive. If it is a
typical hardware failure you won't get data back with
recovery software either and I don't understand why you are
trying to get any data off since that data is on the other
working drive, unless this drive had fallen into your hands
and you are trying to get at data you aren't supposed to
have access to.

Again I am testing it in just a WINXP machine. The server has had the
drive replaced and the RAID mirror repaired with new hardware.

Testing what? There is no need to retrieve data to test a
drive. I would suspect it's just like you described, a
failed drive - that has nothing to do with a raid array.

I guess what I am saying is, is there a way to make this drive
accessible to windows, IE, remove the RAID info.

Forget RAID. Do not mention it again as it isn't
applicable. For your purposes assume you have a single
drive that used to have data on it and that it was never in
a RAID array.

Now why do you need this data when the array was rebuilt
already? We need more info as this isn't making much sense.

If your drive has a physical failure, it will most likely
need to be sent to a data recovery center. Hopefully you
have not, yourself, nor allowed windows to write anything to
it.

I don't think it is
so corrupt/damaged that it won't be readable. The drive spins quietly
and sounds fine.

Well it didn't get rejected from the server for no reason,
right? If it were still working then the array controller
bios or software likely already tried to rebuild the array
onto it... or the admin didn't set it up properly as this is
a fairly standard procedure.

Forget the data that was on it, forget it was RAIDed. Run
scandisk and the HDD manufacturer's utility on it.

Like I already wrote, we need for you to supply the
information originally requested instead of trying to steer
the conversation. That info was requested as it is
applicable towards figuring out the state of the drive.
Drives don't just fail to work in the same array they'd been
running in but then magically are readable if moved to a
different system if/when the original controller and
array(s) still work fine in the original system.

Odds are the drive is bad and unusable at all. Either that
or the person trying to fix the array didn't know what they
were doing and pulled a drive for no good reason.

If you want to run recovery software go right ahead but if
that software can't get your files it has nothing to do with
the drive formerly being in a RAID array because it was
RAID1. Is it possible it was not actually RAID1 but 5?

 

[Alex Harrington]

No, as already written it is not a factor that it was a
member of an array. The whole point of RAID1 is that it's
two identical copies for redundancy, that both of the drives
are able to supply all data when not in the array.

Agreed for software RAID. Most "fake" h/w RAID and AFAIK all software
raids do exactly what Kony describes. Proper H/W RAID as is often found
in servers is a different kettle of fish.

I know for a fact Adaptec and Intel controllers write custom stuff to
the beginning of the drive to identify it as an array member, which part
of which array etc such that drives can be moved from server to server
(as a complete array) without loosing track of what's what.

In order to read the bad drive, assuming the drive is still physically
capable of being read, you'll need to plug it in to an identical RAID
controller (sometimes identical even to the firmware version on the
controller) at which point it should be recognised as a degraded RAID1
which Windows will then find and read.

Some info on the server itself - ie model and RAID controller type would
be helpful.

Cheers

Alex

 

[mwfischer82]

Ok sorry for the confusion. The drive was deemed BAD by the Card.
Dell made a mistake, by having us initialize the GOOD drive, which
then destroyed the array, and to make a long story short, we had to
rebuild the server from scratch. The drive that I have, is the old
"Failed" drive. I suppose it is just not readable any more, as this
is why it was deemed bad by the server in the first place.

To answer the type, it is a Dell Poweredge 1800, and these are 150G WD
Drives. This one had a Smart Error on the BIOS check of the drives in
the old server.
The good drive was then added back to the server with a replacement
from dell, we rebuilt the array, and reloaded the OS and Backups.
Only issue is, that the backups we had were not quite complete. We
were missing about 5 user folders. So before taking this drive to
data recovery, we thought we could try anything possible to retrieve
these few folders that we need.

Thanks,




I understand why this is confusing, but thanks for trying to direct me
to the right place.

 

[kony]

Agreed for software RAID. Most "fake" h/w RAID and AFAIK all software
raids do exactly what Kony describes. Proper H/W RAID as is often found
in servers is a different kettle of fish.

I know for a fact Adaptec and Intel controllers write custom stuff to
the beginning of the drive to identify it as an array member, which part
of which array etc such that drives can be moved from server to server
(as a complete array) without loosing track of what's what.

Software RAID also writes array ID info to the drive - it
doesn't prevent use as a single drive.

 

[kony]

Ok sorry for the confusion. The drive was deemed BAD by the Card.
Dell made a mistake, by having us initialize the GOOD drive, which
then destroyed the array, and to make a long story short, we had to
rebuild the server from scratch. The drive that I have, is the old
"Failed" drive. I suppose it is just not readable any more, as this
is why it was deemed bad by the server in the first place.

To answer the type, it is a Dell Poweredge 1800, and these are 150G WD
Drives. This one had a Smart Error on the BIOS check of the drives in
the old server.
The good drive was then added back to the server with a replacement
from dell, we rebuilt the array, and reloaded the OS and Backups.
Only issue is, that the backups we had were not quite complete. We
were missing about 5 user folders. So before taking this drive to
data recovery, we thought we could try anything possible to retrieve
these few folders that we need.

The best two options are retrying the drive in the server-
taking the new array offline temporarily if possible, seeing
if the RAID controller & bios identify it as a member of an
array or allow use without assigning it to an array. Do not
assign it to an array if it wasn't shown as a member of one
by default as this may write to the drive which you want to
avoid if you are doing option #2-

Send it to a data recovery center.

You might also send Dell a bill for data recovery if that
route is taken, at least a strong complaint and avoidance of
their "support" on anything important.

 

[Alex Harrington]

Software RAID also writes array ID info to the drive - it
doesn't prevent use as a single drive.

Fair enough. The difference though is that because the BIOS of a
standard board still have to be able to boot the drive then the S/W RAID
can't do anything non-standard.

Drives connected to a H/W controller don't necessarily have to follow
any standard because the BIOS is on the board, along with all the
processing power needed to convert the drive contents in to meaningful data.

Regards

Alex

 

[kony]

Fair enough. The difference though is that because the BIOS of a
standard board still have to be able to boot the drive then the S/W RAID
can't do anything non-standard.

Drives connected to a H/W controller don't necessarily have to follow
any standard because the BIOS is on the board, along with all the
processing power needed to convert the drive contents in to meaningful data.

Regards

Alex

Standard board bios does not have to be able to boot it, the
raid controller has it's own bios or embedded code in
mainboard bios that can be disabled and wouldn't boot or run
RAID0. RAID0 shows us another case of a *non-standard*
(versus single volume) access change, demonstrating the
software RAID controller's capability to do it, regardless
of merit or lack thereof for another alternative, the RAID1
mirror.

It is true either type of controller doens't "necessarily"
have to do anything normally. Instead we can consider that
with lack of reason not to do it standard, and a very clear
reason to do so (ability to add a data containing drive
volome to build a new mirrored set), it is typically the
case that you can do so and not have problems reading off a
single member later w/o the raid controller. This is in
contrast to other RAID modes.

Pity we never did get all the details on this server or
drive so a lot of time was wasted. Details like drive type
(WD 150GB only tells us brand and capacity, the two things
we don't need to know, although I'd guess that means it's an
SATA Raptor), specific server drive controller, a lot of
legwork might've been done by the OP to expedite the
situation.

 

[Alex Harrington]

Pity we never did get all the details on this server or
drive so a lot of time was wasted. Details like drive type
(WD 150GB only tells us brand and capacity, the two things
we don't need to know, although I'd guess that means it's an
SATA Raptor), specific server drive controller, a lot of
legwork might've been done by the OP to expedite the
situation.

Agreed.

I have a particular dislike of SATA RAID, perhaps somewhat unfairly
gained by bitter experience with Adaptec 2810SA and 21610SA controllers
and Maxtor drives.

We're mainly an HP shop at work now so we're slowly moving over to SAS.
I've yet to have to try and read a RAID1 from one of those on a
different manufacturer SAS controller. Here's hoping I never have to


Cheers

Alex

 

[CBFalconer]

Ok sorry for the confusion. The drive was deemed BAD by the Card.
Dell made a mistake, by having us initialize the GOOD drive, which
then destroyed the array, and to make a long story short, we had to
rebuild the server from scratch. The drive that I have, is the old
"Failed" drive. I suppose it is just not readable any more, as this
is why it was deemed bad by the server in the first place.

To answer the type, it is a Dell Poweredge 1800, and these are 150G WD
Drives. This one had a Smart Error on the BIOS check of the drives in
the old server.
The good drive was then added back to the server with a replacement
from dell, we rebuilt the array, and reloaded the OS and Backups.
Only issue is, that the backups we had were not quite complete. We
were missing about 5 user folders. So before taking this drive to
data recovery, we thought we could try anything possible to retrieve
these few folders that we need.

Please do not top-post. Your answer belongs after (or intermixed
with) the quoted material to which you reply, after snipping all
irrelevant material. See the following links:

--
<http://www.catb.org/~esr/faqs/smart-questions.html>
<http://www.caliburn.nl/topposting.html>
<http://www.netmeister.org/news/learn2quote.html>
<http://cfaj.freeshell.org/google/> (taming google)
<http://members.fortunecity.com/nnqweb/> (newusers)