PLease help with Data Recovery

S

subxero

Well-Known Member
Joined
Jan 21, 2008
Messages
347
Reaction score
1
We have a Netgear ReadyNas at work used as an image database and as a backup for all the studio machines work in progress. It has 3 1TB drives using X-Raid. The girl who looks after the image database accidentally deleted a folder of images - a lot of images which cost a fortune. I checked the Nas configuration and it does not use a recycle bin or snapshots.I have spoken to the IT guy who set up the system and he reckons there is no way to get the images back since the data backups would have written over the files. I get that. But...

Recently, (just before this incident) we got a message warning that one of the drives was becoming unstable. It was replaced right away. I have that drive and thought I could hook it up to a PC and recover the data from it. The deleted folder of images is definitely on there. Problem is it is not that simple. The PC does not mount the drive. Active Undelete manages to detect it, but the scan produces garbage (a bunch of odd looking symbols). I have since found out that the Nas drive uses a proprietary file system with a 16k block size as opposed to 4k. After that, the jargon and methodology as to how to recover the data went over my head.

Could some kind soul please explain to me in English how this data can be accessed and recovered. Is it even possible? The forums I have been to gave no conclusive evidence of success. I tried mounting the drive in Linux armed with a bunch of Terminal commands, but Linux gave an error message saying 'the drive could not be mounted as the file could not be read' _weird.
 
Last edited:
subxero said:
We have a Netgear ReadyNas at work used as an image database and as a backup for all the studio machines work in progress. It has 3 1TB drives using X-Raid. The girl who looks after the image database accidentally deleted a folder of images - a lot of images which cost a fortune. I checked the Nas configuration and it does not use a recycle bin or snapshots.I have spoken to the IT guy who set up the system and he reckons there is no way to get the images back since the data backups would have written over the files. I get that. But...

Recently, (just before this incident) we got a message warning that one of the drives was becoming unstable. It was replaced right away. I have that drive and thought I could hook it up to a PC and recover the data from it. The deleted folder of images is definitely on there. Problem is it is not that simple. The PC does not mount the drive. Active Undelete manages to detect it, but the scan produces garbage (a bunch of odd looking symbols). I have since found out that the Nas drive uses a proprietary file system with a 16k block size as opposed to 4k. After that, the jargon and methodology as to how to recover the data went over my head.

Could some kind soul please explain to me in English how this data can be accessed and recovered. Is it even possible? The forums I have been to gave no conclusive evidence of success. I tried mounting the drive in Linux armed with a bunch of Terminal commands, but Linux gave an error message saying 'the drive could not be mounted as the file could not be read' _weird.
Click to expand...

Good frigging luck

1stly: Why are your backups overwriting anything? Multiple incremental and full snapshots should be kept at a redundant location at all times,even if it's just a few 3TB drives being rotated daily

2ndly:X-Raid from my reading is a fancy schmancy RAID5 - which is a horrendous piece of ****e. But worse so being a 3 disk array RAID5 means a single disk will not leave you with recoverable data. Were this a mirrored type array you'd stand a chance. But since this is a striped array the data isn't actually stored on 1 disk,but spread over 2 of them with the 3rd being used as a parity disk in case a single drive fails.

Had you had 2 of these "missing" disks you could however have rebuilt a virtual raid array and gotten the data

That being said all is not necessarily lost,but it's going to cost you a righteous amount of time or money to get back.

First option:
Image the actual raid disks,ASAP,do not write anything to them,create images with something like R-Studio
Next use Reclaime to scan for the EXACT Raid parameters used in the array - the bigger the array the longer it'll take ( you can try asking netgear or googling but i've never had solid answers from Netgear
Then use R-Studio to recreate the array with the parameters Reclaime provide ( they offer instructions on how to do it on their site and help )
Then have R-studio scan for deleted files in the Linux-type filesystems ( Ext/Ext3 ) and pray it hasn't been overwritten

Second option:
Hire some professionals to actually take the original disks,image them,then recreate the array and undelete the original files from the filesystem ( Mounting Ext3 after recreating an array and then undeleting isn't fun ) as seen above
 
Oh crap! Looks like at the end of the day it will work out less hassle and cost to buy the images back. Thanks for the feedback. I have set up an independant drive which will copy the database every night as an independant failsafe against human error.
 
Surely if you've bought the images, you can just ask the supplier for another copy. Their value is in the image, not in the cost of transferring them.

Also, don't you have the original media they were distributed on?
 
subxero said:
Oh crap! Looks like at the end of the day it will work out less hassle and cost to buy the images back. Thanks for the feedback. I have set up an independant drive which will copy the database every night as an independant failsafe against human error.
Click to expand...

Indeed this is important. Many people when setting up backups don't consider that you might just replicate the fault before you pick it up,so it's best to keep each backup for infinity ( or as near possible space allowing )
 
The reason you can't get the data off that one drive which was removed is because it was part of a RAID array. RAID writes data across all drives in the array, so you won't get any data off just that one drive.

If your images are from somwhere like iStock then just login and download them again.....

And also, don't give someone full access to your backup who is inclined to just delete stuff!
 
SouthBit said:
The reason you can't get the data off that one drive which was removed is because it was part of a RAID array. RAID writes data across all drives in the array, so you won't get any data off just that one drive.

If your images are from somwhere like iStock then just login and download them again.....

And also, don't give someone full access to your backup who is inclined to just delete stuff!
Click to expand...

Sadly the company we buy the images from only allow re-downloads for a period of 25 days, after which, you have to pay per image you want to re-download again.

The person who looks after the database has been doing so for 7 years without incident. Not sure what posessed her to hold down shift instead of ctrl, but I guess that is what they call human error.
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X