Recover Data from Windows Disk Management Striped Dynamic Disks

ARTIMEDIA

New member
Hello good people, I'm sorry if this is not the right place as I'm not a professional of data recovery. I'm rather a customer if anything. I'm a decades long filmmaker which has recently had a data loss problem.

I had a software RAID 0 array of 2 disks where I had lots of professional video work being edited. I had backups of most everything except one recent work, which is very important.

What I mean by software RAID 0, is the option to convert 2 drives in one dynamic disk, by striping, using Windows (7 in this case) disk management utility. These were two 600GB WD Velociraptor hard drives. The system was on a separate identical 600GB WD Velociraptor drive.

Now for some stupid reason, when I was restoring a System Image Backup, it decided to install it in one of the RAID drives. I'm saying "it" decided because I did nothing different than the many times I had restored system images before on the same system. I usually just did "next, next, next..." - but maybe something disconfigured in the Bios and it didn't detect the System Drive and decided to install it in one of the RAID ones - a 120GB partition was created in the 600GB drive. The rest still shows as unnalocated (RAW files from the array?).

I have tried tons of recovery softwares: EaseUS, iCare Data Recovery, R-Studio, TestDisk, DMDE, ReclaiMe... You name it, I've tried it. EaseUS was the only one that seems to see the 2 Drives as a single dynamic disk, but recovery returns a bunch of truncated video files. I don't know if this is because EaseUS is recovering files from each disk separately or if it's because of the partial formatting of one of the disks. The other softwares where I tried rebuilding the array, like DMDE or R-Studio, returned checksum errors or "WinError 55 - Network resource not available" at some point. It left me wondered if on top of everything I also had a mechanical problem in that formatted drive. Data Lifeguard Diagnostics detected several unreadable sectors... But I suspect that's "soft" bad sectors... Not actually physical damage.

For that reason, my plan was trying to undo the formatting before I tried rebuilding the array. But quite frankly... I don't even know if such an "undoing" thing is possible. This is my dilemma:

1. If I try to recover the files from each disk separately, the files will make no sense on their own (they are half-files).

2. If I try to rebuild the array before recovering the files, it returns me errors because one of the drives has been formatted and that half of the array is not complete. EaseUS sees the 2 drives as one dynamic disk but recovers truncated files.

4. I'd like to return the partially formatted drive to its original state to try and rebuild the array, but don't even know if that's possible.

5. I now created two separate images of each drive of the array hoping I manage to rebuild the array from them, in case the DMDE RAID recovering problem was due to mechanical failure. But I fear it will still return errors because I haven't "unformatted" the drive.

6. If I finally find a way of undoing the formatting, will it work with the images I created? Or does it need to be done in the actual physical drive? I'm asking this because now that I created the images, I really want to try and erase everything in these drives and see if they're healthy, to re-use them.

7. Any other advice on how to recover my data?

Thanks in advance!
 

Jared

Administrator
Staff member
I think you'll need the help of someone with a lot of experience recovering badly damaged RAID arrays. It's going to have to be done manually since autodetection will inevitably fail in a case like this.

Our price for such a RAID is a flat $750 (barring any severe undisclosed hardware issues). Obviously, much of the data (first 120Gb) may have been overwritten, and this likely includes the file tables (where file names and folder structure is saved). So you may be limited to just getting a RAW recovery by file type. So it'd just be nameless, random numbered files in folders sorted by their type. But, at least they'd open. You'd just have to re-sort the data manually afterward.
 

lcoughey

Moderator
Based on the stripe and assuming that the full 120GB overwrote every sector from the 120GB to a single drive, I'd suggest that the first 240GB of the data on the stripe is toast. That is unless the capacity of the files are smaller than the typical 64KB stripe size.
 

ARTIMEDIA

New member
@Jared: Thank you for your reply and also thank you for clarifying about your base quotes for this kind of service. :) I will weigh that against the financial damage of losing this work and will let you know.

Yes, when EaseUS recovered files from the Dynamic disk (it was the only recovery software that "saw" the two disks as one single dynamic volume), that's exactly what I got: A mix of RAW files by type, plus a few only in their original directories. In fact in the beginning of the scan, some files would show up in their directories and them mysteriously half way through the scan, those directories would vanish and the files would show up in weird directories of the formatted partition of the new Windows Installation. Quite awkward.

Question 1:
I suppose that making an image of the disk (to prevent further loss in case there's a mechanical damage) won't reduce the amount of available data that can be recovered, compared to the actual physical drive, correct?..

Question 2: I suppose that although files can still be found "under" the windows new partition in deep scans or by techniques only professionals like you know, there's not really any way of "undoing" the partial formatting and partition creation, correct?

@lcoughey: Thank you also for your reply. No... These were HD 4:4:4 12Bit video files. files sizing sometimes tens of GB each.
 

Jared

Administrator
Staff member
ARTIMEDIA":342tko2g said:
[post]8546[/post] Question 1: I suppose that making an image of the disk (to prevent further loss in case there's a mechanical damage) won't reduce the amount of available data that can be recovered, compared to the actual physical drive, correct?..

An image or clone is every bit as good to work from for data recovery as the original is. There's no magic that data recovery software performs which can recover overwritten data, it's just finding lost files no longer referenced by a working file system. Cloning is always the first thing a professional company will do, just to eliminate risk related to hardware failure.

ARTIMEDIA":342tko2g said:
[post]8546[/post] Question 2: I suppose that although files can still be found "under" the windows new partition in deep scans or by techniques only professionals like you know, there's not really any way of "undoing" the partial formatting and partition creation, correct?

A partition table itself is easy enough to re-create, but an overwritten file system is not so easy. If new data overwrote some or all of the MFT (master file table) which is stored near the beginning of the drive, file names and locations are lost. If the original drive was NTFS formatted, there is some indexing and other file system structures in the middle of the partition which can help some. But, a full file tree recovery is unlikely.

Even us pros don't have a way to recover overwritten data. That's just a myth cooked up by some paranoid people who were reading some misleading advertising of data recovery companies.

ARTIMEDIA":342tko2g said:
[post]8546[/post] These were HD 4:4:4 12Bit video files. files sizing sometimes tens of GB each.

One possible issue with files this big, is that, if the drive was getting close to full, the files may be fragmented and not stored continuously on the volume. Hopefully, you had a lot of free space remaining.
 

ARTIMEDIA

New member
Jared":28h1056g said:
One possible issue with files this big, is that, if the drive was getting close to full, the files may be fragmented and not stored continuously on the volume. Hopefully, you had a lot of free space remaining.
Thanks again for all the clarifications. Unfortunately, small film/video studios/businesses like mine tend to be working in limit situations in terms of storage. I usually only buy new storage when the existing one is reaching it's limit.

The way I had been working, I had this roughly 1100GB Dynamic Striped array in which the most recent projects were. This allowed for faster read/write speeds for accessing source files and for rendering, respectively. Whenever I finished a project I would save it in two places for redundancy: My Qnap NAS and regular HDDs that I store separately. However everything was against me in this case because, I was running out of storage both at the Dynamic Raid 0 and at the NAS so, I only had this single copy of the source materials and edit in the Raid array that I lost... And predictably they were quite fragmented considering the array was also 99% full.

That's probably why most of the RAW files recovered by AeseUS were either truncated or even mixed with other files. I think AeseUS tried to find what was left and tried to stitch together parts from different files. I have videos that say they are 20 minutes long but only play 5, I have videos that are half/half of two different videos. Some SD videos show PinP, embedded in the upper left corner of HD videos... Huge mess.
 

Jared

Administrator
Staff member
Well, if you can play 5 minutes of video, it's safe to say that your RAID settings are correct in the recovery. So fragmentation is likely to be the issue. Stitching the files back together would probably take a lifetime and bankrupt you long before it's done.

Maybe some better software like R-Studio would have a chance at figuring out some of the file system, but you'd probably have to manually figure out the RAID parameters. Perhaps EaseUS can tell you what parameters it's using and you just put them into R-Studio. Then scan the whole thing and see if it finds anything useful.
 

ARTIMEDIA

New member
Thanks! Yes, I've actually used R-Studio to create the .dsk image files of both drives. I was now thinking of trying to reconfigure as much as possible from the Raid 0, using either R-Studio or DMDE, so that I could then repeat the recovery attempt and see if it yields better results than when I tried using EaseUS alone.

As for using R-Studio to figure out the Raid parameters, thanks for the kind advice. I suppose that's better or at least cheaper than using RaidProbe service from Runtime's Raid Reconstructor software, no?

Btw, after now deleting the volumes and formatting the dynamic disk where I had accidentally installed Windows, WD Lifeguard Diagnostics, keeps telling me there are "too many bad sectors" I guess that doesn't augur good things about the physical state of the drive itself, right?
 

jol

Member
ARTIMEDIA":1qdqeb86 said:
However everything was against me in this case
Then I afraid that A DR PRO will also go against you
what I mean is what @Jared already mentioned:

Jared":1qdqeb86 said:
So fragmentation is likely to be the issue. Stitching the files back together would probably take a lifetime and bankrupt you long before it's done.

the way I see it - based on the info written above - , the only way you'll have the file recovered is manually (using HEX)

I'm sorry
 

ARTIMEDIA

New member
It's ok, I guess worse things occur. :) Thank you for the advice Jol! I'm always willing and eager to learn more. I admit I know nothing about rebuilding video files at the code level using HEX. But if it's media related, I'm always ready to start learning. I'll look into that possibility.
 
Top