December 21, 200718 yr Hi there! I'm afraid I messed up big time on this : I need to recover the data form a HDD after the unraid clearing process. I know it's a longshot but any help or advise would be really appreciated. Short explanation : I lost all my pictures (holidays, marriage, friends, baby...) The HDD was on NTFS, to work I have WinXP.
December 21, 200718 yr unless I'm mistaken, you're toast without going to a data recovery firm. I believe the clearing process actually writes 0s to every location on the disk, which is why it takes so long.
December 21, 200718 yr Author That's what I was afraid of... Damn... Any idea how much this kind of job costs? EDIT >> OMG, it starts from 500US$... OK the data are priceless but still... Does anyone have even the slightest idea on how I could get a chance to recover those data? I see some programs like Acronis Recovery Expert, Partition Recovery, Get the data back do you think this might help? Nothing was written on this HDD after it was installed...
December 21, 200718 yr That's what I was afraid of... Damn... Any idea how much this kind of job costs? EDIT >> OMG, it starts from 500US$... OK the data are priceless but still... Does anyone have even the slightest idea on how I could get a chance to recover those data? I see some programs like Acronis Recovery Expert, Partition Recovery, Get the data back do you think this might help? Nothing was written on this HDD after it was installed... The problem was that you took a drive formatted in one format (NTFS) and then formatted in a second (Reiser). So NTFS tools and Reiser tools may not be effective. Just to make sure, I would try mounting it back on a PC and see what types of free utilities you can find on download.com and elsewhere. I believe there are also free Reiser tools, but they would take more knowledge to install and run them. Bill
December 21, 200718 yr Author At this time I'm trying Acronis Partition Recovery, it helped me before with corrupted partitions I hope it'll help me this time... So I deleted the ReiserFS partition and ACR is scanning the disk to find anything. Worst case scenario it'll find the ReiserFS partition. With a bit of luck it'll find the NTFS as well... ... I know, very long shot... Thanks for the advises guys
December 21, 200718 yr That's what I was afraid of... Damn... Any idea how much this kind of job costs? EDIT >> OMG, it starts from 500US$... OK the data are priceless but still... Does anyone have even the slightest idea on how I could get a chance to recover those data? I see some programs like Acronis Recovery Expert, Partition Recovery, Get the data back do you think this might help? Nothing was written on this HDD after it was installed... The problem was that you took a drive formatted in one format (NTFS) and then formatted in a second (Reiser). So NTFS tools and Reiser tools may not be effective. Actually, you did write to the drive... twice. The first to write zeros to every single byte on the disk. (the clearing step) The second to partition the disk and create a new reiserfs file-system on it. Since you basically overwrote any and .all possible contents with the clearing step (writing zeros to every byte on the drive) the normal partition and file recovery tools will not be much help. They work because when deleting, or re-formatting, or re-partitioning you do not overwrite all the bytes on a disk, but relatively few that point to the files and define the partitions, etc. Your only hope is probably one of the very expensive data recovery services, or, (if you are really lucky, a backup you made in the past of the disk you wiped) The very expensive service MIGHT be able to read the traces of magnetism left by your original data that did not get obliterated when you wrote the zeros. They do this (I've read) by using special hardware and software to position the read head very slightly off track to try to read an edge of the data that might not have been throughly erased. This might be WAY more than the starting cost of $500 you originally quoted. I know it will hard to describe the series of steps that led to the clearing of your pictures, but did you grab or assign the wrong disk or something? Joe L.
December 21, 200718 yr Author Actually the big mistake was on my part not triple checking if the pictures were transfered or not : I copied the pictures directory from Windows XP using supercopier (kind of a copy manager) with a simple drag'n drop over the network. I assumed everything was copied successfully as I saw all the directories without noticing that there were all empty. (can't express how stupid I feel about that...) After the copy I placed the hard drive in the unRAID machine, assigned it to disk6, I cleared and formated it. I brought the array online and left it like that not assigning any data on disk6 until I noticed that the files were missing, at that point I removed the hard drive from the array. And that was it! Hopefully I backed up some of the pictures on ODD but of course not all of them... Another mistake I won't be making anymore... I contacted Tom about this, he was kind enough to try and help me but I'm afraid there's nothing I can do now but taking it with philosophy : "It's only data" and stuff... I should have been more careful... Anyway, if the data were correctly copied but for some odd reason deleted from the unRAID disk (still in the array) could you please point me to a good ReiserFS recovery program?
December 22, 200718 yr FWIW and for future reference... When such a thing occurs STOP, pull power if you must. Before attempting to do ANY data recovery make a bit for bit backup of the drive using something like Acronis - yes it will be HUGE. Given a choice do not attempt to boot from the disk or examine it with any tool - any changes they might make could simply make things worse. Having a bit for bit image gives you a "go back" point should a recovery fail during such an attempt. The better software will make such an image from a drive and attempt to do ALL recoveries from that data image rather than the original disk. In the case of overwriting, keeping the original disk pristine is even more important so do no recovery attempts on that media unless you're sure you know what you're doing. Forensic investigators will even use "write blockers" to ensure that evidence aka data isn't damaged during the investigative process....
December 22, 200718 yr Author Yep, that's right... Wouldn't you know of an easy to use ReiserFS undelete tool?
December 22, 200718 yr As the others have said above, once the data has been overwritten, it is not possible to undelete it. There is NO chance an undeletion tool for any OS can find anything to salvage. It can only find the zero's that have been written there. It requires forensic analysis capable tools to recover *some* of the data, and that is going to typically cost you $500 and up. I'm sorry. If you are desperate enough, you can call a service like EdTech Services at 813-516-3805. They will give you a free estimate after examining the drive. [Disclaimer: I have an indirect tie to this company.]
December 23, 200718 yr Author No no, I've given up recovering the data on the cleared hard drive, I'd just want to scan the unRAID disk where I can see the empty directories to be 100% sure the files weren't transfered
December 23, 200718 yr No no, I've given up recovering the data on the cleared hard drive, I'd just want to scan the unRAID disk where I can see the empty directories to be 100% sure the files weren't transfered A google search resulted in this hit: http://forums.suselinuxsupport.de/lofiversion/index.php/t10781.html For unRaid I'm pretty sure you will need to stop samba. Log in via telnet and type samba stop You must leave the array running, otherwise /dev/md1 will not exist, and you would have to try this on the physical disk /dev/sd? and then rebuild parity on the entire array since parity would not be updated since it is not running while you are changing the disk beneath it. Then, try the command as described in that post using /dev/md1 through /dev/md15 (or on the disk you wrote want to try recovering) For the first disk it would be umount /dev/disk1 reiserfsck --rebuild-tree -S -l /boot/recovery.log /dev/md1 Now, I've never tried this, so I have no idea if it will work, but who knows... The files recovered will be listed in /boot/recovery.log when you are done, use the management web-page to stop and restart the array. By now, it is way out of sync and the only way I know to get it back in sync is to stop and restart the array. Joe L.
December 27, 200718 yr Author Bump! Command completed but I can't find the lost+found directory, any idea where it might be? FYI the command took approx 5h to complete on a 320GB SATA2 HDD and formatted the drive (I made a backup of the previous data ) : meaning that the drive now appear as "Unformatted" in webadmin. So basically I'm left with two questions : where's the lost+found directory and how do I use the recovery.log file? If anyone has an idea it'll be much appreciated
December 27, 200718 yr It is unformatted because it is unmounted from the array. (unmounted just means that unRaid did not find a reiserfs on it when it looked, but it is not smart enough to know the difference between unmounted and really unformatted.) From web-admin, stop the array and then re-start it. It should get back in sync and show the drive. Then, lost+found will be a folder at the root of the drive. Joe L.
December 27, 200718 yr Author OK well it's over then, I recovered some other files I deleted but the pictures are definitively lost. Too bad but thanks anyway for the procedure, it's good to know this kind of thing exists just in case
Archived
This topic is now archived and is closed to further replies.