Is it possible to erase your data during a rebuild

[FrozenGamer]

Using latest 6.3.3, did a data rebuild on a failed disk, just introduced the hot spare into the array and started it up,  a few minutes after that i clicked format on the new disk, while the data rebuild was going.  After the rebuild it says that i have 5.97 gigs free on that drive (#16) - if it did a rebuild it should have showed 1tb since i was rebuilding a 5 tb drive on to a 6.  I have 2 parity drives.  Or is it just a bug that unraid doesn't show the proper usage of the rebuilt drive until reboot?  It is such a large array and i have stuff spread all around it that it might be a while before i notice what is missing if anything.

[Squid]

9 minutes ago, FrozenGamer said:

few minutes after that i clicked format on the

If the emulated disk's file system was unmountable, then clicking format erased the emulated contents.   Actual disk failures are rare, and when a disk comes up unmountable, the disk just needs file system checks done on it to get the information back.  

 

If the original disk is still available, then try mounting it with unassigned devices and then copying the information back to the array.

[trurl]

Format is never part of the rebuild process. You are rebuilding an empty filesystem.

[FrozenGamer]

So it sounds like i just formatted away 5tb of data?  Unfortunately, i just precleared the original 5tb disk.

[itimpi]

What file system did you have on the disk?    If by any chance it was ReiserFS then there is a good chance you can recover the majority of the data using reiserfsck after the rebuild completes.   The equivalent tools for other file systems are not as good.

 

there is also a chance that plugging the disk into a Windows system and using a disk recovery tool capable of handling the file system type you used.might succeed.

[FrozenGamer]

Filetype is xfs - i am assuming that preclear script zeroed all data off of the drive that i pulled and that none of it would be on the new formatted one - i just performed reboot and it still shows as almost empty. -- feeling pretty depressed about this right about now - and of course stupid.  

 

[trurl]

32 minutes ago, FrozenGamer said:

Filetype is xfs - i am assuming that preclear script zeroed all data off of the drive that i pulled and that none of it would be on the new formatted one - i just performed reboot and it still shows as almost empty. -- feeling pretty depressed about this right about now - and of course stupid.  

 

Most of the original bits will be on the rebuild. All except for the relatively few bits required to write an empty filesystem. Unfortunately, those original bits are not part of the filesystem anymore. Whether they can be recovered to become part of the filesystem I don't have any experience with.

[FrozenGamer]

then why does it say that its empty? or is it that its empty until i write to it and the bits are put on the rebuild anyhow?  in which case i should not write anything at all to the disk..

 

I am reading that this has been done before. please forgive me if i am missing something or not understanding.

 

 

Also i am beginning to have a glimmer of hope with your last statement - either way thanks for your time.  Ill be buying you some beers if i get most my data back.

 

Were you talking about on the precleared drive or the newly built one?

[trurl]

4 minutes ago, FrozenGamer said:

then why does it say that its empty? or is it that its empty until i write to it and the bits are put on the rebuild anyhow?  in which case i should not write anything at all to the disk..

The filesystem is empty. The original bits aren't part of the filesystem. If you write anything to the empty filesystem it will overwrite more of the original bits.

 

6 minutes ago, FrozenGamer said:

Were you talking about on the precleared drive or the newly built one?

 

The rebuilt disk will have the original bits that weren't overwritten when you wrote the empty filesystem (i.e.; formatted).

 

The clear disk will have all zeros.

[FrozenGamer]

Ok, let me see if i understand correctly.   so it rebuilt the data or 99% of it (because i formatted in the first 10 minutes of an over 24 hour rebuild. ) and my formatting it says that the data is not there, yet the rebuild was done on top of my format.  Sooooooo..  i shut off the dockers first, then decided to just take the array offline until i can determine if there is a way to recover the bits/data,  should i post another question on this subject - ie "How to recover data off a formatted xfs drive?"  

[JonathanM]

Just now, FrozenGamer said:

should i post another question on this subject - ie "How to recover data off a formatted xfs drive?"  

Yes. This exactly. It's not as easy as recovering some other formats, but it is possible. There is a vague recollection I have of someone on this forum running a trial version of some recovery software, and it looked good, so they paid for the full version and got their data back. Maybe someone else can remember what I'm talking about, or sift through search results.

[JorgeB]

This one was used before by other users in similar situations:

 

http://www.sysdevlabs.com/product.php?id=ufsxs5

[trurl]

Just now, FrozenGamer said:

Ok, let me see if i understand correctly.   so it rebuilt the data or 99% of it (because i formatted in the first 10 minutes of an over 24 hour rebuild. ) and my formatting it says that the data is not there, yet the rebuild was done on top of my format.  Sooooooo..  i shut off the dockers first, then decided to just take the array offline until i can determine if there is a way to recover the bits/data,  should i post another question on this subject - ie "How to recover data off a formatted xfs drive?"  

It isn't exactly a question of when the format happened. The format will have overwritten a relatively small part of the disk in any case, because only a small part of the disk is required to represent an empty filesystem.

 

You probably know that it is possible to undelete files. This is because the original files are still there on the disk unless they were overwritten by new files. But deleted files aren't part of the filesystem any longer.

 

Same idea with formatting a disk. Most of the disk was not overwritten, but an empty filesystem was written to the disk, so that is what the system sees now.

 

I don't think it is really necessary to start a new thread for this. This one is all yours already and I think the title makes it pretty obvious what it is about.

[itimpi]

When you did the format it wrote the sectors that hold the file system control structures.    This change is reflected in parity so that bit cannot be undone and is being reflected in the rebuilt disk.    The timing of the format is irrelevant - just the fact that you did it.    However file systems tend to have a level of internal redundancy so often tools that read every sector on the disk can fathom out what the pre-format directory structure looked like and recreate it.   The format tends to only write the control structures - sectors holding data are left unchanged.

 

I would have thought the best chance of recovering data is to use a tool like XFS Explorer (or a similar tool) with the rebuilt disk connected to a Windows system. 

[FrozenGamer]

trying the software and it looks reasonably priced will buy it if need be too.  also buying beers.

 

[FrozenGamer]

Will the 39 euro version work or do i need pro?  Can anyone refer me to a thread with more specific instructions on how to do the recovery - because scans are going to take 8 to 11 hours and i would like to make sure i have the right settings before i start.  Also do see that there is data there, and some folder names are there but not sure if the file names will be recoverable.  One of the choices is "intelliraw" on the scan.     looks like intelliraw is for round 2 if the basic scan doesn't work.  Right now i am trying the 8 hour scan with basic UFS explorer, a few start and stops of it show lots of files, just not sure if i have a way of recovering the folder structure/naming.  Some folder names/file names are there but others are hexidecimal filenames.