Promise Raid recovery

[dougcollins]

I'm trying to recover from a lost formatting of a Raid0 with a Promise Raid Controller, with no success. I get a bunch of lostfiles directories with what seems like properly named files, but most of the files will not open.

Now when I look at the drive in Disk Manager, the drive shows up as partioned, 75 gig active and the other 175gig unallocated. This is not right. It should be a single stripped 246 gig volume. I am now tempted to delete the partion and try again, but from what I've read on this forum, writing to the damaged drive could render it useless. Will altering the partion mess things up worse?

(Although Disk Manager reports only 75 gig active, the ZAR recover comes up with 120 gigs of data)

Thanks,

Doug Collins

[Alexey V. Gubin]

Is RAID itself still functional or not? Do you have signle or multiple disks for the RAID if you look in the disk manager?

If you worked along this instructions for the unformat (http://www.z-a-recovery.com/unformat-tutorial.htm), in step 4 (select a volume to recover) you need to

Right click the list, select "Define volume manually"
A window appears, select "There was only one volume...", click OK.
It will return to the list and a new entry will be added, labeled "unknown" filesystem and "user input" as a source.
Select this newly added entry and click "Next"This sequence bypasses the partition table and any possible problems in it, and provides ZAR with the correct target area to search in.

With regard to partitions, I suggest you leave it alone while still thinking about possible recovery.

[dougcollins]

Hi Alexey,

Thank you for your reply. I believe the RAID is functional. Disk Manager shows it as a single volume, partioned with 79meg active and the rest (about 175meg) unallocated.

I am trying what you suggested and I will report back with the results.

I am a little worried about the partion, because when I first had the problem and I viewed it in Disk Manager, it was not partioned. It was a single volume of 225 meg, but unformatted.

Thanks,

Doug Collins

[dougcollins]

No luck.

I followed your procedure above, but all the recovered files are corrupt as far as I can tell.

Should I try to delete the partion, of is that death?

Thanks,

Doug Collins

[Alexey V. Gubin]

Please ZIP the log file, C:\Program Files\ZAR\logfile.txt
and email it to development@z-a-recovery.com for review (if it is below 15MB when zipped). I do not feel like declaring it dead before reviewing the log file.

[dougcollins]

The zip file is on it's way. It was 1 kb over 15 mb, but it was too large to send on my server.

I edited the file where there were numerous ascending entries about a bad sector.

Thanks for taking the time,

Doug Collins

[Alexey V. Gubin]

Here is what you try


Delete the log file, so we start with blank one.
Start ZAR.
On the first screen click "Advanced Configuration", and under "Overrides",
set "Filesystem Type" to NTFS
set "Number of sectors per cluster" to 8
set "Sector offset for 0th cluster" to 0
Click OK to close configuration.
Continue ("Recover simple volume", then select your RAID) up to volume selection.
When prompted to select a volume, right click the list and select "Scan for missing partitions".
Wait until you see the first NTFS entry found, which should be almost instantly, and click "Stop scan".
You are now back to the volume list. Select an NTFS entry in the list and click "Next".That is likely to produce the desired result.

[dougcollins]

Sadly, that too failed to result in useable files.

Do you want to see the log file? It's much smaller than before.

Thanks again for your trouble,

Doug Collins

[Alexey V. Gubin]

Yes, send it in again.

[Alexey V. Gubin]

I've received the log file and see it worked as specified, but failed to produce a result. This is probably about time to ask


What happened immediately before a drive malfunctioned?
Is there anything that hints on a RAID controller not working properly? Any sort of a diagnostic messages from the controller maybe?
Are you sure nothing happened which may have caused either physical mixing of a drives (so that they are now in a wrong order with respect to the RAID controller), like shipping of the machine, or maybe something "logic-level" like a power surge?
If the RAID controller happens to have a replaceable cache memory on it (regular DIMM), is it possible to have this memory replaced and the latest run repeated?

[dougcollins]

I'll answer as best I can, but it won't be a short answer:

1. The Raid controller reported a malfunction. This has happened many times before. Usually if I reseat the cables or the controller the problem is corrected. However on a few ocassions I have been forced to delete the array and re-define it. This is what I did this time. All the other times I have done this, the drive recovered with all my files in tact. (I was very surprised about this the first time, so perhaps I shouldn't be surprised now that they are lost).

2. All indications from the controller are that it is functioning correctly. Of course I can't be sure unless I re-format it.

3. This question is interesting. Physically, I can't how the drives could have gotten swapped around, but nothing is impossible, I suppose. In order to make the recovery, I moved array to a different computer so that I could more easily transfer the recovered files to another disk. (The array actually resided in this machine not long ago, so I didn't think I'd have to configure anything.) The four drives are fastened together as one unit, and I kept the cable attached to both drive and controller when I moved it, to be sure not to mix up drives.

But here's the thing that caught my attention about your question: One of the drives is different because it was replaced some time back. I noticed it was listed as the first drive in the controller bios. I seem to remember it being the second or third drive, but I could be wrong.

If the drive order has indeed changed, and not physically, I take that you are suggesting it is possible electrically? What would I do about it if this is the case?

4. I am not aware of any replaceable memory on the controller. It is a Promise Technologies TX100 x2.

I hope this answers your questions sufficiantly. I am encouraged that the log reports some success. Perhaps there is still hope?

Thanks once again for all your efforts.

Doug Collins

[Alexey V. Gubin]

At this point, all signs point to the incorrectly assembled array. I'd say the wrong order of disks is most likely. The controller is a dual channel parallel ATA, 4 drives max, and there is a RAID 0 array of 4 disks, correct?

What you do now

In the RAID controller configuration,
Record the array configuration as it is now, so it can be restored if need arises.
Break the array and configure the drives as four independent (JBOD). We need ZAR to access individual drives.
Now delete ZAR logfile and start ZAR.
Refer here - http://www.z-a-recovery.com/raid-recovery-tutorial.htm for a step-by-step instructions WITH ONE EXCEPTION. Instead of "step 5, select volume to recover".
Disregard the list of a volumes completely.
Take note of what it displays, but instead of clicking on a specific volume, right click in the list and select "Define volume manually".
Select "There was only one volume in list", then click OK to close prompt.
The new volume will be added to the list, with an "Unknown" filesystem, select it and click "Next".

[dougcollins]

You are correct about the array configuration.

I will disassemble the array as you advise, but first I am wondering; If the drives were somehow rearranged, if I were able to find the original arrangement, would this solve the problem?

Now I realize there are about 16 different combinations, but I'm willing to bet if anything got swapped, it was most likely the cables at the controller. There is only one other combination there. Perhaps that is worth a try?

Thanks,

Doug Collins

[Alexey V. Gubin]

As long as the original configuration is recorded, it is worth to try and see if the volume becomes readily available in Windows. If that does not work, I think you'd better let ZAR to try and detect the proper order of disks.

[Alexey V. Gubin]

IMPORTANT:
Never run "chkdsk /F" (fix mode)against the volume without running "chkdsk" without /F (read only) first. This way you always see what it is going to fix.

Depending on the stripe size, RAID type and number of disks, it is possible to have a combination such that a volume will be mountable but still contain incorrect data. If you try a chkdsk against such a volume, the massive data loss results as it fixes the volume which is just not supposed to be assembled that way.

[dougcollins]

I tried swapping the cable around a the controller, but the results weren't any better.

I am now going to try your suggestion and break the array, but I am unclear about how to proceed.

Are you saying I should remove all the disks from the controller and just plug them in as individual drives in the IDE ports without using the controller?

Or, do you mean I go into the controller BIOS and delete the array and re-define a new one as JBOD? If this is the case, my choices will be (if I recall correctly) Stripe, Span, or Mirror. I'm guessing Span is JBOD?

Thanks,

Doug Collins

[Alexey V. Gubin]

If there are enough IDE ports on the mainboard so you can plug 4 drives in, then do it.

If you do not have enough motherboard ports available, then yes, "Span" is the same as "JBOD (Just a Bunch Of Disks)". As I recall, Promise will allow you to create a "Span" with 1 member disk in it. You need to create four such "Spans". This allows ZAR to access individual drives.

[dougcollins]

Alexey Gubin, you are my new hero!

Success!

According to ZAR, 93% of my files have been recovered. That's a pretty good percent, considering what I had a few days ago. Most, if not all of my important files seem to be there. There is one folder called LostDir and 5 LostFiles folders. I'm not sure what those files are, but I'm guessing they are mostly related to my video editing program - probably render files or something. I can always restore those.

I may find some missing information someday down the road, but all in all, this is a pretty good day.

I don't know where you are in the world, but I'd like to buy you a beer!

Awesome program! I will spread the good word!

Thanks for all your effort. Those is definitely the finest customer support I have ever received.

May God grant you continued wisdom and properity with all your ventures,

Doug Collins

[Alexey V. Gubin]

Thanks.

LostFiles/LostDirs appear when ZAR digs up something for which no parent folder can be found. This situation is possible even on a known-good volume, associated with the normal filesystem file deletion process.