Structure of only lost files

[Merlin]

hello Alexey!

we have following situation:
we've got 3 drives and how we thought in the beginning it was RAID5 but identifying data process took a very long time so we stopped the program.

all drives are SCSI of 9GB. But there size is indicated different (with some another program):
1 disk - 17GB
2 disk - 9GB
3 disk - 17GB

from this we have decided that this is a RAID 0 - stripe of 2 disks and its mirror on third drive. we tried to include only 2 drives which are indicated with size of 17GB.
Full identifying scan process passed quite fast but the structure of files consist of only lost files and fragments.
what can be wrong in this case?

here is a log of our first attempt for RAID5:

Init done - logging
NT 5.1.2600 Service Pack 2; 2047 MB RAM
Open physical drive 00000100 success, 76319 MB : ST380811AS - Port 2, Bus 0, Target 0, LUN 0; maxLBA=156301488
Open physical drive 00000101 success, 8678 MB : IBM-PCCO ST39102LC !# - Port 4, Bus 0, Target 1, LUN 0; maxLBA=17774160
Open physical drive 00000102 success, 8678 MB : IBM-PCCO ST39102LC !# - Port 4, Bus 0, Target 2, LUN 0; maxLBA=17774160
Open physical drive 00000103 success, 8678 MB : IBM-PCCO ST39102LC !# - Port 4, Bus 0, Target 3, LUN 0; maxLBA=17774160
Starting RAID5 parity check
Parity detected in 1% of 200 tests
One drive will be rebuit for RAID5 tests
Raw scanner starting on disk 0101 from LBA 0 to LBA 17774160
Raw scanner starting on disk 0102 from LBA 0 to LBA 17774160
Raw scanner starting on disk 0103 from LBA 0 to LBA 17774160
Raw scanner starting on disk 0500 from LBA 0 to LBA 17774160
QS SIZE INHIBIT
QS SIZE INHIBIT
QS SIZE INHIBIT
QS SIZE INHIBIT
ALERT!: MFT entry with alloc size 263168 was encountered during identification; Base record ID 000000
ALERT!: MFT entry with alloc size 1040 was encountered during identification; Base record ID 14800086
ALERT!: MFT entry with alloc size 17408 was encountered during identification; Base record ID 000000
ALERT!: MFT entry with alloc size 33792 was encountered during identification; Base record ID 000000
.............................................
ALERT!: MFT entry with alloc size 112460492 was encountered during identification; Base record ID BC40660
ALERT!: MFT entry with alloc size 106431132 was encountered during identification; Base record ID B900618
ALERT!: MFT entry with alloc size 106824349 was encountered during identification; Base record ID B81061F
TS: Stop validation
TS: Stopped validation
Logging - shut down

thank you a lot,
Lora

[Alexey V. Gubin]

So we got three drives. Some of them are member of some sort of array.

• Type of the array is not known.
• What drives are members of the array is not known.
• Stripe size not known.
• The data is NTFS probably.

Is that correct?

From the log part, I checked partnumber and the drives turn out to be Seagate Cheetah 9.1 GB (decimal). ZAR opens and reads all three OK. However, there is no valid parity information on these three drives.
This leaves two probable explanations:

1. There is one more drive somewhere.
2. The array is actually RAID 0 of three drives.

So I suggest you ask whoever is responsible for the array that maybe there was one more drive that failed, or got lost somehow. If no drive turns up, have ZAR search for a RAID0 on three drives (have both RAID5 checkboxes disabled, and the run would be significantly faster).

[Merlin]

thanks for your quick reply,

we consider that there are only 3 drives in RAID array

we have tried RAID0 with ZAR and here is the log:

Init done - logging
NT 5.1.2600 Service Pack 2; 2047 MB RAM
Open physical drive 00000100 success, 76319 MB : ST380811AS - Port 2, Bus 0, Target 0, LUN 0; maxLBA=156301488
Open physical drive 00000101 success, 8678 MB : IBM-PCCO ST39102LC !# - Port 4, Bus 0, Target 1, LUN 0; maxLBA=17774160
Open physical drive 00000102 success, 8678 MB : IBM-PCCO ST39102LC !# - Port 4, Bus 0, Target 2, LUN 0; maxLBA=17774160
Open physical drive 00000103 success, 8678 MB : IBM-PCCO ST39102LC !# - Port 4, Bus 0, Target 3, LUN 0; maxLBA=17774160
Raw scanner starting on disk 0101 from LBA 0 to LBA 17774160
Raw scanner starting on disk 0102 from LBA 0 to LBA 17774160
Raw scanner starting on disk 0103 from LBA 0 to LBA 17774160
QS SIZE INHIBIT
QS SIZE INHIBIT
QS SIZE INHIBIT
ALERT!: MFT entry with alloc size 263168 was encountered during identification; Base record ID 000000
ALERT!: MFT entry with alloc size 1040 was encountered during identification; Base record ID 14800086
ALERT!: MFT entry with alloc size 17408 was encountered during identification; Base record ID 000000
ALERT!: MFT entry with alloc size 33792 was encountered during identification; Base record ID 000000
ALERT!: MFT entry with alloc size 301990916 was encountered during identification; Base record ID 66329092
ALERT!: MFT entry with alloc size 0 was encountered during identification; Base record ID 91014184
AS start
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (190964 of 190964) 0s
Performance: Ident data query (55259 of 55259) 0s
Performance: Ident data query (190489 of 190489) 0s
AS done
Performance: Ident data query (184631 of 190964) 0s
RAID: fetch 184631 entries, drive 0101
Performance: Ident data query (49242 of 55259) 0s
RAID: fetch 49242 entries, drive 0102
Performance: Ident data query (184381 of 190489) 0s
RAID: fetch 184381 entries, drive 0103
Volume information:1.2
ALERT!: Excessive MFT attribute size near ap 630; hint -1
ALERT!: Excessive MFT attribute size near ap 558; hint -1
ALERT!: Excessive MFT attribute size near ap 942; hint -1
ALERT!: zero-sized MFT attribute
.................................................. .....................................

Volume information:1.2
ALERT!: zero-sized MFT attribute
ALERT!: zero-sized MFT attribute
ALERT!: zero-sized MFT attribute
ALERT!: Excessive MFT attribute size near ap 590; hint -1
ALERT!: Excessive MFT attribute size near ap 686; hint -1
ALERT!: Excessive MFT attribute size near ap 590; hint -1
.................................................. ....................................

Volume information:1.2
Purged unresolved MFT region: 0000 : 16 entries @ LBA 50
Purged unresolved MFT region: 0000 : 16 entries @ LBA 98
Purged unresolved MFT region: 0000 : 16 entries @ LBA 146
Purged unresolved MFT region: 0000 : 16 entries @ LBA 194
Purged unresolved MFT region: 0000 : 16 entries @ LBA 242
Purged unresolved MFT region: 0000 : 16 entries @ LBA 290
.................................................. .....................................
Purged unresolved MFT region: 0000 : 16 entries @ LBA 998642
MFT regions dump
Performance: Ident data query (27424 of 381453) 0s
Vote NTFS CF: 8; Count=3755 ; separation 99,9%
Solver: decoupled input 5182/42413
Vote Decoupled SS (008): 0; Count=219 ; separation 73,1%
Performance: Solver: decoupled CF/SS 2s
Simple volume - Detect parameters complete
Simple volume - Parse filesystem start
Simple volume - Parse filesystem started
NTFS parser started with CF/SS of 8/0 (VSN coordinates)
Performance: Ident data query (332861 of 381453) 0s
Directory tree read-in started - 332861 MFT entries
VDF direct coarse match
MFT checkpoint hit
Volume information:1.2
Volume information:1.2
ALERT!: zero-sized MFT attribute
.................................................. ........................................
VDF indirect coarse match
ALERT!: Duplicate MFT checkpoint
Volume information:1.2
Volume information:1.2
Performance: NTFS read-in 27s
VDF disabled per config
Performance: Virtual Disk Filters 0s
Directory tree linking started - total 71916 objects on volume
Performance: NTFS rebuild directory tree 0s
Directory tree refinement and reconstruction started
Directory tree refinement and reconstruction pass 1 started for 71917 objects
Directory tree refinement and reconstruction pass 1 done
Directory tree refinement and reconstruction pass 2 started for 73329 objects
Directory tree refinement and reconstruction pass 2 done
Directory tree refinement and reconstruction pass 3 started for 73330 objects
Directory tree refinement and reconstruction pass 3 done
Folder structure reconstruction complete with 3 pass(es)
Performance: NTFS directory tree cleanup 3s
Simple volume - Parse filesystem complete
Fragment reordering start
"Fragments" directory added with 1388 member(s)
Scavenger starting
Scavenger started
Starting 2 worker(s)
Started 2 worker(s)
.................................................. ...........................................

Done 2 worker(s)
Started tree mods
Done tree mods
Start purge
Done purge, 2414 objects
Scavenger stopping
Scavenger stopped
Autosave starting
Autosave started
AS start
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (55259 of 55259) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
AS done
Autosave stopping
Autosave stopped
Final TS start
FL load starting
FL load started
FL root operation
FL root done
FL load stopping
FL load stopped
Performance: RunTime 1m 10s
Final TS done
.................................................. ..................................
ALERT!: MISSING RL ENTRY ; AttrType=00000080; RealSize=1152221; AllocSize=0; RlCount=1; Need 0, found 1125899906842625
ALERT!: RL LOL 0
Performance: ValTime 15s
TE SF 1
TE SF 2
TS: Stop validation
TS: Stopped validation
Logging - shut down

we have got a structure with only fragments and lost files and no other folders.
what can be wrong?

thank you,
Lora

[Alexey V. Gubin]

Post the fragment starting with
Vote RAID stripe size
and ending with
Loading RAID ID transform

Additionally, in "Advanced Configuration" under "NTFS" make sure that "Enable NTFS 1.2 compatibility" is checked (ON).

[Merlin]

Hello Alexey!

Here is the log with our last attempt. The option "Enable NTFS 1.2 compatibility" was ON at this time.
Now we have got some real structure but amount of files are not so many and most of folders are in the Lost Directory.

Vote RAID stripe size: 16; Count=12763 ; separation 79,9%
Purged a total of 26178 known false positives (stripe size mismatched)
Remaining 15290 records
Vote Start offset: 0; Count=15260 ; separation 100,0%
RCRD/RSTR bias @86
RAID: Test RAID0
Vote RAID starting disk: 259; Count=1675 ; separation 49,4%
Vote Next disk for 0103: 257; Count=13275 ; separation 100,0%
Vote Next disk for 0101: 259; Count=1863 ; separation 98,1%
RAID loop closed
Final nonzero RAID layout scores
RAID0 (Stripe set):92,62
Virtual RAID settings changed for Virtual RAID #0
-------------------------------------
Volume information for ID 00000000
Origin : Reconstructed RAID
Partition type : Unknown
Capacity : 17357 MB
Number of sectors : 35548320
RAID type : RAID0 (Stripe set)
Stripe size : 16
Rotation parameters: 0 / 0
Member 00 : 17774160 sectors at LBA 0 on device 0103
Member 01 : 17774160 sectors at LBA 0 on device 0101
The device IBM-PCCO ST39102LC !# - Port 4, Bus 0, Target 3, LUN 0, ID 0103 is not S.M.A.R.T.-capable
The device IBM-PCCO ST39102LC !# - Port 4, Bus 0, Target 1, LUN 0, ID 0101 is not S.M.A.R.T.-capable
Loading RAID ID transform

thank you so much,
Lora

[Alexey V. Gubin]

Did you check validation result, or actually recover some sample files to see if the files larger than 1024 bytes are recovered correctly? That would indicate if general filesystem parameters are detected properly.

Also, in "Advanced Configuration", under "NTFS", set

"Gaps in MFT up to" to 32
"Fragments smaller than" to 0

and retry once more. This way we probably squeeze maximum possible out of it.