Data Recovery from Adaptec Raid Controller

hello my name is Ray Burkholder I recently had a hard drive failure on my desktop computer when I was upgrading Windows XP on my desktop computer during a reboot cycle the computer would not reboot again it was probably due to the Bermuda humidity that we have here in any case I tried several cycles of the power and in in none of the cases would the motherboard read the data that was off of the hard drives and boot into Windows XP sometime during this process the hard drives got corrupted so I’m using this video has an opportunity to explain the methods that I used to recover information off of the hard drives there are various tricks and techniques that I’ve encountered during this process that may be of value to you so what I’ve done now is I’ve taken the RAID controller and the external drive way out of my desktop computer and I am now going to use a 1u server to plug everything into and check into the status of the various components because the 1u server does not have a power supply as strong enough or power enough or the or has the connectors to power an external driver way I’m going to use a computer power supply that I’ve taken from another computer and I’m going to use a special technique with that power supply to turn it on and connect it on to the external drive array in attempting to get it to restart something happened to the hard drives probably trying to many restarts corrupted the hard drives I’ve taken the hard drives out of my desktop and I have this one you Dell server to try things out on so because this Dell one new server is not identical to the desktop that I had there’s various things I need to do to try and get this hard drive to work so this Adaptec card controls up to four SATA drives so when I bought the Adaptec card it came in as a kit as part of the kit you came with a four drive enclosure as you can see the four drives are hot swappable so I can pull a drive out and plug it back in and on the reverse there are four SATA ports and two power ports I’ve take these items out of my desktop and I’m going to mount them in this 1u server to see if I can bring everything back online and recover the data off of my hard drive so I’m going to plug the raid adapter into the server I have the hard drives now in this computer does not have the connectors or the power availability to drive the drives in the external drive array so I’m going to do a little trick I’m going to take a power supply of taken out of another 1u computer and I’m going to use this to drive the external drive array so you can see the connector that would normally go into the motherboard and the connectors that will drive the hard drives now because I don’t have an on/off switch I’m going to use another little trick that you can find on the web where if you take a jumper you can jumper from pin 3 and 4 together to create the green wire to an adjacent ground wire that will turn the power supply on just make sure you don’t jumper any of the other wires any of the positive or negative voltage wires to anything else or your short the power supply so the power supply is currently not connected and it’s turned off so we’re connecting the power supply adapters so in summary we have a 1u server we’ve installed the Adaptec RAID controller card you connect to the four drives from the adapter grade controller card to the external drive array we have power to the external drive away we have power to the server and we have power to the monitor and if we turn on the power bar everything should come on and we should see the boot screen so with the driver rays plugged into the computer through the RAID controller going to wait for the computer to boot I’m going to then press ctrl raid to get into the RAID controller configuration wait for it to initialize there are no messages that come up during the raid controller boot so the RAID controller seems fine so let’s go into the array configuration utility and we’ll see what we’ve got for Drive you have the RAID 10 raid away we’re a southern 35 gig shows us as two array members each of three are sending two gig and it shows that the array status has failed the key thing here look is that we have a stripe size of 256 kilobytes I will come in handy for the one of the subsequent steps you need to take a look at I have to arraign members each one running raid 1 so there are two drives in each of the two array members and the two drives they are in a redundant configuration and then the two redundant configurations are brought together as stripe so this combination provides redundancy and it provides speed of access to the data on the drives there should be enough redundancy on the drives and you should be able to recover the data off of the arrays I will not be able to see the drives within Windows XP there are two raids first one has two drives in it trying to build and verify that your experience that found that it is unsuccessful the second one has two drives in it as well but it’s failed completely so with the two sets of failures it’s unable to go on either rate set to be the data so the two failures I’m going to have to resort to extreme measures to obtain the data off the drives so now I have to take the drives and use a different utility to be able to recover the information off of the drives as a controller card is manufactured by Adaptec I call them to inquire about my options for data recovery because they determine my controller card was outside of warranty there was still that they could do for support although they were unable to offer up any support directly they did int that a company called run time software would be able to have some software tools that might aid in recovery I downloaded their evaluation to a called raid Reconstructor this tool is used to examine the hard drives for locating various file systems this tool scans hard drives directly so I needed to bypass the adapter controller card and connect the drives directly to the SATA ports on the motherboard since the 1u Dell server only had two SATA connections I had to use a different computer the computer I ultimately used out SATA connections as well as SAS drive connections as the two types of drives use the same type of connector I had to examine the motherboard documentation to determine which connections to use with the computer off I connected the drives in the drive array directly to the motherboard and started the computer the computer recognized the drives but placed some of the drives in a boot order with higher precedence over my regular drive I had to go into the BIOS and update the boot order so that the computer would boot normally I had to boot into Windows safe mode in order to use a software utility is manufactured by runtime software I started off by using raid Reconstructor starting it requires right-clicking on the icon and running it as administrator as I have for drives that put 4 into the box labeled as number of drives and for each of the four drives I manually selected each of my 373 gig drives recall that during the examination the Adaptec controller card settings I mentioned that we needed a 256 K block size this is entered here the analyze process is started it scans the drives additional parameters are then requested I am not sure what to put for the entry known as start sectors to probe perhaps I should have changed it to sector 0 in any case I moved on and added a block size of 512 sectors for 256 KB and uncheck the default entries for the purposes of this example I also changed sectors to probe to 1,000 you the results of the scan were inconclusive I even paid for run times evaluation service their results were inconclusive and they even suggested that my drives were beyond recovery I moved on to examine the drives myself with runtime software’s other tools first one I tried was Captain Nemo Pro it requires a configuration file called an image file image file determines which drives to examine provides a block size and how the drives are striped since my drives are mirrored and striped experiment with various combinations of two drives to come up with something which worked this is the resulting image file which enabled successful recovery of data from my drive array the drive numbers are the numbers encountered during use of raid Reconstructor experiment with the ordering of the drive numbers to arrive at this combination I started Captain Nemo by running it as administrator I loaded my image file which in this case has raid 3 then once the image file is loaded the software recognizes directories on the drives the software allows me to browse the directory hierarchy and to examine individual files the registered version will allowed file retrieval on to alternate media because I wanted to examine the directory structure in greater detail in order to determine where I might have corruption I license runtime software’s get back data software it also needs to be run as administrator’ upon startup it finds the drives but note some errors which I acknowledge I provided with the virtual image file I constructed earlier I acknowledge to check some errors and move down to the next screen the software was able to find and recognize my various Windows XP NTFS file partitions I then selected a particular Perdition and can have it validate the filesystem I can browse the files and directories once I found a specific file or directory I can copy it over to my separate media for safekeeping I have to keep in mind that I need to copy the files directories to drives other than ones I am examining in the end all was not lost by using off-the-shelf software and through some experimentation I was able to recover all the data that I needed off of my drives by using these tools I was able to save thousands of dollars by not having to send these drives off to a third-party service for examination and data recovery in hindsight another good tool that I could have been using in the past with something called good sync is a valuable tool for syncing working drives with backups and with other computers I hope you are able to find the information in this video a value you

Recover Data from Single RAID 1 Hard Drive (LINUX-Based NAS)

what is going on YouTube mark here with a grumble share I had this ready nasty duo sitting in my closet for the last three years one of the hard drives failed and instead of doing what it should have allowed me to do which was access it and get my files it turned into a giant paperweight that wouldn’t boot up I had read that I could install in bunt to and basically mount my drive and access my files like that but I’m not a Linux guy if you were in my position and you have a single Drive from a raid 1 array and you want to get your files and copied into your Windows system and you don’t want to install them bun 2 and you don’t want to learn how to mount it and you don’t know what a grip is or all that stuff kind of intimidates you and I have a very easy solution please watch and it’ll be fast so the first thing you’re going to want to do is remove your drive from your Nass and you’re going to want to mount it in your computer once you’ve done that and your computer is booted up you’re going to want to go to WWDC internals comm / linux reader and you’re going to want to download the freeware application that you find there I’ll put the link below once it’s downloaded you’re going to want to install it and you’re going to want to possibly need to run it as an administrator pick where you’d like to install it and click install and then just run it you can do that by clicking finish and leaving the checkbox checked when it pops up its going to show you what it found so you’re going to want to click on the drive that you are trying to recover in my case it was a 1.5 terabyte Barracuda and it’s going to show you all the files on there go ahead and drill into the folder with the files that you’re trying to restore and then you’re just going to want to select all of the folders or files that you want to save to another Drive in your computer right click on it and press save it’s going to pop up a little dialog wizard and you’re going to just want to hit next and it’s going to take it you know a good chunk of time depending on the amount of stuff you’re trying to recover to enumerate and calculate all the files that it’s found it’s going to ask you to put in an output folder so you can browse to a folder already on your drive or you could make a new folder in this case I made a folder called Nass and you just select it press ok hit next it’s going to show you all the folders that it can find you could expand it just pick the files you want in my case I wanted all of them and then just you know go do something because this is going to take a while for it to recover all of the files well it worked disk internals Linux Reader x64 1.9 point 3.0 hats off to you guys thank you so much for sharing this as freeware it really saved my butt I recovered all of the photos all of the music all of the work that I thought had been lost to me and had been sitting in my closet so now I get to go on a alter trip thank you for watching the video I hope it helps you out as well please comment like and subscribe if you have an alternative method that you’d like to share please do so below see you guys next time bye you

Restoring a raid array after non-raid disk error

Here are some instructions on how to recover a broken Intel Raid 0 raid array. This occurs when the raid controller gives a “non-raid disk” error and thinks one of the disks from your raid are no longer a part of the raid.

Synology DS1815+ NAS RAID Recovery (Linux RAID Recovery)

okay so I’ve gotta sell knology nos and I’m trying to recover files from an old PC and copy these onto the notes these files came from a Linux raid with for one terabyte disks and they were a raid 5 and what I want to do is copy them onto my new disks which are a 4-3 terabyte disks also in raid 5 but I’ve enabled sonali hybrid raid 1 so I can grow this in the future so why don’t I do I’m gonna extract these four disks out of my old PC and basically use them to supplement the four disks which are currently in my psychology 8 disk that’s our transplant is across and copy the files off and then once I’m done with that I’ll congruent mine as is currently on and I’ve put the disks into the two Lestrade’s here I can just quickly slide them into the chassis one by one and wait for them to come online this takes about five or 10 seconds per disk here we go so now I’m on the psychology web dashboard if I go into the storage manager I can see the four disks which I’ve just added that’s when it loads so you can see four which are currently in use and for unused disks now if I was to create a new volume is in these disks the psychology raid manager would overwrite the contents of these disks losing the data which is on it which is not what I’m going to do so I’m going to go on to the menu into the services and enable remote access via SSH the quickest way to do this is using the search facility just look for terminal and SNMP and enable SSH on port 22 now the default admin user is disabled so I’m going on to the users control panel to enable remote access for the admin user just click it edit and then check to say well this account now that have okayed this I can use my favorite SSH client to connect to the nas I drag this across and use the SSH command on my Mac I’m SS Aging in as the admin user on the IP address which I’ve is the same as the web UI if you’ve got a Windows PC you probably have to use putty or something like that so now that I’m in I can cap the MD stack file which shows the status of all the raid devices here I see MD 2 is my main raid which is currently set to 8 terabytes this is built on the 4 disks SD a B C and D and then there’s a couple of other raid arrays which created by the nas for a certain housekeeping I can LS the dev folder to see which devices are on the nose and on grepping for SD for the disks I can see there’s my SD a B C D disks which are the four three terabyte disk cipher started there have also got new disks EF g and h now that I know what disks are on the system I can use the MD admin tool to examine what the raid status is for each of those disks so on the pseudo MD ADM if I can type it now that I know what disks are on the system I can use the MD ADM tool to examine the rain status for those disks so I’m gonna sudo MD ADM – examine dev sta-1 and I see that it comes from a raid 5 array which is originally three terabytes and the disk is one terabyte here I also see the partner disks which make up this array I’ll use these IDs to reconstruct the raid array so again we sudo MD ADM – assemble then I use dev md3 the first free ID for our raid arrays here 0 1 and 2 and 4 are taken now I just use the IDs of all the disks onto adds this race that’s SD e 1 SD f 1 SD g 1 and then finally SD h 1 now I’ve entered this command I can hear the disk spinning up and it’s created the array now all I have to do is Mount this array so I’m gonna create a folder called old raid or something similar to that you need to sudo did this folder all have to do a sudo mount dev MD 3 which is the device I created and mount it onto the folder all great give this a second and to verify that all my files there I can just LS old road and here we are there’s all my files now all I have to do is copy them using the Linux CP command recursively from old raid on to my new volume and that’s it I can copy those at my own limit II remember once you’ve done you need to disable SSH access and then disabled the admin user account as well that’s it and there’s all all there is to restore in the road

RAID-1: What is this, how it’s work , how to setup and recover in Windows

hi and on this lessons I will explain you what is the raid 1 level of the disk redundancy array of inexpensive independent disks so for raid 1 you have to have a minimum two physical hard drives and it’s a also maximum two hard drives you can use three of them in order to use RAID one so for then you combine these two discs into one and it was raid 1 and you have for example two files in you going to copy them to the disk what’s happened here we go as you see the file is copied fully copy to one disk one hard drive and fully copied to the second hard drive it’s like a a mirroring copy of it like DubLi a exact duplicate copy on the second drive then you copy another file it had been exactly the same the same file copy just two to birth to both hard drive disks so in here you can you can understand it then you immerse two hard drives each one of them one terabyte you will have one raid one disk a with the size want to write the second terabyte just went to know used for a backup copy yeah this is a disadvantages of this raid level because yeah like you buy for example two hard drives each one of them 4 terabytes and you think wow I will have eight two in total not you will have only four because the second drive will be will be used for a mirroring okay but what do it in a raid 1 level if one of your disk is failed totally failed in the end of life your data is available and you can continue to use and to read and write your data is still available for you you don’t lose your data because on the second drive you have a full copy of your files so this is one of the advantages of this raid level the second advantage of this raid level is the read performance really fast because you read the same file from two hard drive disks the write performance will be same as one drive because yeah you’re just writing full file to both disk but read performance really great Hey what is good for a RAID one level it’s for critical mission files for example I don’t know like small server which can support like not so many hard drives and you like you have two data drives and just to combine them into RAID one level – sorry – place for example database like note so in very complex database so the read will be good and if the one drive is failed you still have this database available for your customer for you so that’s all this is a RAID one level easy and it’s called mirroring if you want to see how it’s how to set it to set it up on the windows just stay tuned yeah you see that is available ok here we have Windows 2016 let’s open Disk Management start disk energy until MSC check you can use this moment even in disk in Windows XP ok this management CIT inserted three new hard drives and it asked me to select a record table if it’s MBR or GPT I use MBR for disk a teal for terabyte and GPT only for disk a above for terabyte so MBR it will initialize them ok here we go three disk right click on one of them new mirrored volume next and which this will be mirror this one if you want to add third one you will not able it’s grayed out for you only to disk drive obd sacred my red one and perform a quick format next finish it will be converted to dynamic no problem okay CD to this dynamic and one more sec all right I have dr d available here is mirror and dynamic and the size of this drive is only 10 gigabytes let’s create some file folder yeah this one yes great one more yeah ok ok like right now let’s initiate a failure of the drive for this reason I will shut down window and will remove one disk will see the missing one here and we’ll try recovered with this one you ok so staging okay we back let’s see this computer if drive is here now my drive not here and where’s my files where’s my folders so let’s open this management see what’s happened there disk and Jim teen and sing stops disk okay see my drives failed this is a missing drive and this is Drive which is still available but it’s failed okay what should we do we just need to remove this mirror entering and add this as new one let’s right-click on do this one and you can reactivate volume recommend that you run a check this just to check if it’s everything okay Plex is missing it’s okay it’s the same that still missing cream the the mirror still missing okay let’s let’s remove this one remove missing disc okay let’s add let’s see if it’s available you know see our disc here and here are folders everything recovered so they just add for redundancy and the new new mirror this is dr d a new disc what will come later – dynamic and will be synchronized yes it starts synchrony to be exactly same as this Drive so that’s all our files here so we so right our redundancy and our failure of the drive so thank you and see you next

Software RAID in Windows 10, Storage Spaces and Data Recovery from RAID drives ?⚕️?

[Music] hello everybody this video will tell you about creating a storage space or a mirrored volume in Windows 7 8 or 10 dear friends if you need to recover deleted data use utilities by headsman software follow the link in the description to visit our website download a utility for free and install it then start disk analysis when the process is over it will show the files available for recovery and you will be able to bring them back our blog features quick guides to solve all kinds of problems faced by Windows users our channel and blog offer solutions for any issues from installing the operating system to remote administration and connecting mobile devices our specialists will be glad to answer your questions in comments to videos and articles the storage space is functionally integrated into Windows then allow the users to create one virtual hard disk out of several physical disks it can help you to backup data by duplicating it in several discs or unite several hard disks or SSDs into a unified storage pool storage spaces are the same as raid but on a desktop computer with several hard disks connected to it this feature first appeared in Windows 8 and it was included in Windows 10 storage spaces are available in all versions of Windows 8 and 10 including home versions you can create a storage space with a special menu in the control panel to do it connect to your computer all hard disks that you are going to use for creating a storage space and in the control panel select the menu storage spaces create a new pool and storage space select the disk you want to add to the pool and click on create pool please remember that all data from the drive is selected for the storage pool will be deleted after the pool is created you should adjust the new storage space assign a name and select a drive letter this letter and name will be represented in Windows you can also select the standard Windows filesystem NTFS or the new system type or IFS if you are going to create a mirror apparently storage space meant to protect your against loss of data it’s better to choose the our EFS type select resiliency type simple no resiliency two-way mirror three-way mirror parenting to create a large storage pool without drive failure protection select simple no resiliency two-way mirrors adjust store into copies of data on a drive and three-way mirror three copies each copy of the data is stored on a separate physical disk a parent a storage space will protect data if one of the drives fails and it will have a larger size than a 2-way of three-way mirror but it will work slower depending on the resiliency type you have selected the wizard will set the maximum size of the storage space in my case the size is 147 gigabytes however you can set up a larger size for a storage pool this option is for cases when the available size of connected physical disks is full and the user can connect and now the drive without the need to make changes to the storage configuration after that click on create storage space the storage space you have created will be shown as another drive in the folder of a specie such drive will have the name and letter which you have assigned to it and it will look similar to other drives you can do anything to this drive that you do to another nerd rive you can even encrypt it with BitLocker you can learn more about protecting the drive with BitLocker from another video by our channel find a link in the description after creating a disk storage you can go back to the control panel to manage it or change settings you can create another storage space their number is only limited by the number of physical disks connected to the computer you can add drives or rename the storage pool you can change the name or legend of a storage space by clicking rename in the storage spaces section in order to add disks to the existing storage space select head drives and specify the disks you want to add when you select the many optimized drive usage windows will spread the existing data evenly across the disks within the storage space if the existing storage space consists of three or more physical disks one of them can be deleted to do it unfold the physical disks menu and click on prepare for removal link next to the disk you want to remove in our case there is no such link as the storage space consists of two disks only after that the system will take the data from the disk being removed to the remaining two or more physical disks of the storage space as a result the link I prepare for removal will change into remove the physical disk deleted from the storage space will become available in the disk management window to enable further work with it you may have to create a new partition there and format it among others storage space management choices there is an option to delete a storage space please remember that all data from the deleted storage pool will be erased if you want to delete a storage space the mandate delete pool will become active by selecting it you can delete the storage pool completely what to do if you face loss of data from a storage space can it be restored if one are several drives of a storage space fable the process of data or a camera from such storage space becomes very complicated and cannot be reduced to scanning every drive with data or camera software in this case data won’t be restored or it will appear to be damaged the only exception is a mirrored storage space which has been created as raid one as such type of storage space creates a copy of all data on every drive let us save some files in this storage space now let us imagine a situation when your storage space or one of these drives is out of order you can even delete it in order to restore the France kept in such storage space run headman petition recovery though the storage space is no longer shown in the folder this PC the application can see all physical disks connected to the computer I know that Western Digital was one of the drives in this storage space so let’s scan it after the analysis is over you can find and restore lost files of folders in the same way as you do with any other Drive find the folder where necessary files were stored and recover them if you can’t see the files in this folder all they are not shown in the preview window or after recovery just check the folder content aware analysis they are most likely there you now the files have been recovered find the link to admin partition recovery download page in the description as I said in the beginning of this video the storage spaces function appeared in Windows beginning from Windows 8 however this operating system had a function of creating storage spaces even in earlier versions you can create a mirrored volume striped volume or spanned volume in Windows 7 or older versions of Windows by using the menu Disk Management in order to create a storage space with the Disk Management menu you need to have two or more drives connected to your computer and these drives have to be unallocated if the drive which you want to mirror is allocated delete such volume to do it right-click on it and select delete volume please remember that it will delete all data from the drive after that right-click on the drive which you want to use for storage space and select the type of new volume depending on your goals these types are somewhat similar to resiliency types of disk storage that I have described in the first part of this video for example a simple volume is a part of the physical disk that operates as a separate physical block it is nothing but an ordinary logical drive on a physical disk it is not a storage space in the meaning that we use in this article I spent volume unites free space into two of more physical hard disk into one logical drives and volumes have better performance than simple volumes about their resiliency is the same a striped volume is an array without redundancy and is nothing but a raid 0 such array is meant for better performance rather than save data storage a mirrored volume is the same as mirrored storage space or raid 1 it is meant to keep data safe in case of physical disk failure by saving several copies of files if one of the de physical disks within the storage space fails the copy of data will still exist on an outer disk a raid 5 volume as well as parity storage space is a cross between a simple and mirrored volume data is written to several physical disks with one or two parity data files created I select new volume and click next in the wizard window that appears choose the drive you want to add to the mirrored volume that is you select one more Drive in addition to the one you have selected before and click on add next choose the drive letter assign a name to the volume and format it before formatting starts you will be warned that the basic disks will be converted to dynamic disks to create a mirrored volume after that formatting and converting the disks into a mirrored volume begins in the disk management window mirrored volume disks will be shown in brown color and in this PC folder there’s one of the local disks now that’s all if you have any questions leave a comment to ask one we will answer every question without fail click the like button below and subscribe to our channel to see more thank you for watching and good luck

How to Perform RAID Data Recovery[RAID 0/1/2/3/4/5 Recovery]

he also guys in this video I’ll be showing you how to perform rate data recovery and we store all the deleted or lost data from a red hard drive by making use of a software so this software that is designed to recover data from a red hard drive and I run it on my red hard disk and I’ll show you how to recover data in this software right away so after you download it and install the software on your computer just ruptured and on the main screen all that you’ll see are just three buttons recover files recover photos and recovered drives so not a brick of data from a red hard drive click on the recover drugs module that you see here and on next screen select partition recovery and on the screen the software gives you a list of all drives that are connected to your computer so other you’re supposed to do on this screen is just select the rate hardness from which you are looking to recover data and then proceed ahead by clicking on the next button and now the software begins to search for the partitions that were deleted or one loss from your raid hard drive this usually takes a few minutes so that you can do is just wait for the recovery to complete after that you will be presented with all the red partitions that were recalled from your hard drive ok then with the recovery process all on this screen I find all the read partitions that were recovered from my hard drive so other than supposed to do here is just select the read partition from which I am looking to recover date down and then proceed ahead by clicking on the next button and on this thing I can select a specific file that I would like to recover from my raid partition for example if I’m just looking to recover pictures then I can come to picture and set the GP eg file extension which will make sure that only the pictures are recalled from my read partition as if I’m looking to recover the entire data from my partition then on how to skip this step by clicking on the skip button that I see here and proceed ahead but in this video click on skip button and recover the entire data from my read partition and now the software begins to recover the entire data from the partition that was started in the previous step and once recovery is completed I’ll be presented with all the list of files and folders every record from my read partition ok so we’re done with the recovery process and here are all the files and folders that were recovered from a read partition so that I’m supposed to do on this grid is just select the root folder that I see here and set the entire list of files and folders that will record from my hard drives partition so once I set it all the files and folders I’ll click on the next button that I see here and proceed ahead and on this screen and supposed to select a folder on my computer to which I would like to see what the decode data from my read partition so I’m planting a folder that I’ve already created on the desktop and – ok and upon clicking the next button the software begins to save all the recovered data from my rate partition to the folder that is started by me so now we’ll wait for the saving to complete after which shall be taken directly to the folder where all the covered data from my rate partition is saved to okay so we’re done with the saving process and here are all the files and folders that we hold from my read partition so this input look-over data from a red hard drive by making use of this rate recovery software say fellow thing to perform great data recovery on your computer then you can just download this software from the link that I provided below and start to recover back all your data using the software and we hope this video helped you in recovering your deleted or lost data from your red hard drive and if this video helped you in recovering your data then give it a thumbs up or subscribe to my channel to watch more of my upcoming videos

RAID recovery – entropy analysis

hi welcome to the reclaim each Channel and today the topic is what you get intensive analysis in mclean from entropy analysis is applied to the parity based arrays such as rate 5 and rate 6 once you have done the content analysis service you have already discussed in one of our previous videos and concluded that 0 ug which may be parity based one you can get more information about your age with the entropy analysis now let’s look closer at what is entropy in general entropy is a measure of data randomness the more render the data as it is an alternate and unpredictable the higher entropy you get for example in English the skillet is most frequently followed by you later this means that any meaningful text English text in our case is pretty predictable in terms of words letter follows words letter and therefore entropy of text is moon videos and image files on the contrary Kefka entropy as for race since parity block is calculated by mixing several data books generally entropy of parity is higher than Andropov data now let’s consider rate five consisting of say three disks this one is to disk swing where the 30 votes allocated my exist each relative walk is calculated based on several data books for example P 1 2 P 3 4 and B 5 6 if we calculate entropy see over the subjects we get the picture where the high entropy values correspond to the variables to be high entropy now let’s see what you get with the entropy analysis in between raw book size the number of these sins originally this order sponsor disks which do not belong to the ring question and for spiritists and Caesar the disks do not form a Verity mystery also with the entropy analysis you can notice the certain requirement with six configurations and knows at the start of C n does not equal zero now let’s discuss how to do there to be analysis and get all these characteristics actually Rick we brought does not give you some particular values instead of this you need to memorize different settings name block size and the number disks until you get one of the typical features the settings which give you is a typical picture as a correct parameters for your weight you can recognize the typical picture if you observe the following there is only one big on each disk being analyzed one big G’s else Peaks from the different disks do not ever wear now let’s consider the typical pictures on the first picture we see a red five consisting of four disks with an core block size notice that there are more than one peak nearly eight Peaks on each disk therefore the specified box size is larger than the corn box size for our rate you need to decrease the box size until you get on the one peak to choose the coal block size you need to divide the current block size by the number of Peaks you see on the picture in our example it is needed to divide 1024 kilobytes by 8 bits which gives you 128 kilobytes set a new block size and see a beautiful picture one bit per disk and no other lips note that if you continue decreasing block size the big cheese spoiled see Peaks available further reduction in block size results in a complex the wrong picture there are no pics at all return to the core block size this order can be determined based on how Pixar like it on each disk we need to align the disk so that the peaks follow each other in our example we see that this koala is image 0 image 1 2 and image 3 note that the entropy analysis doesn’t allow to determine which one is the first now let’s see how the picture changes if you specify cork number of disks for a raid 5 this time vote on the 3 disks we see that book size is not divisible by the number of pigs namely 1010 24 kilobytes is not divisible by 6 sometimes you we also noticed that two peaks of the different disks available all these points to the effect that you specify the encoder disk number try to change it and see that we solve the program is number of disks and now need to adjust block size decrease the block size to 128 kilobytes and see a beautiful picture therefore we deal with a for discrete 5 where one disc is missing and the box size is 128 kilobytes now let’s look at the raid 6 first impression is that the specified block size is a way to watch for raid 6 considerations about the number of peaks and block size are the same as for raid 5 so decrease the block size for example to 64 kilobytes see that we need to decrease it once again to 32 kilobytes books better let’s wait for a while until reclaiming Pro collect enough data since in the right six to parity sucker created and they usually occupied Justin blocks on the physical disk you get peaks like this one’s not that Peaks ever lived by the half of the big wins the content analysis and enter by analysis allow you to identify great configuration parameters basic weekly then you can use these parameters in manual rate recovery or specifies them in automatic recovery for fast analysis in this video I discussed most typical arrays more complex cases for example grid park with delayed spirits here and read six with white face you can find in our book logical data recovery if you like our data recovery videos subscribe to reclaim my channel reclaim its impulse with you see you soon

RAID Recovery from Forensic Data Recovery Course

all right so raid is fun this is going to be the fun part this is where it all comes together I do want to mention one thing about software on the software side we are going to use we are doing this manually there are tools that can now reassemble raid arrays somewhat automatically but this is one of those chicken and egg kind of things right if you don’t know what to do and you don’t know why it’s doing it or what the layout is and those kind of things then it’s a lot of work there are many ways that you can process raids I like to do it visually because I feel like if I’m looking at a photo I can figure stuff out quicker there are people and even like before like Hoffman in the Netherlands there’s a company who’s written stuff about doing analysis of gaps in space inside of a raid array is a very difficult task to do but they’ve written some scripts to do analysis I’ve been to their class and done their stuff I find it difficult to teach I find it difficult to talk about so I like to do it more graphical and so there are a number of ways with which you can do raid raid Reconstructor will do one thing our studios will do a completely different one if you look at the documents for our studio if you wanted if you bought off-street our studio our studio will do a raid reconstruction but you got to do it all manually they have like a document that’s like 20 pages long it tells you how to search for gaps and try to figure out what the gap space is so there is a scientific method with which you can examine gaps where on page 150 what 160 150 150 okay mm-hmm so my methods not the only method that you can use to do these things and you can spend a lot of time doing analysis you can look at segments you can look at stuff I will tell you mine addresses the two main areas of raid that you’re going to see raid 0 and raid 5 there is also raid 5e and raid 5 double e I will tell you right now if somebody tells you I have a raid 5 e or double e this process will not work exactly the same I will tell you you should use if you get raid 5 e or double e one of the automatic tools because you’ll have an additional parity that will be distributed that you won’t be able to easily track my hand or manually you will need an automatic tool that will assemble them but most of those controllers are higher in controllers so you’re looking at like IBM controllers or you’re looking at HP compaq trader raid controllers things like that so as soon as you hear those words and it’s not like standard you know three where or Adaptec or something in the lowering category the sub $1000 category which is mostly what I see in NASA’s I do get the others from time to time but if you say to me oh look I’ve got an HP I’m not going to use this method to do this I’m going to use an automatic piece of software that will search for the segment’s some of those drives in those raid arrays such as a compact raid array actually right segment numbers and stuff in there so you can figure them out if you knew where to decode that content so in those cases those are the ones that work really well with something like ufs explorer there is another tool that’s about a hundred and seventy dollars this tool that i have found it works great on 5e in double e so you have to think four is one one of the other ones i found is this is not this is not a real fancy tool but it does work and it does give me the configuration and it’s roughly 170 bucks or so and it will give me the configuration and then we’ll lay it out it does not make my job easy because I have to spit out a solid image so this is not practical for some large raid arrays if you handed me 4 4 terabyte drives that’s sixteen terabyte or whatever it is it’s going to be at that point I’m going to have a very difficult time spitting that out into a single image that’s probably not going to work so I would want to use something called the virtual image so there are ways where you can use a XML file to make the virtual image work so there are things that won’t fit exactly into this category but it will cover like 90% of what the rate of rays are that are out there so there’s a there’ll be a couple of if this is where we’ll defer that or do something that I get a lot of raids that are from Lacy’s Nast boxes Buffalo Terre stations up to say 16 or 20 drives in a raid array and I deal with those all the time I deal with compact IBM perc controllers all of those things and I can get most of those jobs done but I will automate it if I can but there are many times I got to look at these things manually and see what they are X ways forensics also does raid arrays it has a couple of problems and I think there’s a bug some my epic calls the phone and tell them about it but so raid arrays there is one piece of software from runtime that called Captain Nemo Captain Nemo is actually kind of I don’t know it’s kind of crappy actually I’m not very thrilled with it but runtime software makes an automatic tool called raid Reconstructor it is the only program that actually tries to use entropy and try to do a calculation to guess it actually does a lot of work for that to happen so anybody use raid Rica charter yep and you have had bad results and I’m going to tell you why you have bad results I’m going to show you why a lot of times their software actually works and they don’t tell you it works they give you a little box and it says yes the result is not significant click this button and then it will say for $300 or whatever we will tell you what the right parameters are if you use our rate probe right you know talking about I will show you that it actually works the only problem is is that for some reason they don’t bother to tell anybody that when it actually works I’ve had some discussions with them about this and I don’t know maybe they’re making money doing raid probe I don’t what is it Oh reclaim me yeah I’ve seen yeah it’s reclaimed me so that’s a yes okay awesome that one is a good application so reclaim me so keep that keep that in mind as well as you’re going through this I’m going to go through the manual process of what it would look like this is like counting before the calculator and so I’m gonna I’m gonna go through real quick raid 0 raid 5 then we’re gonna do raid 5 and then you’ll do raid 0 on your own and you’ll see how quick and easy it is because if you did raid 0 you would be amazed at how easy it actually is in most cases so so really what we’re talking about is what is not a raid what is what is raid what is not a raid because you’ll get a whole bunch of these little mass boxes and that content out there a raid normally and you’ll see both variations of this there’s a redundant array of inexpensive or independent drives I think originally it was supposed to be inexpensive and somebody turned in the bill to the boss and the boss said that’s not inexpensive where’s the inexpensive part so they renamed it independent so that’s what people tend to refer to it today but I hear both variations some raids are not redundant and they were derived for different purposes and then there’s a number of different drives depending on which raid array you select I only really care about raid 0 raid 5 if we’re talking about raid 5 e double es we have all kinds of other things that take into place and it’s a lot more expensive but most of the other pieces of software that are complex will handle those jbods there’s somebody laughing really hard that they cuz j-bot stands for just a bunch of disks and somehow every box in the world says j-bot on it right just a bunch of disks and it’s just a term and it doesn’t even you know there’s somebody laughing a lot they’re like every time he walks with your three guys came up with that it says j-bot on the box so just a bunch of this so these disks are concatenated in most cases is like one drop becomes the first drive and the second drive becomes the extended drive so there’s a tool or a board or something that will then cause the last pointer from the last drive to point to the first sector the next drive so this is like this jockey as an example for those who have brought that up before you can take on the fly two drives connected to a disk jockey and it will make a larger array so if you have two two terabytes you can make four terabyte drive that will work temporarily for you while you’re doing this does the forensic person do that too because the lower inversion does it this forensic version do that the j-bot on the flop so so it is possible to do a variety of things with a j-bot from that now a common use of these has been lossy right well let’s see is promiscuous there’s only I like to say it let’s see who got acquired like a few days ago or something who acquired them anybody remember it just happened like Lissy just got bought by like Seagate or something I think it ca alright let’s see we’ll see you got bought by somebody though sigue bought let’s see I don’t know why but they did I mean it’s yes it because it’ll see was just mine maybe they wanted them to sell so I don’t know anyway they just and they’re just happened so anyway let’s see is our real problem right because let’s see make scrappy power supplies their power supplies blow all the time and they take a drive with it or take a board with it and their boards they make a whole bunch of unique boards and on any day they might release like three drives that are completely different they look the same it’s ridiculous with different boards and so we collect these boards and so I have like a mock so like a hundred of these boards that are all different kinds and so it’s a lot easier if I could just clone the drive on a ditch bar plug the tube back into a working board and plug it back into our spar over the line I’m done we do yes yeah if you can get it running again or anything with the original board so that’s a that’s a good trick to do and then I do it sometimes in software but if I I keep a stack of boards too that are working boards in the stack of good power supplies so if I can do it automatically great but if sometimes have to manually do it and they change their method from one to another like one day they will have a boards it’s a Linux embedded and they will use a 256 K stripe and another day they’ll use a 64 K stripe I see all different kinds of things on the C’s I’ve seen 64 128 256 and 512 K stripes I’ve seen a variety of messes so they look like this you open up the case you get two drives with a crusty old wire in between because they didn’t use a fan and there’s no fan in here and it’s a yellow and your Mac source is whatever so in some cases you’ll get some that are raid zero and some of them will be jbods some of them will actually just be connected from one to the first I have seen a scenario where an HPA you know this HPA where we say I’ve got a 200 gig drive let’s make it a 40 gig drive on the first disk they said the HPA to twice the size of the first drive so if both of these are 500 gigs they set the HPA to one terabyte on the first drive then the board concatenates the last one or changes the addressing mode for the sector’s so that all of these sectors then are added so it can catenate the two drives together so as you talk to the drive it keeps on writing so all your day don’t be here till you get here so it just fills them up in order they’re not rated if you get this in for recovery how can you tell which one’s the first one huh that was most data but MBR the MBR will be there on the first job in almost every raid array you can almost always tell which one’s the first drive because it has an MBR and in this case it also has an HPA the second drive will not have an HPA so when you clone this on the deeps bar if you took the first drive out and you look at it and go that’s crazy that’s not a one terabyte this gets obviously a 500 gig drive not on one terabyte you have to manually set the HPA equal to the source so you have to type in the number and so you could clone it set the HPA to the same save it put it back in place and you can get it to work again in its original case in the original box you don’t need to you can just concatenate the two drives together and you’re fine or image them concatenate the two files together as long as you have no additional LBAs and you’re not missing any it’ll actually work but that’s what actually happens now if one’s platter dust let’s say the first one is platter dust and it has really damaged what can I do to the second one to get data back carve that is all I can do because they do not have any file system information so all I can do is carve files then spit them out so I will not get directory structures and also other crap or whatever else all I’ll get is whatever pictures and stuff is on there that I can recover so a j-bot at least from this standpoint there are single drives you’re going to process them as single drives you don’t want to process this this as a single Drive if the other drive lived because you want to concatenate them or put them back together and amazingly enough if you actually take these and I don’t know why this works exactly from a standpoint of I don’t know if maxi this is a soft raid or whatever happens but if you took a Power PC or something and you plug the two drives in the max will actually concatenate the drives back together for you it will actually see it as one solid drive and it will actually do it if you’re able to repair it so even if this system died a PowerPC if you plug those two into it it will concatenate them back and show it as one solid J Bob one solid drive so there’s a number ways to do that now if you’re doing it in you can just physically actually copy the two files together once you’ve actually recovered them or concatenated them once so that’s not really a raid and it’s not anything special you know you can actually do copy B copy slash B if you wanted to but I could use two a hex editor and paste through the two files together as well so I can do either with either method in that direction but a copy /b does it in binary and you can copy one file to the other file and as long as you’ve got enough disk space it will append them yeah yeah so I can know I take an image of the first drop and to make a DD image I take a DA image of the second Drive and then I can catenate the tooth either in a hex editor or at copy /b or find a file joiner and just concatenate the two together that’s all I’m doing nothing special Yeah right it’s the same thing yeah yeah just copy slash be because copy does it with the Beinecke slash with a binary instead of text so the second thing that I’ve seen is the NASS boxes this is a laziness box now this is actually a raid 0 you’re now you can do this in software you could reassemble this in software in a raid array but I’m just going to show you one of the things that I do this is actually a real one running these were to 500 gig drives that we’re here this is an embedded Linux board right here this is embedded Linux running on a card with the processor and everything and this is an ass box I took out the 500 gig drive is damaged and I imaged it on the deeps bar and I got it to work all but a handful of sectors and I got it to a completely image and be fine but at this time I could not set the drive up to the same size I could not use the same size drive so I couldn’t do to five hundreds so this one’s a terabyte that’s why it’s actually called Terra so this one’s a terabyte drive and this one is a 500 drive so the drama took out was actually a 500 after I cloned this I set the HPA to 500 gig and when I put it back in Linux honored the HPA and still treated them as a raids it because of the raid zero it still treated them as it was a working drive so I didn’t have to do any additional work or anything I cloned it it worked I set the HPA I threw it back in the box I powered up the Nass and it worked now I can and have had them not work and when they do not work then after I cloned it I take two DV images then I’m feeding them into our studio and I put it together now if it’s only two drives you can figure out what the stripe says is and you can figure this out pretty quickly and we’ll talk about that when we get to raid zero but it was a raid zero good everybody happy with this answer so far and forgive the nice pitcher dynamic disk dynamic discs are fairly easy to do in our studio our studio actually knows that they’re dynamic this and actually knows the configuration I will tell you how many disks belong to it I made a short movie and I put it up on YouTube so if you just go to my the earlier list where I put the YouTube stuff up and my my HTML document some for updates you can just watch this 10 minute movie and you can just see how to do it but if you it’ll just tell you what just you got to plug in and so our studios will actually tell you which tests belong in the set all you have to do is plug all your distant once you’ve prepared them and you’ll be able to recover the dynamic discs so again I don’t want to spend too much time on that so we have raid 0 raid 1 we should really never be seen right raid 1 yeah as long as that drive was working now if you get a red one in then you only recover into one drive or the one set of drives because if it’s 2 combinations or mirrored then you’re only dealing with it as if it was a single entity so you shouldn’t see raid 1 technically you do because everybody makes crappy stuff out there but you’re recovering it as a single entity whether a raid 5 or whatever the combination is it’s using so we have raid 0 and then we have raid 5 and all the variations of raid 5 which are 5e and 5 ee and then raid 6 and raid 6 I use raid 6 and raid 6 is supported in studio so when you rebuild your raid array you can use our Studios for our raid 6 the plan would be to never see a raid 6 because whatever the redundancy factors were in raid 5 that were weakened failed are fixed in raid 6 because raid 6 has an additional disk and it’s not a parity disk people say that kind of crap all the time it’s not an actual parity disk it’s to this that have distributed parity across all of the drives and so there is an additional one in case there is an additional failure in raid 6 so we’re gonna talk about raid 5 and then raid 6 just has one additional disk it’s not a hot swap it’s not a I mean it’s not a hot spare it’s a additional disk with additional parity that’s actually live during the process of using this disk to increase redundancy okay so raid 0 why did raid 0 yes yeah you can lose so so you can lose 2 drives in raid 6 and still not have any data loss once you learn as the other drive now you’ve actually got a more significant problem so then you’ve got to fix it or repair it that’s why you’re seeing it so in raid 6 you can lose 2 in raid 5 you can lose 1 once you lost the second one then the second ones down and so we’re going to talk about rate five minimum disks and stuff like that but so typically in raid 6 you can have one additional discs so raid 5 the minimum number of disks is is 3 it’s 3 the minimum number disk is 3 raid 5 has 3 to write minimum or a 5 is 3 days and then raid 6 would have 4 so that’s the minimum number of disks so you can lose up to 2 in raid 6 and you can lose up to 1 in raid 5 once you’ve lost the second one now it’s in for recovery so we’re going to talk about those things now and what the orders and those things are raid 0 why was raid 0 was what is the point of raid 0 why would people be using it speed so a lot of video companies SGI’s used them for our video work and things like that their speed because you have two sets of parallel working together writing data at the same time so they’re great for video editing and things like that but they really I guess weren’t meant to be permanent storage and some people do them I’ve had a 14 disk raid 0 in for recovery 14 this raid 0 that’s just crazy talk that’s ridiculous who would do that I am amazed by the the people in it what’s the minimum number of dissing raid zero what’s the maximum number of dissing raid zero may know the maximum it’s a crazy number it’s way up there like I’ve seen them up I’ve seen them up too it’s pretty much whatever your controller supports but up to 127 or 128 because they start at 0 up to 127 or 128 I I think 45 is the one I’ve seen the most I’ve seen 45 in a raid 0 no there they were it wasn’t it’s like they keep a pendant they kept appending like the whole external stack of bells or what you say this is like that floppy thing where the guy built a raid array at a 27-foot no this was actually a real they just kept stacking them on and on a dell controller everyone tomorrow you’ll see it take a crazy picture and publish it yeah mmm good so and then the minimum number a dish you would expect to see in a raid 0 2 right so there is no we’re done now all right you’re gonna have to forgive me for this if I offend anybody but in my world raid zero should never be called raid 0 there is no redundancy it really shouldn’t be called a redundant array right so I think it should be called aids it’s an array of independent drives that suck that’s my opinion so if you have raid 0 you have 8 it’s terrible so you do not sorry and I tried to be funny and it’s not really a funny topic but you know it’s so anyway so raid zero is not redundant raid zero is basically distributing your slices across and so we’re going to talk about this have better pictures coming up so we’re going to distribute this across the disk and we’re going to use a slice size so when I write a file I’m only writing let’s say I’d say 64 K as I write 64 K I write the next 64 K here and then 64 K here and then 64 K here and I rotate through them and so as I’ve already said with a you know and I have had raid arrays it’s common for me to have a raid array that’s a raid 0 that has four drives in it and also a s 400s I’ve mentioned this before like s4 hundreds have four drives by default in and asked for hundred and they are raid 0 in and as/400 and so if you ever had to recover them the they’re not a standard 512 K sector they are 522 K s 400 is a IBM mini mainframe and so I actually have had those in for recovery as well but you won’t be able to recover those you’ll actually have to use Linux to recover them and you will not be able to use a write blocker because they’re expecting a 512 byte sector and not a 522 byte sector so they’re 522 bites not 512 and so you the last 10 or ECC and you have to strip off that ECC so you have to like write a script or a program to strip off the last 10 bytes and then you actually have your data and then you can weave them back together so you actually have to do some work to do an as400 so if you hear a is 400 either run screaming or get out some get a higher programmer come on over but it is possible depending on distributed items with 4 drives if you don’t know the combination you get the mystery box which is I don’t know what the order is I don’t know what the stripes are I don’t know what it is then it is possible that you could spend a lot of time trying to figure it out however if you use some of your wits you might be able to figure out how to eliminate some of the options so as an example how do you know which drive is the first drive probably has an MBR on it at least still today so things like that can eliminate one of the options now you know which ones first then you can actually work through your process and all the other drives so you probably have an MBR and then you have to deal with your size sizes so I try to point out what my examples these are redundant from this so here’s my point I’m gonna basically try to look at and and I just kind of came up with this by looking at the pictures remember that puzzle this is how it really came up with it you know those puzzles as a kid they were a little square puzzle and yet the little squares and you slide them around when I saw the way rade works and I saw how this slices work that’s exactly what it reminded me of it reminded me of these puzzle pieces I’ve got to move these squares around and figure out what the arrangement is so you’ll see in a minute now raid0 is much simpler so raid0 you eliminate one of the combinations all together so you only have slight sizes and order because the only two things you have to worry about so if you don’t know anything about the disks most of them are going to be 2 or 4 drives of course if you have 16 or 18 or 20 drives you better hope somebody at least wrote a number on it or you’re gonna be spending a month doing it but we’ll talk about it and then the other thing I do is I test to find the slight sizes I actually start looking at pictures in between all the sizes now this is not perfect and I’ll tell you why it’s not perfect in between each one of the segments let’s say I let’s say I looked at a picture and the picture was 64 K between 64 K in size and 128 K in size you have fragmentation you have things that may be wrong you may have corruption you may have other things that actually happen so I need to take a big sample I want to take a sample of like 200 pictures and looking like 20 or 40 of them and when you get some of the bigger ones if any of them are right you are probably right but you may have smaller ones or compressed ones or things that are embedded in other pictures and documents that fit in between here so small ones aren’t going to give you a good enough sample so you may have some that are right in my process so I’ll try to show you a picture pictures and try to kind of give you an idea like how do you know when things are wrong now I showed this in one class and I said what’s wrong with this and somebody said nothing so what is wrong with this what it’s like this radare you can write the body is missing but the body you don’t see any additional part four pieces in there what’s wrong with it exactly one of the drives is missing so you get now here’s the story well honest to god I’m not kidding somebody sends in a drive and it’s in for recovery and I am able to you know recover it and do whatever and I got it imaged on the DS farm then I start looking at it and I look at that and I’m going what that this looks like a Raider ring so I called the dude and he says yeah I only sent you the drive that I knew is working because I know you charge per the drive so I didn’t need any other data from the other Drive what are you kidding me so yeah so that’s what happened so you can tell things right away this is a raid zero it’s missing one of the drives what’s the scent in this one like so you know and my question to when you’re looking at this you have something wrong in one of the orders because these are two legitimate pictures from a Windows machine so I’ve got something that’s either wrong in my slice eyes or something that’s wrong in my disk order depending on what I’m actually dealing with but they are real and so at least I know that I actually have something what is my potential slice size in this picture if it’s about 140 K what would my slice size probably be 64 K and so if you can kind of guess from what they just said like if you’re looking at the picture and you look at about half of it then you can see the other half so I’ve actually got something that’s out of order either I’ve got my orientation or one of the other items is out of order in the raid and then I have small files like under 32 K these smiles are fine so I know at least my slice size is bigger than this because these picture are intact or if I had dozens of them that were intact then add small ones under 64k in this raid array and this would actually be something closer to a thumbnail but then when I actually found the real picture and looked at it it was like this now and I do want to point out even though that there is a problem with this if you look at this see how this strike across the top is correct I mean even if this was three drives and I was looking at a picture that I have extracted see how the stripe across the top is correct this starts to become a consistent pattern that you start to see and I’ll show you why in just a second like this one like even if this was wrong and there’s something wrong with this content right off the raid array and it processed it and there may just be garbage in this place but it’s like holding it as a placeholder because that’s what JPEGs and stuff view is it still processes it and you can throw crap in there it’ll still process the data let’s see how the striped across the top is correct so this is a pretty big indicator to me when I’m actually looking at content that I may have something that’s partially right but maybe I have one of the orientations and one of the rows wrong but I probably have all the drives in the right order so I’ll show you what we mean and then RAW files when you have large RAW files on a drive or disk you’ll actually get and this is a fairly large file this is a mini Meg file at this point so in these stripe sizes they look like little checker boards all over when you get things wrong so the whole point is is you’ve got to reassemble these things in the correct order even if you don’t know what they are and so and then when you get it right it looks like this but I want to give you a sample because you can also do a similar thing with mp3s and mp3s have some variations I want to play you a song hangouts like it all right listen to this and tell me this is all for real radar a so but so now I want you to also know like certain things that happen with like mp3 files because there are some things you can do like variable bitrate compression right so your slice size may be dependent on how much sound is actually in that like the segments from Aerosmith is longer than the segment so so the more dense the noise is the more the data you actually have in a smaller area so have smaller segments that you’re actually listening to so quieter and piano music will be longer than what you’ll actually hear for other things in the segment with the density if they’re using variable bit rates and things like that so so sometimes we actually listen to music or something else if we can’t find something I will tell you that movie studios normally use Targa files instead of JPEGs so you’ll be looking for target files so sometimes you need to like figure out what it is you’re looking for but movies will also do the same thing if you took them to movies and as long as the header was there and the command the codecs were the same you could take two segments and glue them together and they’ll play and so you’ll actually you know you can be watching a family guy and all of a sudden you’ll see you know Seth MacFarlane talking or something you’ll see two segments that don’t belong together so it can happen and so that’s one of the things that happens with some of these so so now I’m going to talk about rate five and then we’re gonna do raid five and read zero so raid five what is rate five four Snowdown no downtime is supposed to be enough for no downtime so that the server can keep running so someone can pull the drive out and put another drive in so if you’re at you know when it was designed the whole point was going to be my server crashes at least at least if it the hard drive crashes my server doesn’t crash I can keep my content running while I get another Drive but part of what’s happened now is so small businesses aren’t mine extra drives they don’t have them in stock small businesses are buying one little server with three or five drives in their raid array or whatever and they wait for a drive to die and then they call Dell and say I got one or something like that but if they don’t have a warranty or they’re not they don’t have them in stock then what happens is the IT guy he has the o fill out a little purchase order and he gives it to the guy bla bla bla and hopefully someday they’ll actually have drive but you’re gonna see it in for recovery in the meantime because the next rise is gonna die and they didn’t really put one in in time but the other thing that happens a lot is that when they put the sudden the new drive in there’s some other problem or something happens and two drives died around the same time yes it’s a very popular problem so when you’re dealing with raid 5 there’s two types of controllers in raid 5 it is very popular to have one off on your motherboard or one on your host base controller and there is in servers and stuff they normally would have what’s called a discrete controller the discrete controller will have a CPU that’s the difference between the discrete controller and a host-based controller so the street controller has its own processor and it’s going to be able to handle the math that’s necessary to keep the raid array running much more efficiently the host based controller is using your CPU and so when a drive dies there’s a lot of weight put on your local CPU to keep the calculations done for the data to exist the data does not exist without the all the drives actually existing at the same time so it’s a lot heavier on the system on a host-based controller so you’re we’re going to do some software in a rate controller but I’m going to show you an animation that at least makes this a little bit more exciting I used to use this when I needed to sell server or something like that to the client and I said this is going to be your solution okay so this is my my early animations of how a raid array works and I will tell you I wrote this for executives so most executives do not know what exclusive-or meant so when I put exclusive-or and I put like XOR in there for the exclusive-or routine because that’s actually what happens this drives exclusive or their parity they had no clue what I said but if I said a plus B equals C they knew that they knew what that meant right everybody had this finance class or whatever else and they could figure out a plus B equals C so I replaced it with a plus B equals C so here you go so you know that alarm that you just heard there is an alarm on most rate controllers everybody heard that the alarm on the raid controllers well it’s either in server room and nobody hears but in a small business it’s usually like in the closet right outside the CEOs office yes he says shut the noise off he walks through he’s like what the hell’s going on shut that off I work to do and then what happens after you shut it off hey what nobody does nothing yeah no urgency is gone and then the CEO says oh all right we’ll put in a purchase order for that extra hard drive that you need get around to it well I’m not sure it’s in the budget I’m not sure we have enough money to buy that extra scuzzy hard drive that you asked for so that’s really what happens they have no clue and then like six months later that’s when goes so right now it’s running but as soon as that one goes now you got a bigger problem and then that’s when we see it for recovery and of course the server’s down and nobody’s doing any work and then the IT guy gets fired like it was his fault he gets fired so he’s like you did not explain the urgency to me so you are fired or he just quits you like I’m out of here the server’s down you know there’s some statistic that like a small business that 92 percent or something of small businesses that suffer a major loss like this that don’t get it recovered go out of business within one year or something from a major loss you’re gonna be out of business anyway yeah right they’ve got enough money to pay for it yeah I don’t care how much it is I’ve got to get it back so so now here’s another problem when the second drive goes you know because the idea is you can throw an X on any one of these drives and so the segment is going to be a a a and then you’ll see parity for a so it’s it’s exclusive or so a exclusive art would be exclusive art with C exclusive or with whatever gives you your parity so if you ran if you took this calculation and you did the opposite and you actually wanted to say which segment worked you should be able to do an exclusive or in reverse and you should be able to figure out which drives are in which order because all you have to do is do that math every time you move it around and so believe it or not I actually asked run-time to do that and they made a utility inside of raid Reconstructor that does it they added an exclusive or routine of course they didn’t tell anybody how to use it that was awesome but they did at it I said like because they’re doing entropy and I’m like well you know there is a way to tell and it’s exclusive or anyway we’ll talk about that but here’s the real problem second Drive goes this one’s dead which one do you need to recover guys you need to recover the last one that died you know the most recent failure because this one was in sync the day that it died but now it’s the way out of thing this is six months later so this one’s the one how do you know which drive you get a box and you got four groves in the box and maybe it lucky maybe they put zero one two three four who knows but yeah I’ll know which one it is no because who knew which one the fired IT guy he’s the guy who knew and so and maybe the janitor the janitor actually might know because the janitor he’s mopping the floor and he goes oh there’s a red blinky light that wasn’t there last week he might actually know so I’ve asked before he actually does so like oh yeah sorry blinking like six months ago well that was Terry blinking yesterday it’s cool I like blinky right so you have to recover the last Drive that failed that’s it that’s the one you got to recover none of the others are going to be useful so that’s what we’re going to do is we’re going to focus on those now the rest of time you’re getting the mystery box it’s exclusive or routine so H this Lauren would be equals C so that’s what happens in a 3dr array but here’s your options for the things that you don’t have you don’t know your disk order you don’t know your slice size and then there’s a option for what’s called the arrangements and we’re going to talk about those in a minute for Windows uses stupid names forward backward dynamic but Linux has real names and so luckily our studio uses the real names runtime Reconstructor or raid Reconstructor uses the stupid windows names and they’re just dumb and then you don’t know much you’re fragmentation and that might cause a problem so bla bla bla so we’re going to do it that’s all the words I use to back that up so this is the arrangements this is what the Linux world primarily uses for names for all of the content so I want you to see remember the puzzle picture I was talking about where it could slide the squares around and I could figure out what the arrangements were look at these arrangements so if you were looking at a picture that came off of these drives and it came from this it fit so this is drive 0 drive one drive to blah blah blah but this is now think of it as a picture this is that square I’m looking at that segment let’s say it’s 64 okay and I’m looking at that segment this top row is going to be right if you have the direct disc order if all of your drives if you put them all back together and you’re not dependent upon the parity slice and you have those drives in the right order this top row the picture will actually be in order now the second row the pitch will be in order to you get to approximately where parity is obviously and let’s unless you’re dependent upon that you’re using an application that calculates that but I want you to look at the next one this one’s called left asynchronous the next one is called left synchronous you see the top row it is the same the layout is the same between those two one two three see that that’s that slice that cost the top that would be right now the second row is not right if you look they’re different four or five six and then rotates to seven and remember there was one of the pictures they had like a little blemish that was over here on the right later on in the lower row it was then one of the earlier pictures I showed it was this blue stripe crossed top and had a blemish right here so that’s where this parody it hit that spot in that parody so the row was actually right then it corrected itself and it was parody and then the next rows were wrong okay if you’re looking at this so if you look at the other rows they will cycle back through so once you get to the bottom of the cycle they actually cycle back to so on four drives that will actually cycle back through every four time so your slice will repeat over and over so you’ll have a stripe that’s good the problem will be is it as the data shifts and the JPEG calculations are doing something with that you might not have the colors right so you might still see the stripe correct but the color won’t be right because it now has a the wrong color tone for the stuff prior to it does that make sense so when you’re looking at this and you go back and forth between them and you’ll actually see that those two have variations that will cause that problem now here’s the other thing the next two there’s one called right asynchronous and there’s one called right synchronous so all those things that you were scared of with all those variations there are four of these variations but you will not see right synchronous or right asynchronous in any of the controllers I have never seen them in any of the controllers unless they were a 5a or a five EE so if somebody said have a compact raid array or I have HP or I have a I be M RAID controller now you’re looking at 5e and double e and those are right arrays and so they’re not going to be in any of the nasty oxes and they are not going to be in any of the llowing controllers they’re not in high point you’re not in Adaptec they’re not in ami they’re not in any of the low-end controllers that are like sub $1000 so you won’t see them at all so I can almost completely say if somebody did not say I had perc I know perks are not even those perks are actually still synchronization right left synchronous there’s no rights so at least from that standpoint if you’re not talking about IBM for any of those others they’re going to be left so you can take two options right off the table so some of the things you know right now you know which ones the first drive in they are you know it’s only going to be two options for the two either left or right the let there’s no rights you’re only gonna have two options for left’s and then you have options for your slight size so when you’re looking at your options for your life your size size you could have an 8k all the way up to a 2 mm k2 so at this point in time you could have small slice up to a very large slice this is not common for you to have these many options in almost all of the controllers a lot of the low-end controllers not everyone like a perk has some crazy options that you can still do but if you know what your controller is if you even knew that you could look up what your options are so if you knew that you have a high point controller or something like that or adopt that controller then you know that you may be limited to 32 K to 512 so you could lemon ate those right away I will tell you almost every one of them that some IT guy did not mess with is probably 64 K almost always now the IT guy gets is you know I’m setting it up it would be cool to say K well then you’re gonna have to play with that if you have a Lacey it’s going to be 64 128 256 or 512 to be any of us if you have pretty much anything else most of the others are going to be 64 or 128 so if you stick with 64 is the base and you start with 64 then you can figure it out as you go through between those things so almost always unless it says it’s little C then you have your choices are 64 K 128 K and then it will cease you have 256 and 512 as two more options for the sides so this is almost always then you have left so you have left asynchronous and left synchronous so you have those two options and you know which one is your first disc with your MBR right there are other things you can do to figure out the pictures and how big a picture is going to be so remember we talked about manual carving you have to know FFT 8 you can actually carve out a picture manually and you can figure out how big a picture is so when I told you before it was if I carved the picture out and it was wrong it will tell me the inappropriate size you can’t look at the size in the file system so as an example let’s take a picture and I cut it out let’s say it was corrupt on the driver I have my slice sizes wrong and I took that picture and I saved it you see the size of the dimensions that the metadata says this picture is that is not a cake that’s not an 8k picture right how big would that be 10 megapixel exactly right so I know you kind of maybe guessed a little bit is that about right no yes oh wait you like the pictures yeah so you can do that and you can try to guess or you have another option you go to the web and you don’t find the calculator for the for the size the physical dimensions and then based on the only thing that changes is what happens in between the JPEG with its compression now most of the cameras are using somewhere like between 90 and 95 or something around there we’re probably closer to about a 2 Meg picture so that’s probably what we’re looking at for that size of a picture so that makes sense so I’m looking at approximately 2 Meg’s if I answer and what those dimensions are knowing the camera and knowing the things that’s what I’m going to base my decisions on so I throw some drives in the array and I try to figure out what this is I’ve now fixed the draw it’s a fixed what I needed to do we’re still imaging a drive we’re still trying to fix what we’re going to put together now I’m gonna say this is 2 Meg’s and so like you guys look earlier you glance steady instead o is 64 K that’s what’s happening here too so the question is so if you break this down and you divide by 2 every time if you look at the top slice you can see that the second row is wrong and it’s the to shift but this top row is right even though there’s not really much color up there along the way and then it looped through again remember I said every cycle that’s going to loop through when it loops through watch this see how big see this slice is bigger than this slice that’s right in many cases that slice is bigger it’s twice the size understand look at the layouts I don’t know if it actually has a layout right here at the looks so remember I told you it would loop through depending on the drives actually since we have four drives there would only be five stripes before it would loop through in many cases so what will happen is it will loop back through it’ll go through this and this stripe will be right and then this stripe will be right and then that stripe will be but up against the other stripe that’s right in the same order so you have two stripes that will be back to back which accounts to the wider area and then it repeats itself and so when you’re looking at this picture huh yeah so when you start to see this now you start seeing color changes and shifts because JPEGs processing this stuff differently for its different algorithm stuff but do all of the items belong in this picture or all of these huh are they all part of this picture now it’s all shifted but see like this is the top of her head and then it shifts and then you got another shift and then you’ve got the finger and the hand and all this so so do I have discs in the right order yeah yes I do I have two discs in the right order because they’re actually slices like this then I have the disks in the right order how big is much life-size 64k right so we can tell it looks like 54k so the only other option is left in this picture that would be wrong is I’m dividing in my in space I’m dividing in so I said if this is two Meg’s then this is one Meg then this is five twelve then this is 250 set stand this is one count 64 I’m just dividing everything into visually that’s really what I’m doing based on the amount of size so I’m just trying to calculate what that slice might be if that was that wide you know if there’s a for Meg picture well then I’m at 128 and if it’s a 8 Meg pitcher than and so on and so on but you don’t know what that size the picture is without trying to calculate what that is because if it’s wrong like this is actually going to give me the true representation the file put it but it doesn’t always like when we’re wrong we need to know what the size of that picture is so we can figure out what our slice size is then so I would use the EXIF information from the from the picture if I can to prove that so I’m trying to use that data so and then so what would actually be wrong in this case is whatever the choice is for the two items that actually chose for left synchronous or left asynchronous are wrong and all you do is change that one so once you know you’ve got your order and you got those things instead of just keep going ah still make a list I still write it down on paper and I still say I tried this you know 1 2 3 64 K in this orientation and I still like mark them off until I’ve checked them off but I would only have like six variations or something that I could possibly do at this point to figure out if it was better or worse and so once I actually figured out which one it was and I switch from one of the asynchronous modes then I actually would get the picture right well this is actually three this one’s actually three drives but yes if it was the pictures so in these cases if there was three so so depending on those these are pictures from our studio these are pictures from a website so these are what what one is calls them and then so these are pictures from Warrick studio than their orientation so we’re gonna do it there on that are on the computer okay so what I want you to do is in the and it is typed up but let’s switch to the computer there’s two methods we want to use here raid Reconstructor and our studios i want to show you reagan Reconstructor first because raid we construct are supposed to do all this automatically now ufs explorer probably would do this all automatically and figure it out automatically but there are a lot of better tools than there used to be but i want to show you raid Reconstructor and what it’s supposed to do so start up raid Reconstructor what’s that what you say yeah but they’re in the raid5 directory so if you look there you will find and you can put them in any order but if you look and you click on the double dots the first thing is you’re gonna have to say we’re doing array 5 and I know I have three drives I’ve repaired the do all three drives I have all three running we can do it with two but I’m going to show you three it doesn’t matter whether we do it or two or not we just have a blank space so raid five and three drives that’s what I’ve sent you in the mail and then you click on the double dots and you go load all the images and so when you load the images they’re going to be in the same directory but there’s one called raid 5 raid 5 version 2 and you need to load the ones that are just DD so we’re going to do one at a time in each position each one of the DD images everybody okay everybody night okay once you have all three of them in the position if you did not have one of the disks if you repaired two of them and you had two of them and you didn’t have one of them it’s missing disk you just leave it blank you just leave one of them blank and it will be the missing disk so you don’t fill it in and it will treat doesn’t missing disk so you have to have at least two of them this one happens have all three and so we can try all those variations later but now you’re not supposed to have to know anything down here the theory is is that the tool is supposed to figure it out for you now windows raid arrays who use these stupid names backwards forwards bla bla bla who cares let just let it the whole point of raid Reconstructor is it tries to figure it out by entropy and guess correctly so just say open drives there is a button now that says step to analyze click analyze I don’t care what it says here click Next this is something that they added on in hopes that they could try to do like a sample of the drive just click Next so I never pay any attention to any of those things I just let them go because they never work ok so everybody should be at this screen now so as many people said raid Reconstructor does you’ve not had a lot of luck with it it doesn’t work a lot I’ll show you when it doesn’t work and how we can fix it so the thing is they should have checked all these boxes for us they didn’t but you should check all those boxes because we don’t know what the slice size is so you’ll notice it 16 sectors is 8k up to 1.8 now I will tell you right now if you have a Lacey Drive and you see the words Lacey add 256 and 512 because you would have to do that if you had to add 256 it’s actually 512 sectors and then 512 was actually 1024 because it’s times 2 right so if you had a Lacey Drive you should add this let’s see yes you would have to if you had a low seat because it’s let’s see if we can get our data back so you would have to add the 256 and the 512 because they have both variations now for some reason this standard policy seems to be 256 lately the ones I’ve been getting are 256 so what you’re getting you guys getting 256 lately I don’t I don’t know why it’s dumb way to do it alright so after you’ve checked these things just say next that’s all you need to do so this is how they were supposed to run and you see it failed and when you click this button huh yes what is that button say when you say it when you click it says click here for more it says please send us more money and we will do this rate probe thingy and we will give you you know we are answered tell you what configuration is for another 300 dollars or whatever it is blah blah blah if you do that rate per thing make charges all right so this is GS I’d complained about it but they don’t listen alright so make the screen make the thing as big as you can see like drag all these things so you can see what all your stuff is so make it as big as you can see like that everybody see that here’s what they don’t tell you they’re doing an entropy test and they use a key system for their entropy test and they made this crap up I don’t know what numbers they use or how they decided but they go in increments of 1 to 4 you know 8 or something like that when they have a high number when the number is greater than 6 or something like that they say success we know which the number is when they don’t then they just rate wherever they are at this point in time so you’ll see in this column right here it says OS : 4 that’s their entropy count the higher the number the better you are so if it didn’t match anything when they did an entropy test we have nothing the entropy did not work it failed on the times that it actually worked and did something that says OS : 4 in this case and that number goes higher as it increments so when it finally gets high it will actually say success and it will turn green it won’t really work there are certain instances with entropy that their calculation can’t figure out what the derivative is for the area around it you can change these numbers all day long and it won’t get any higher it will never figure out what this rate array is and this is a real rate array this is a hardware raid array not a software raid array I actually took 8 gig drives I’ve made a hardware raid array and then I broke it and I made these images so this is a real Hardware raid array but if you knew that OS : something and the higher the number then you could examine the column and you could say what are my possible choices how many choices do I have in this entire list from top to bottom because it’s actually a longer list right there’s a scrollbar here but from top to bottom how many possible choices do I have to examine to there’s only two choices so let’s assume you knew nothing except the order of the drives you win right now there’s only two choices cos : 4 that’s their entropy counter yeah there’s only 2 right so there’s only 2 choices and one of them is 1 2 & 3 and the other one is 2 1 & 3 so if you did know the disk order and the guy was at least lucky enough to write a number on your disk of I pulled this one out first and I pulled this one out second you already know and you win but even if you didn’t know you only have two choices here that will work so you can pick either choice you want and check it and see if it works so let me show you how to do that like I’m just did you check all the oh yeah if you added other stuff to it then it like changes the okay I see yeah cuz it won’t match mine at that point okay sorry and then just yeah then do it again I just want to play the same pages right okay that’s all about the glue right okay so uh so if you pick one of these I’m gonna just pick the first one here then I’m gonna say finish now when it says finish he’ll now go to the next step which is step three and this is you have three choices you can save a virtual image so a virtual image is what I use the most and the reason I use a virtual image is I can use mix I can mismatch drop drives I can use physical drives and I can use image drives I don’t image the good ones most of the time most of the time I do not image the good ones how you fix the bad ones and then I image those and I have DD images and then if I have 16 drives in a row I’m hooking them up through any method I can USB physical drives rate or control or whatever I can do to connect them to the machine yeah every saw so if I got 14 drives in raid 0 array I’ve just got to keep throwing those things in there so I physically will continue to add those things till I have them so virtual images do not require me to make an image and they do not require me to spit out a physical disk virtual image makes a physical just a standard physical XML file pointing to all the data so I just saved this in the root of the drive and if you make the path wrong it won’t do it right so if you type C colon backslash file name dot VI m it has the V dot V I am virtual image file never a virtual image however the so make a file name C colon backslash dot B I am then the file name dot B I am and then you hit everybody okay with that idea like I actually named my files after my test like I know this was raid 5 I chose 64 and I’m doing 1 2 & 3 in the order so the previous choice that I made I make my file name according to that so that I always save 1 according to what I’ve did and then you hit copy and when you hit copy it’ll save the file I’m overriding it and if you do view you’ll see what it is the view shows you it’s an XML file and it just shows you your layout and shows you where they are and shows you blah blah blah so that’s what the virtual image file is there’s after you hit copy saved there’s one that says view so you hit copy you say yes you see this you can now try to mount blah blah blah or you can scan it so you can hit view and you can look at it and it’s just going to be a text file in the root of drop so certain drives no raid 0 almost never has like an indent into the drive but like maybe a per controller and a couple of the others might have them so you’ll have to look for the partition segment and where it starts and almost always I can figure out from where the partition segment starts how many sectors I am in to the drop and it will be the same all the way across all the drives so once you know like on a par controller if it’s 128 K and you can also sometimes google it and say oh I got a per controller I’ve got some other thing how far am i otherwise you open up a hex editor and you go scan for the beginning of your partition segment for the NTFS string and then you can figure out from there to the beginning to drop how many K you have you searched for NTFS and you search for that string and then you’ll actually know how far you are indented into the drive at that point in time so you will fit sit that fall all the way across but if you know what your controller is and you google it they’ll tell you what the segments or what that size is and so and those are the things that you FS Explorer is doing automatically for you they’re figuring out where that sector is and where that location is and I’ll show you in run time here how that actually is done because there’s a way to do that to maybe wait so that’s what the XML file looks at now after you’ve done this you’ll see it’s step four is highlighted now let me tell you about raid or runtime software’s stuff we know that we’re if we’re looking at NTFS which we don’t know right now right you don’t know what my raid control what my raid array is do you know what’s NTFS you have no idea what I’ve done it could be a Linux raid array you don’t know what I did so we can’t look at it in NTFS if we don’t know it’s in TFS if we do we might get something doesn’t work the one that they have that’s the most versatile is Captain Nemo Captain Nemo does Novell partitions windows partitions and Linux partitions but it does not do Mac they do not have an H F s program yet so you have your biggest chance of it working with Captain Nemo so if you click on Captain Nemo it will now pass your virtual file to Captain Nemo and it will open it with your virtual file and your images this is now my raid array reassembled now what you want to do is and this is going to take hunt-and-peck you would actually have to go look for a picture and see if the picture worked so you could go down and you could say is this right does this look right it’s under there are some pictures under administrator and then I think I put them under pictures or my documents and pictures or they’re my documents you go into my documents there’s folders they have pictures in it and so if you just go find one and click on it when it opens up then you can tell if it’s good or bad so raid Rica shortener did work even though it told you it didn’t in failed so it is possible to do it now this is a and what I’m also looking at is how big the picture is this picture is a three mega church not being right zero right it’s completely zero yeah three Meg picture if I did not get the radar a configure correctly it will not work okay come on so you think the one day it will show a directory structure but it may also be munched up it won’t look right you will be able to actually tell you can do that you can take a step back and do that other one and you will see that like certain things will happen like Francis the administrator folder will be empty and some other folder may not because the file records are now not in order so if you had it wrong you also see directory structure changes that will not match but it will show you one it will show you something it just won’t be right we’re going to see that in a minute everybody okay so organ you guys good over saying click now check all those notes and then I picked the first one what’s the one I’m on but if you want to pick the second one you’ll see it’s wrong yeah second one is wrong and that and that is true it’d be fine if it was wrong and say okay and then you can click captain email and then you’ll be on the right configuration great if you have the wrong configuration you probably got some sort of structure but it was screwed up on it yeah now you can go into documents and settings administrator and open up a pitcher under the My Documents folder and then you can see that it’s right and it actually works to our studio you cannot present that to our studio our studio has its own method but you can present it or use it in ufs explorer so UFO explorer they have a module that you can use this with so you can use the virtual image now there’s a different configuration for our studio but and we’re going to do our studio manually because this is doing some automation for you and so it’s still not like the pocket calculator versus doing it with a pencil so i’m going to show you the manual way so now one other thing so one other thing I’m going to tell you about now let’s end close if you just go back to the configuration we don’t need Captain Nemo open and everything you can see it works you can right-click save all the files but I want to show you one thing that’s not obvious at all inside of you’ve probably looked at raid Reconstructor many times have you looked on the Tools menu yes because it looked like it didn’t work but let me show you something that’s amazing the Tools menu see under the Tools menu look at your one of your tests if you had them right as I told you before a plus B equals C if we have it right we should be able to do an exclusive or test they just never told anybody how this works you know what else that you didn’t notice so far they did not tell you which drive was the first Drive even though they put them in the wrong order in the second choice if you knew which drive had the MBR on it wouldn’t you know which drive is the first drive why the hell did they not tell us that it’s there it is there but they don’t have any indicator for that there there is an indicator for it in their program they just don’t tell you that there so I would like for you to run the exclusive-or test click exclusive or then you get this window you see this and you have a button that says start click start what does it say Green is at the bottom pass if you have them wrong it will be fail it will be red when it doesn’t know what they are at all and it fails completely it will be ambiguous and it will be white but I want you I want you to see something that happens that you don’t even notice right away now at the bottom right now when I click on it it’s going through these number of sectors it’s actually calculating the exclusive-or for all of these sectors so it’s calculating all of these and all of them pass this is all this is a chunk this is a chunk this is a chunk this is a chunk this is thousands of sectors it passed these past and they’re green it knew it’s right when they exclude some more tests see this where you see this little box over here on the side that looks really crappy it has no scrollbar or anything like that hit click in that box and hit the HOME key or ctrl home control home look at that it knows the partition table it knows which drive is first it just didn’t bother to tell us that in the other screen well no just because all the drives are there and it’s comparing them it’s actually doing this automatically in this process if you it it’s not telling you the order but it’s comparing these gluts of all patterns to make sure that they’re correct it figures out the order on its own I know I know what you’re saying the tool actually does it for you it is figuring that out it’s not all it’s doing is doing that exclusive or calculation and it is figuring out that on its own in order for you to cause it to fail on this array you’re actually going to have to like change the drives you’re gonna have to like throw a dummy drives in there it is an exclusive or pattern for these in this order it is it is doing this automatically for you it is calculating these on in these exclusive or yes so humans just one second and with just tuned that one you can see this a 5/5 – yes yes yes if the MBR was on the second disc it will tell you which one is the first one yes it will actually figure out that there’s at least enough for the parody to be able to be calculated so it will do that so it actually has to be actually wrong like we’d actually have to like not have the content in this case so we’re just trying to figure them out and do an exclusive war test so you can see it when you have completely wrong stuff in there it’ll completely be red or to be ambiguous then we’ll show up but my point was is that there actually is some rudimentary test here it’s not that we still don’t get to do any work but it will it will at least tell us that it’s actually doing a calculation and it’s figured this out so and if you have all the correct drives in there it does this on its own without our consent basically it’ll try to figure it out and tell us but they don’t give us the answer so we have to actually physically like go look at it well the parody once they’re in the right order with a missing disc it will work it’ll actually work like so just to give you an idea I’m going to I’m going to close these drives and here’s this one which actually has the actual information on it then I’m going to make it blank and so if I open drives and I do the analysis and of course this is probably wind demos fail that’s what all right let’s see you see this see this one has a missing disc there missing disc is missing this one but it knows that disc one was the one with the MBR in the entropy test this will actually work it’s missing a disc and I only have two discs it will work if I click this button I do the exact same thing copy yes okay view it will actually work with a missing disc and it will figure it out in this case the three driver is correct as long as one drive is missing it can still figure out at least the basics of the entropy test even if you have them one missing disc so it’s a five you have to have to to have the data and it’s recalculating the parity for the remaining drive for the remaining sectors for the remaining content so it is doing this and again it doesn’t work perfect every time but you with some struggle and with some knowledge that at least that was the layout you can actually try to figure it out and make more advances but there is still one thing which is our studios which is to do it manually so alright let’s go do our studio real quick just so everybody can get an idea here let’s close everything close everything all right okay all right ours quit in half a day yeah must be nice relaxing taking kick him back all right open our studio our studio is the ugliest interface ever especially doing raid arrays anybody done our way to ring in our studio yes all right so what we want to do first is we want to load our images into our studio so this is where you’re listed the discs are this is where the work is going to be done this is your log file so I’ll show you how to create this raid array they make you create a virtual raid array so go to Drive open image and you can open all three of the raid ones just by clicking on control so you can actually open each raid raw each raid file by clicking on the DD and holding down control so you go D D D D D and open those three everybody okay all right which one’s this one how about that now here’s your hard thing do not select the partition select the drive if you select a partition you’re throwing it off by 63 or 64 sectors actually you’ll be 64 s into this huh what does Oh it’s software yeah but you want to select your partition after you’ve combined your disk not before you combine them so that’s the first thing now so we have three we wouldn’t we know which one right away is this one is because of that we don’t know the other two but we so right away you see when you put all the disks into the image you know which one has the MBR on it because it tells you right so it’s already picking it up now we just have to make sure we do not select the partition because the partition would be 64 sectors into the drive from 0 to 63 and that would throw these off and then the two images combined would not be correct right so let’s just say I had a really big raid array and I had to do this manually and I had to figure this out which I have had to do with like Targa files for movie studios and things like that and the end times so what you have to do inside of our studios you have to create a virtual rate array and then populate it with this data so under create you will see a convert create virtual block raid click that create virtual block raid that’s how you make a raid 5 array so when you click this you will now get an additional image and it will say virtual audience and then you will say virtual block raid 1 everybody see that now the easiest way to populate this they do have a drag-and-drop interface but I don’t like it the white box is over here if you right-click it will show you all your devices make sure you select your images now here’s the thing our studios does not do it automatically for you you will manually have to figure out what the order is so it’s not like reg Reconstructor where they calculate it and try to give you an automatic idea you have to manually select it so you know your first drive is this one it says it right here do not select the partition select VDD image and when you do it will remove it from the list right so don’t do the partition do the drive then add the second one now if you did not know what order they are this is where our examination is going to come in and so and and I’ll tell you that our students will do it wrong by default so you will know right away will be wrong and you’ll have to figure it out so if you select number two and then number three now the other thing you want to do everybody’s here at this spot the next thing you want to do is this we know this is rate five you’ve been told this is a raid 5 raid this is not a raid zero so this is a raid five so select raid five now there’s one other thing does everybody see a button that says apply changes immediately this used to be a bug it used to be off the screen is this is it off the screen or can you see it check that box please anything that you change it will not take place if you do not have this button checked so check that button so that every time you make a change it does that change immediately now you can see in the list what our choices are we have raid 5 we’re currently at 64k and then here you have your 4 choices that I’ve talked about earlier which would be your left standard sinkers left asynchronous you’re right synchronous and right asynchronous so the default ones you’d want to start with would be 64 K which I’ve already told you is the majority of most of these raid arrays the second thing is I would leave it at the default which is the left synchronous because I know it’s going to be one of those two anyway it’s not going to be a rave or a right synchronous in this case because I did not tell you it’s an IBM controller or anything like that so then you’re gonna have an expensive drive and that’s a tape drive so at this point in time if I had a big raid array I need to know as quick as I can is this right so I want to scan for JPEGs I don’t want to waste all time all day processing and scanning all of these things for all these variations to see if it’s right or wrong I just want to see pictures and I want to see them fast so that make sense so we did do scanning earlier so see the partition that we now have right here in the virtual block raid on the left hand side it has created a virtual partition in one you see that so I want to scan for JPEGs only do that you guys remember how to do that right click until you have around 200 documents of our requested type so turn off all the ones you don’t need if you want it to be faster what’s that oh well then you won’t know so change your known file types you’ve got to clear all add graphics back and add just JPEGs cuz if this was a giant array it would take a long time and I know it’s not a giant array so it’ll go fairly quickly but if it was the whole point is to do this fast so you do just JPEGs you leave detail scan on and you click scan and now you’ll see that’s just going through the array you see down here in the bottom it starts calculating all the content as it’s going through it so you see us doing specific documents those are the ones we’re asking it to carve so it’s done 114 a document so we’ve asked it to carve down here it shows your where it’s going but uh well I don’t know for sure how accurate is because I don’t wait exactly perfect as soon as you know that you’ve got enough documents to look at we don’t need to wait for the end of the array if we had 50 terabyte here it would take us forever we only need a handful of these I know people who do this I swear to god this happens every time somebody sets up a raid array they start to scam program thinking that you know I will come back when it’s done and then we’ll see if we win if we don’t then we’ll change all the settings so at the end they’re like waiting a week and at the end of the week then they say awesome work I gotta try again if you only do JPEGs what’s that exactly that’s the point right so once you get enough I mean I’m way enough I got 2,000 and I’m still nowhere near the end the drive this still might take a while I mean imagine this is only a 16 gig or a during this is the only 16 get greater a B and if I wait even for this one it may take me a while so as soon as you know that you have enough documents you hit stop are you sure you want stuff yes I do now you have extra files found please look at those pictures and tell me if it’s right it is not correct but when you look at the pictures let’s just say I jump in there I pick some pictures now you do need to take a sample do not trust only a handful of files you need to check different things of different sizes the bigger the size the better you’ll probably be but some of them might not be viewable if they are wrong so if you pick one and you click on it it may crash corrupt whatever like this one like obviously it’s wrong as soon as you know you’re wrong you are wrong because if it’s right it’s either right or if it’s wrong then there’s some corruption or something else was happening but you can’t trust a small sample like small files depending on boundary and compression and things like that like I’m sorting by size small files may actually be okay like when I go to click on small files that one looks line if I go down here and click on some five K files and whatever that makes sense everybody okay you understand them while these small files are okay that one’s obviously not so I’m going to drop down here just some big files like it was at a few minutes ago so I’m down here I’m gonna pick a big file now look at this picture do I have all of my slices do I have all my drives or all my drives here yes yes all my drives are here do I have all my drives in the right order yeah yes you know that right away cuz the stripe at the top is right so if those are actually segments and this is one segment and this is two segments and this is three segments then I actually have it’s actually going to be right you’re actually gonna see that component as you’re looking at it the other thing is does all the content belong to this picture and actually as part of this picture right so I’m pretty close to actually being right what’s my slice size for this picture probably I think it was I mean I have to look at XF information know for sure but I think it’s like three mags or something according to this it’s like 2.5 Meg’s or so so it’s huh now I’d have to actually look at my XF information it will probably be right at this time but if it was a screwed-up Raider aim then did not have them in the right order this file size would be wrong it will actually physically be wrong so I’d have to extract me except for information and I have to look at now you can’t look at it in hex plus say I’m here you’ll notice where I can right click and I can save you and our Studios has its own hex tool in here and I can cut off cut out a chunk of this save it to my desktop and then see what my excess information says or calculate it from the type of camera blah blah blah right so everybody understand what I mean so in the picture there is EXIF information so I can highlight like we did earlier carving manually carving and I can just take a big chunk of this supposedly right thing and I can save this and so I can then export this I think there’s actually a save routine somewhere in here save to binary file hit that then I’m going on my desktop I’m gonna save this is actually a JPEG right so I’m gonna do test 1 for test 2 dot jpg and I save this and if I get a big enough chunk and I look at the desktop now I’ll actually be able to see whether or not I’ve got some chunk of a picture or whatever else see I started getting it across the top you start to see it I didn’t get a big enough chunk for it to be something really something I can tell very clearly but you can see it’s the top of the tree right top you see it if I save more I’ll get more what I don’t I generally feel like I can do better with the bigger picture than I do a smaller picture the smaller pictures aren’t going to be as accurate because compression fragmentation boundaries bigger pictures you know right away you’re wrong when you’re like in excess of like two mags or something like that you’re way beyond its light size right so now the other thing that you need is you need something actually looks at XF information to tell you whether or not I can see anything here so the number of free tools or something out there but if I look at this I believe my XF information if they haven’t changed it in this version if I go to my desktop I think I’m an illustrator my desktop where am i thank you see so Directory Opus is doing this function for me I could download another tool or whatever but see if you look at Directory Opus it parts the data from the EXIF information or you can use an XF viewer or whatever and I can take this and calculate this and type it in to a calculator figure out what it is and according to this this should be about a little bit bigger than a to make picture right everybody good even though it currently is not it currently is 14k it certainly isn’t a 14k file right everybody okay now so I’m back in our studios and I’m looking at this picture so I know I have my drives all my drawers and I know they’re in order and I know it’s a 2 Meg picture so how big is must life-size looking at this picture huh that’s what easy two minutes yeah I mean yeah there is but from what I’m looking at at least again from huh I’m looking at physically like this is two Meg’s and then half to be one Meg and then half would be and then half would be somewhere right around here and then but no look so this is a strike that’s wrong so even though this might you maybe you think it looks like it from there but see this is wrong right and then all right we are on 64 so my size is 64 so what’s my only other thing that’s left no what’s my only other listen I only have three options I can change right try that see if any of the other options work you can but I will tell you sometimes that’s buggy you if you really want to be sure you should probably clear the settings and do it again but it does go back but every once in a while it’s buggy and kind of freaks out so you can go back get rid of this and then I’m back to where I was on my virtual raid and then the only other thing I can do is change my options for this now if you’ve discovered that now it works your next job is in the directory above this one there’s a raid zero shouldn’t take you about five minutes to figure out raid 0 now raid zero so easy do those two in this application do a raid zero on your own there is raid zero files above this directory to do raid zero get it done on the on the hard drive there is now if you go look oops there is raid zero files up from here so if you go looking that data recovery directory there’s the raid zero and there are two image files in raid 0 reassemble like they are assembling the raid0 in the directory above those there’s a raid0 directory with two drops in a raid 0 array use our studios to reassemble raid zero on your own well made 0 becomes amazingly simple by comparison yeah and that’s a real raid 0 array from a hardware raid array it’s not pulled a lot of information but it’s still raid 0 it’s actually a that pit controller once you’re done that’s it that’s what I got for today so all sets are going to be any time that you’ve got something that’s at the beginning that’s indent that’s why I said the same thing all you gotta do is find the beginning of your partition and you’ll know where that sector is and that’s it well like some of them are standard like I think perc is a 128 who Dutton Martin do it in the morning or the morning tomorrow cuz tomorrow we have labs and stuff too so we can work on it tomorrow yes I did do that I do that a lot in raid arrays where I have like you know 16 drives in a raid array and I don’t want to have to go like shopping parts that it’s exactly what I do is I completely image that drive and then I can use that for parts if they are exact matches that’s correct I do dump a DVD to the disk that’s all I do is just make sure that I get a good copy of it and verify it before I take the first drive apart before I take it apart trying to get to our TVs yes that’s correct and in your case with promise controller yeah yes then that’s no problem ami ami Adaptec promise it just doesn’t do 5 e & 5 ee but you FS Explorer does like if I took 2 DD images and somebody told me a whole this or three of them are five of them by if I took those and somebody said oh well this came from a compact then I can throw that in you FS explorer and use the same thing use youth is just DD images still you just need a different program to process those or if it’s the MoMA Buffalo Terre station I cannot do it with X at least this is not support XFS so this will not do a buffalo terror station I have to use ufs explorer to do that you have no problem do it all the time someone that we well like I said there’s a couple other ways to do it which are actually look at it in hex and then break the segment’s down and then try to figure out from the space of the segments and that’s what the class from Hoffman Hoffman cuz Hoffman in the Netherlands they have a class where they actually have and they have a script they wrote you know I’m talking about Hoffman Hoffman’s investigation company they’re kind of like a PI firm or whatever you want to call it in the Netherlands and they actually have like other operations in other countries too but they teach a class on how to actually take the segment’s and then actually you know look for the segments and the break in the segment and the buffer in the segment from one segment to another and then calculate the space between the buffers to figure out if it’s 32 K or 64 K and our Studios wrote a similar white paper on it yeah and it’s yeah but it takes a lot of time doesn’t it right right right in this case usually in under 45 minutes I can look at a picture and I can figure out why my closer I’m not glows give it right yeah yeah I like this method most of Tom like I said it’s not perfect every time but the majority of the time I can do it and I’ve done this for like a movie studios and other stuff like that before they’ve done target files and the Machine died in the process writing these things out from an SGI machine and things like that and I’ve done hundreds at this point that are very similar most of the time on most of the lower end raid arrays no but from time to time you know like some of those that raid arrays that write a segment at the beginning that has a counter this says i’m dr 1 i am dr to i am dr 3 like a park controller does you have to set the offset to get past that so if you have a perk controller then you have to and it’s probably 128 this Mabi 128k and so you just set your segments for 128 K and that’s your offset and then the drive will show up all right okay look look at him are and try to figure it out their layouts or something our studio has it on the right hand side see that where it says offset inside yeah that yeah how do I know what it is yeah well you know what you’re doing in hex when you go and you look for your segment okay so you go down for your partition structure and you find the beginning of the MBR and your partition structure the count from there back in most cases is your number yeah so if it’s like a part controller you’ll see it at like 128 K into the drive but you like I said you can also maybe just Google or your controller if you know what it is then there will be a document somewhere that will tell you like you can actually find it in many cases that people have done it but if I want to look at it in hacks I can actually just highlight from the segment from the MBR yes to the beginning of the drive save it and they’ll say 64 K or 128 K so I just highlight the segment that I want just like I just did there when I was doing the picture like this says that it’s 14 K so if I had just highlighted this segment from beginning of the MBR back to the beginning of the first drive if I find the MBR because I have to have to find whatever the beginning my partition structure is so I’ve got a look at my drives fill up on the NTFS signature and then go back to the MBR and then go back from there so I just highlight from there to the game of the drive and save it and if it’s 64 K because it should be one of those boundaries it should not be some arbitrary weird thing it should be 64 128 or 256 or you know in some cases there are some that have like a well like configuration files like sometimes like Lacey URI makes a segment for their Linux configuration files and they write just like a 200 Meg partition at the beginning and store the data there and then they offset the second drive to that amount that’s what most you

RAID Recovery: Have A Good Backup Strategy Because You Are Out Of Luck

raid array recovery user writes in and asks i had a raid 0 fail and i lost all my data how do i recover it you don’t tough sucks to be you I’m sorry but it does the problem is running something like raid 0 is that your striping your data across several drives and your drive failure rate is basically stacked across to them if you have drives that are going to experience a 1-percent failure rate every thousand hours and you have five of those drives you have a 15-percent I think it doesn’t it doesn’t add it multiplies but closer to ten percent in that mean time between failure and a thousand hours is of course a legit a hugely small number that isn’t realistic but the mean time between failure on most drives is in the like million hours but that’s the average failure rate like meantime like if you took all of our devices and you averaged how long they run they’re going to be at that million hours when you start looking at how many of them have failed in the first thousand hours the first million a hundred thousand hours the first two hundred thousand hours those numbers really start to scale when you’re talking about something like four drives running in raid 0 now if your raid running in raid1 mirroring drive failures no big deal you didn’t lose anything you have one device that still works you can recover that data when you’re running in raid 5 and you have multiple drives with onedrive for parity then you can lose any one of those drives and it will rebuild the array as long as none of the other drives fail during the the rebuild if it does fail during the rebuild that’s when you really start to have problems the problem with raid recovery is the raid system is pretty much tied to the controller and every controller has a separate raid recovery system so if you’re running a Seagate controller you have different things than if you’re running an adaptec controller which is going to have different solutions than if you’re running some other enclosure or controller and if you’re running an external enclosure you may have no recovery option depending on what the enclosure was running for software so the best answer to how do you recover from raid failure or how do you recover rated data is you don’t you just make sure you don’t fail and that you built your e strategy that says that you’ll either have backups or that you will never have too many drives fail at once and you keep that data safe if you don’t care enough about your data to worry about it because you’re just trying to make your games run faster no big deal you just reinstall them over the top if on the other hand you’re backing up the data of every user in your organization you may want to do some sort of offline backup in addition to just having the data rated so have a good strategy for your data storage raid is a great solution but every performance increase that you take with raid comes at an increase in the risk of data loss and so you have to pick your risk to reward settings