data recovery nas

[Kaizen]

We are currently working a data recovery from a single drive from a NAS. Our procedure is first to make a hardware image, then use rstudio to recreate the file system structure. When rstudio does a full scan of the drive it is finding lots of bits but it is not able to reconstruct it to anything useful. We had a similar issue with a different nas drive in the past. I suspect the problem is our lack of experience. This particular drive has 3 partitions. the first is 23mb, the second is about 4gb(it hold a linux operating system) and the third data partition is 927gb. Could this be an issue with encryption? is encryption common on NAS drives? Any suggestions would be helpful.

extra info: the image had all but 102 sectors recovered.

One thought just came to mind, I will hook the imaged drive back to the controller to see if it will decrypt it properly

Could it be as simple as mounting with my Linux desktop. I would think if it was that easy rstudio would have no issues with it.

Got a few things to try tomorrow

 

[ohio_grad_06]

Wonder what would happen if you used ddrescue to copy the contents of your drive that was failing to a new one, and then place the new one in the nas to see if it boots. Might be best to have a drive same make, model and size of the original. I'm just learning more about ddrescue myself, but used it this weekend to directly copy the contents of one drive to another. Just thinking if you could do that here to a drive similar to what was there could you fool your device into working as before?

 

[Kaizen]

Wonder what would happen if you used ddrescue to copy the contents of your drive that was failing to a new one, and then place the new one in the nas to see if it boots. Might be best to have a drive same make, model and size of the original. I'm just learning more about ddrescue myself, but used it this weekend to directly copy the contents of one drive to another. Just thinking if you could do that here to a drive similar to what was there could you fool your device into working as before?

That is one thing we will try when I get back to the shop. Instead of using ddrescue, I used a hardware disk Imager called a "Deepspar Disk Imager". This does what ddrescue does but in a much superior way.

 

[Markverhyden]

Nothing personal but not much information here.

1. If the client places any real monetary value on the data stop what you are doing and get in touch with someone like 300ddr or lcoughy.

2. If they do not care and this is just an exercise to see what you can get then you first need to make an entire image using something like that will ignore bad blocks.

3. Make and model? You might as well say I have a car and I want it to run. Cars can range from a Trabant to a Koenigsegg. So do NAS.

4. Symptoms? Encrypted? The list can go on for pages.

 

[Kaizen]

Nothing personal but not much information here.

1. If the client places any real monetary value on the data stop what you are doing and get in touch with someone like 300ddr or lcoughy.

2. If they do not care and this is just an exercise to see what you can get then you first need to make an entire image using something like that will ignore bad blocks.

3. Make and model? You might as well say I have a car and I want it to run. Cars can range from a Trabant to a Koenigsegg. So do NAS.

4. Symptoms? Encrypted? The list can go on for pages.

I made a clean image of the drive(mentioned above), I am only recovering from the image. virtually no risk to the client.

I was looking for some basic direction. I was hoping poeple who have done this often may have had a quick suggestion. I started the post at home. I did not have all the information, like drive model. I was hoping to have a game plan in the morning, it was time sensitive. It is model MHNDHD. When I list the partitions in linux, it only shows two of three of them. with one listed as AHDI. If I get more informaiton I will update the post. Thanks

 

[Larry Sabo]

I think you would receive more and more-informed help by posting in the HDDGuru, HDD Oracle or Data Recovery Certification forums, once you get more details to share about the NAS. Personally, I know next to nothing about NASes so have no other suggestions to offer.

 

[ohio_grad_06]

I can't say I know everything about NAS devices, but I know ones I've replaced drives on before can be picky about size and what not, which I why I said you might be able to get away with copying to a drive that is like what was there and maybe it will fool the NAS into working.

Just was guessing at the time. I do agree though data recovery places can do more than we can, but if you already have the image and aren't hitting the original drive would think you'd be safe.

 

[Kaizen]

I think you would receive more and more-informed help by posting in the HDDGuru, HDD Oracle or Data Recovery Certification forums, once you get more details to share about the NAS. Personally, I know next to nothing about NASes so have no other suggestions to offer.

I was doing a bit of reading over there. I did not want to post anything there until I did more homework. People there are less forgiving.

I will admit, my post was lacking in detail. I was hoping there might have been a quick fix suggestion. It does not hurt to ask

 

[Kaizen]

I think I am on to a solution. the data partition I believe is XFS, which rstudio does not support(linux does). But after further investigation my image may be corrupt.

 

[SilverLeaf]

I think I am on to a solution. the data partition I believe is XFS, which rstudio does not support(linux does). But after further investigation my image may be corrupt.

One of the problems with many NAS's when it comes to data recovery is the fact that they use file systems that are not supported by the data recovery tools. You may have some success in mounting the image from a linux box that has XFS support. If you really want to be safe, work with a copy of the image.

 

[lcoughey]

I think I am on to a solution. the data partition I believe is XFS, which rstudio does not support(linux does). But after further investigation my image may be corrupt.

Why do you think that the clone is corrupt? I take it that this data isn't very important to your client...at least in the sense that they need it ASAP.

 

[Kaizen]

Why do you think that the clone is corrupt? I take it that this data isn't very important to your client...at least in the sense that they need it ASAP.

Just for testing, I plugged in the original drive in my linux system to see if it would read the partition table, it did read it using cfdisk. It also listed the xfs partition. I unplugged the drive at that point to reevaluate. When I plug in the cloned drive cfdisk does not read the partition table. also my image drive has started randomly beeping(could that happen when it looses power temporarily)

 

[Kaizen]

I made a new image and it mounted perfectly in linux. I am copying the data off as I type. I suspect it should be a good recovery with all but 101 sectors recovered out of a 1tb drive.

Two things came to mind. First I think the original clone drive may be bad. Secondly, the issue with cfdisk not reading it was my fault. I had previously disabled the mbr before plugging it into a Windows machine to prevent corruption. Before trying to mount it in linux, I forgot to re-enable it.