Dell T320 Server and RAID question

[Big Jim]

Had a new customer drop off their Dell Server to me today.
It has 2 600GB 15k 3.5" drives in it.

They tell me around 4/5 months ago 1 of the drives showed an error so they replaced it (without doing anything in the OS) and it ran fine.

Then they came in one morning and it had stopped working.
When it was dropped off to me it is showing no boot device and as far as I can tell someone has set both of the drives up in RAID 0 now.
All I can see when I boot into Hirens is a raw 1.2TB disk.
and when I go into the BIOS for the controller it is showing a RAID0 virtual drive and both drives are allocated to it.
On the front of the machine the 2 caddies both show the flashing activity light but only one has the permanent light on (I assume this means online), however in the BIOS both drives show online.
The system can see the raid controller card and lets me select "C:" as a boot drive, it just doesn't do anything. (boot device missing)

I assume this means the person that has been messing with it has wiped all data.
Is this easily recoverable ?
Is there something obvious I might be missing.

User would like a single file from the machine if possible but its not absolutely critical and I have the go ahead to reinstall the OS (Windows 8)
so no DHCP or AD to deal with.

 

[Mick]

What a mess. Sounds as though the RAID set-up was put in place after the faulty disk was changed. Any chance of getting hold of this 'someone' and asking them what exactly they did? Setting up any form of RAID is just not something I'd expect any normal end-user to have a clue about, so it must have been someone who had at least a vague idea about these matters. From what you've said, I'm guessing that the drives show up as empty when you take a look at them in a Windows PE (i.e. the missing file/s is/are not there) ? If so, scoop them into a bay and see what's recoverable, if anything. But stuff like this doesn't just happen. Someone must have wiped them. On a side note - you'll do them no favours by re-installing Win 8, even if you can. If they're just using it as a file server (again, I'm guessing from what you said ), then this might be the moment to suggest a NAS.

 

[Big Jim]

What a mess. Sounds as though the RAID set-up was put in place after the faulty disk was changed. Any chance of getting hold of this 'someone' and asking them what exactly they did? Setting up any form of RAID is just not something I'd expect any normal end-user to have a clue about, so it must have been someone who had at least a vague idea about these matters. From what you've said, I'm guessing that the drives show up as empty when you take a look at them in a Windows PE (i.e. the missing file/s is/are not there) ? If so, scoop them into a bay and see what's recoverable, if anything. But stuff like this doesn't just happen. Someone must have wiped them. On a side note - you'll do them no favours by re-installing Win 8, even if you can. If they're just using it as a file server (again, I'm guessing from what you said ), then this might be the moment to suggest a NAS.

They literally use it for sharing a single DB file, I have said to them its massively overkill for the usage, and he umm'ed and arr'ed about just using one of the 7 desktop machines to share the file instead.

In the end as the server is 10 years old its pretty much worthless, he likes the idea of the redundancy it provides (again I pointed out that it is 10 years old so can no longer be considered reliable)

I know it shouldn't have W8 on it but he doesn't want a server license and so very unlikely he would spend the money on a NAS either (which again is overkill in this situation TBH), so it seems we either move the file to one of the desktops or just stick W10 on this machine and at least it will be running RAID-1 when I have finished.

I think its fairly obvious that the guy that has been messing with it doesn't really know what he is doing, he set this up for them 10 years ago in a rush and they never got round to sorting it out properly, a drive died 4/5 months ago and they replaced it, and then it just didn't boot one morning and now this guy has had a play with it and its just showing no boot device.
I can't imagine speaking to the guy who has already worked on it will yield much in the way of sense, as it must have clearly been running either RAID 1 or single disks before, and now it is configured as RAID 0, anyone that has any clue about what they are doing wouldn't have done this.

In terms of what the OS sees in Windows PE, yes just a raw 1.2TB disk (the disks are 600Gb each).

this thread is more about whether the data is likely recoverable once a new virtual disk has been configured.
I can easily pull the drive and put it in our bench machine but I didn't want to do that before just double checking that there isn't something else I can do and end up jeopardising my chances of data recovery if there is any.

As soon as i mentioned sending for data recovery, the business owner said no its not *that* important it would just be nice to recover the file in question.

 

[YeOldeStonecat]

It doesn't make sense that...:
*It was running
*It blew a disk...and kept running. This means it was not running RAID 0 originally....but likely...RAID 1, or...no RAID at all, just a pair of disks, such as C, and D.
*If it was running no RAID, or RAID 1....and you remove a drive, replace it, you can't convert it to RAID 0 without being destructive. I've never looked (because I have zero interest in RAID 0 on a server...or any computer for that matter)...but I'm pretty sure there's no "in place migration" from non RAID to RAID 0, or RAID 1 to RAID 0...it has to be destructive...wipes the drives, formats, presents a new single volume to install the OS on or restore an image to.

Now, for broken RAID arrays, there are data recovery companies that have the tools needed to recover data. You can even buy the tools to do this, but...better just to have a drive recovery place do this. You can have a broken RAID and use a minimum set of drives and they can often recover data. Depending on things.

You'll want the original pair of drives. Likely the "newer" drive isn't worth anything...but send it too, just in case, since we're only guessing at what happened.

 

[nlinecomputers]

Now, for broken RAID arrays, there are data recovery companies that have the tools needed to recover data. You can even buy the tools to do this, but...better just to have a drive recovery place do this. You can have a broken RAID and use a minimum set of drives and they can often recover data. Depending on things.

This. How it got there is irrelevant if you want the data back, if possible, it’s time to turn it over to a data recovery company. If they have a backup then just scrag the unit and replace with a new server.

 

[Big Jim]

There is no point suggesting replacing the Server or data recovery, client has already told me it isn't worth the expense.

update on situation though, I slaved the drives into our bench machine, 1 is empty, the other clearly has a windows install on it with all users files/data intact. single partition (no efi or boot sector partitions)

I have connected this drive back to its original host and checked the raid controller, it is showing a single RAID 0 disk as missing, and the drive I have is just showing as foreign with no option to import it, no other RAID drives or VDs are available.

so looks like the previous guy possibly started to convert it to RAID 0 but it didn't complete or something.
I am confused, There is no RAID1 VD to import and system is showing no available boot devices.
Drive doesn't even show in Windows RE environment.

 

[nlinecomputers]

There is no point suggesting replacing the Server or data recovery, client has already told me it isn't worth the expense.

update on situation though, I slaved the drives into our bench machine, 1 is empty, the other clearly has a windows install on it with all users files/data intact. single partition (no efi or boot sector partitions)

I have connected this drive back to its original host and checked the raid controller, it is showing a single RAID 0 disk as missing, and the drive I have is just showing as foreign with no option to import it, no other RAID drives or VDs are available.

so looks like the previous guy possibly started to convert it to RAID 0 but it didn't complete or something.
I am confused, There is no RAID1 VD to import and system is showing no available boot devices.
Drive doesn't even show in Windows RE environment.

Sounds like it was RAID 1 and something broke the mirror and someone tried to reset it up again and selected RAID 0 by mistake. It wiped out the previous configuration. If you can see directory and files then grab the data if you can and call it a win. Somebody else most likely touched it before you did and made the problem worse.

 

[Big Jim]

Sounds like it was RAID 1 and something broke the mirror and someone tried to reset it up again and selected RAID 0 by mistake. It wiped out the previous configuration. If you can see directory and files then grab the data if you can and call it a win. Somebody else most likely touched it before you did and made the problem worse.

I've created an image of the drive with files on.
If I try and recreate the RAID 1 on the server itself it warns that it will delete all data.

I know for sure someone touched it before me, the customer told me that they had.

i don't understand how he could have created a RAID 0 drive with destroying the existing data on it though.

The drive in slot 1 has "original drive 1" written on it.
however the drive in slot 1 has mfr date in 2017, whereas the drive with data on it has mfr date 2012
so I don't even know if he was swapping drives around and got them mixed up, or if the 2nd drive they bought was a used one and that was already written on it.


Out of interest how much do you guys charge over your normal service rate for working on servers ?

 

[nlinecomputers]

i don't understand how he could have created a RAID 0 drive with destroying the existing data on it though.

Cuz people are stupid??? You're new here aren't you?

 

[nlinecomputers]

mfr date in 2017

Just because it has that date doesn't mean it is not new. It's just sat in a wearhouse for a while.

 

[Big Jim]

Cuz people are stupid??? You're new here aren't you?

Being stupid doesnt explain why the data is still in tact, being stupid only explains that he selected the wrong type of RAID drive

Just because it has that date doesn't mean it is not new. It's just sat in a wearhouse for a while.

The point being that the newer of the 2 drives said original disk 1 on it.

 

[Sky-Knight]

The back story while interesting is irrelevant, you have data from the disk. Image that off, and either nuke the platform to configure it correctly, or scrap the unit.

You'll never know what the specific stupid was, because no one that mucked with it will admit to it.

 

[nlinecomputers]

Possible that the stupid person made a RAID 0 containing one drive, the other drive being marked as a member of the RAID 1 array.

 

[nlinecomputers]

If it’s a hardware controller then if you reset the controller to default with no drive attached and then boot with only the good drive the controller may read the configuration and boot up as a broken mirror RAID 1. The likely mistake the previous user/tech? did was trying to setup a new array instead of rebuilding the array with a new blank drive to replace the dropped drive.

 

[Porthos]

There is no point suggesting replacing the Server or data recovery, client has already told me it isn't worth the expense.

That says everything about the client that most need to know.

 

[Big Jim]

That says everything about the client that most need to know.

I agree, however in this case, the usage they have for the server, I really don't see the value in spending lots of money either.
They literally use this machine to share a couple of DB files for a garage software that they use.

If it was going to get silly expensive I would just tell them to put the files on one of the office desktops (that also never get switched off by the way)

If it was an AD machine and performing other functions I would agree with everyone in here and start getting them to look at replacement options.

Update on situation
bearing in mind I have a full disk image.
I recreated a RAID-1 array and the data was still showing on the disk, so I tried to repair the windows install but it was still complaining about boot configuration files.
Currently reinstalling a clean copy of W8, last option to restore just the windows partition to the newly installed W8 and see if the new boot config files will allow the system to boot, if that doesn't work I will just leave the clean install on there and put all of the data on the desktop for him to sort out.

 

[labtech]

On the drive containing "the important file", were you able to find it and recover it?
If so, then the file recovery job is done.

If not, then more in depth digging is necessary.

For logical situations, where the drives are fine (or have created images, even better), many of us in data recovery could help remotely without breaking the bank. No need to ship anything. Just connect the drives to the system and give us remote access for a diagnosis with AnyDesk or TeamViewer.

 

[Big Jim]

I've fixed it!!

solution:
took image of drive with macrium
reconfigured RAID1
installed new copy of W8.1
overwritten new W8.1 windows partition with "broken" windows partition
Used Macrium boot drive to "repair windows boot"

all working again now, nothing lost (as far as I know)

 

[nlinecomputers]

I hope you replaced both drives with new ones. Obviously this unit has has two drive drops in the past few months and possibly one back in 2017 as well As I’m guessing that other techs have just repaired the mirror and reused the drives that dropped.

I usually replace both drives when a mirror drops.