raid recovery simple stripe

[pcpete]

I have a client who had a dell with a simple striped array. One of the drives was bad. We cloned both drives. The failing drive had a pretty good recovery(clone). I plugged them both into rstudio and created a virtual raid, then dragged the two drives into the array. If it found the partitions; is it safe to assume the default raid settings were correct? The reason I ask is when I scan the found partition it is not recreating all of the user accounts properly as the client said were there, also a fair amount of the files are corrupt. Of course this could be because of a slightly incomplete clone. I mainly was wondering if the issue might be my inexperience with using rstudio to create a virutal raid. Any suggestions would be appreciated.

 

[lcoughey]

1. When you say "pretty good recovery(clone)", how much unread does that mean?
2. Are there any read errors associated with the MFT?
3. What happens when you try other block sizes?

 

[pcpete]

the first half or the damaged drive is perfect, so I am guessing that means a complete MFT. The center of the drive had just a few unread MBs.

I think it was user error. I was trying to gather the information you wanted and I noticed something: I was not hitting apply after changing block size. After changing it to 128 block size it seems to be the correct one. I am now getting all of the needed information.

What surprises me the most was with the slice size set wrong it was able to recover anything.

Is there a preferred method to get slice/block size?

Thanks for helping me work through this!

 

[lcoughey]

The MFT likely was scrambled, but not enough for you to notice when reading with R-Studio. But, it would definitely mess up the files being recovered.

 

[pcpete]

That makes sense. I got lucky when I checked a few small word files, which were probably not affected by the improper slice information, but anything larger, would have been corrupted. Every file of the near 900gb I have checked has been pristine(with the proper block size set).