Data Loss on RAID-1 - How do I recover?

rezilient1

Junior Member
Feb 25, 2008
23
0
0
Hi there.

I have a P5K-E mobo which has the ICH9R raid controller.

My boot drive is a Raptor 150gb, but for data I have two SATA WD 320gb drives in RAID-1 and it has been running fine; until yesterday.

- when I came home from work and turned on my screen (my desktop is always on), i was looking at a BSOD that I hadn't seen before... it said something about "HARDWARE CHECK EXCEPTION"... searches online lead me to believe there is an underlying hardware problem on my machine

- it began to boot up, but i was surprised it asked to run a CHKDSK on my E: drive (RAID) which isn't the boot volume and typically I wouldn't expect that unless my array puked on me... I allowed the CHKDSK to continue.... the CHKDSK ran pretty fast but I did see the word "DELETED..." a bunch of times which concerned me.

- when the machine finally booted up I checked the volume and sure enough there was DATA missing (lots of it)... clicking some of the folders resulted in "access denied" message, or something like that

- when I checked windows disk management i was surprised to see TWO disks with 320GB instead of just the one RAID array disk... one was showing the correct volume label and mounted to E:, the other was not active and looked like unpartitioned space (i believe)

- system log had hundreds of the following errors:

The driver detected a controller error on \Device\Harddisk2. (this is how it began)

The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume RAID300. (then millions of these started occurring)

- i rebooted the machine and entered to BIOS... the SATA configuration had changed from RAID to IDE... somehow the RAID broke ... I changed it back to RAID and rebooted

- when I went back in to Windows I can now see the single RAID array in disk management, I'm not getting access denied errors when I click folders, but there is a LOT of data missing.

- one more interesting thing, in My Computer it says free space 134GB... if I recall, this is how much free space was left WITH all my original content... BUT when I add up all the "visible" files and folder on the drive it only adds up to ~70GB... SO in that case the true free space would be more like ~230GB... So I'm hopeful that my data is still in there, somewhere, hopefully with all the same file/folder structure too.

No I don't have any backups, it was a "work in progress" and I never completed a backup of the array. :(

So where do I go from here? How do I recover this lost data?

If this is just 1 bad disk, can I disconnect a single disk and see the missing data?
 

Keitero

Golden Member
Jun 28, 2004
1,890
0
0
Since it's RAID1, you should be able to disconnect one drive and see it as a single volume. If one drive doesn't work, try the other. Chances are slim if both drives are bad. If you have access to another computer, you should be able to connect the drive to another computer and access the data.
 

rezilient1

Junior Member
Feb 25, 2008
23
0
0
But would the "data loss" (or missing data) situation replicate to the other good drive since its mirrored?

I'm at work right now, I'll try what you said when I get home.
 

taltamir

Lifer
Mar 21, 2004
13,576
6
76
the data loss MIGHT replicate if you KEEP them connected. Not if you seperate them... take both drives out of the machine, find what is broken, fix it, then put the drives back in one at a time.
I read sometimes about checkdisk destroying data on raid arrays (it deletes "corrupt data" which is actually raid stuff), but i haven't heard of it happening in raid1, only raid5 and the like.
 

rezilient1

Junior Member
Feb 25, 2008
23
0
0
I think it might be too late. :(

After the initial failure the RAID array broke. Now I'm thinking that was actually a safety feature, to avoid data loss to replicate...?? I joined the array back and booted in to Windows already, last night. I think I'm screwed.

If the data has replicated (I am betting it has) what should I do to recover the data? I have access to Ontrack EasyRecovery Pro through work, anyone use that before?
 

Keitero

Golden Member
Jun 28, 2004
1,890
0
0
It's a long shot, but worth a try. I've seen Ontrack to some amazing things.
 

RebateMonger

Elite Member
Dec 24, 2005
11,586
0
0
As previously noted, most RAID 1 arrays allow you to attach the single drives to another PC and read the data on them. And, yeah, in RAID 1, data errors on one drive are duplicated to the other drive.

I'd:
* Mark which drive is attached to which cable on the current PC

* Install the trial version of data recovery software on the other PC. I generally use GetDataBack (runtime.org) or DART (DTI Data Recovery).

* Remove a drive and attach it to another PC as a secondary drive (direct attach via SATA or IDE or through a USB adapter)

* Run the data recovery software on the attached drive. This type of software is supposed to be "Read-Only" and isn't supposed to write to the attached drive. If the drive shows signs of mechanical failure, consider making an image backup and doing the recovery using the image rather than the physical drive. GetDataBack will make an image backup as an option.

* Repeat using the other RAIDed drive if necesary.

*If this doesn't give you the results you need, consider using a reputable data recovery company. The good ones have a high success rate.

* Don't trust a single drive or RAID array with your one copy of important data. All drives fail and redundant RAID arrays can become corrupted.
 

rezilient1

Junior Member
Feb 25, 2008
23
0
0
Thanks, I appreciate all the advice.

RebateMonger: Can those steps be performed on the same machine the drives are currently hooked up to? Its just a data array (not primary), so I'm not trying to boot from it. So can I just hook up 1 drive at a time and turn off RAID within the bios.
 

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
- when I came home from work and turned on my screen (my desktop is always on), i was looking at a BSOD that I hadn't seen before... it said something about "HARDWARE CHECK EXCEPTION"... searches online lead me to believe there is an underlying hardware problem on my machine

Yea, that's generally a low level problem like CPU, memory, heat, etc.

- it began to boot up, but i was surprised it asked to run a CHKDSK on my E: drive (RAID) which isn't the boot volume and typically I wouldn't expect that unless my array puked on me... I allowed the CHKDSK to continue.... the CHKDSK ran pretty fast but I did see the word "DELETED..." a bunch of times which concerned me.

That will happen any time the volume isn't unmounted cleanly. So anytime the machine doesn't shutdown properly and there's dirty pages for that volume it should run chkdsk.

- when I checked windows disk management i was surprised to see TWO disks with 320GB instead of just the one RAID array disk... one was showing the correct volume label and mounted to E:, the other was not active and looked like unpartitioned space (i believe)

That shouldn't happen unless the RAID controller did something very bad. Either that or data got corrupted being written to disk which could also be caused by heat, memory, etc.

- one more interesting thing, in My Computer it says free space 134GB... if I recall, this is how much free space was left WITH all my original content... BUT when I add up all the "visible" files and folder on the drive it only adds up to ~70GB... SO in that case the true free space would be more like ~230GB... So I'm hopeful that my data is still in there, somewhere, hopefully with all the same file/folder structure too.

It probably is and if you're lucky the filenames will still be in the MFT. But if not you might have to sift through and rename all of it.

If this is just 1 bad disk, can I disconnect a single disk and see the missing data?

That shouldn't work since it's a mirror, essentially everything you do applies to both drives.

After the initial failure the RAID array broke. Now I'm thinking that was actually a safety feature, to avoid data loss to replicate...?? I joined the array back and booted in to Windows already, last night. I think I'm screwed.

I doubt it, I don't know if any RAID controllers smart enough to differentiate between good and bad bits.

RebateMonger: Can those steps be performed on the same machine the drives are currently hooked up to? Its just a data array (not primary), so I'm not trying to boot from it. So can I just hook up 1 drive at a time and turn off RAID within the bios.

As long as you don't write to the drive. Every write to that drive potentially overwrites your data that the OS thinks is gone.
 

taltamir

Lifer
Mar 21, 2004
13,576
6
76
frankly the fact you even got a problem indicates to me that there is something really really wrong with the original machine. most likely in the hardware level.
So that is not the place i would be doing recovery work.
 
Nov 26, 2005
15,181
396
126
I have the same motherboard. Same Raptor boot drive and 1 storage drive mirrored to a RAID 0 setup that is only on when I decided to turn off the computer, plug in the power cord and reboot, then the storage drive mirrors the RAID 0 setup. The RAID 0 setup is ran off an add i card. The Rosewill RC 209. Are you using the Jmicron chipset with the extrenal ports for your RAID or are all your drives (boot & RAID) off the ICH9R controller???