Data recovery. Worth it? Resources?

Discussion in 'Networking' started by Oyeve, Nov 29, 2012.

  1. Oyeve

    Oyeve Lifer

    Joined:
    Oct 18, 1999
    Messages:
    19,556
    Likes Received:
    72
    So, my companies 2003 exchange servers raid totally died. New server is being built with exchange 2010 and I have everyones OST converted to PST so emails have been recovered. All except my boss who's father recently passed away and he has some emails he would like to have that for whatever reason were not in his OST. So, I have 3 HDs from the old server that was in a raid 5 config. The HD drive zero AND the hot spare both crapped out so their went the system. Anyhow, I would like to know if it is even possible to recover data (actually, Im pretty sure it is) but I havent used a professional recovery service in years. Anyone know of a reputable resource? totaly data is roughly 70GB.
     
  2. Loading...

    Similar Threads - Data recovery Worth Forum Date
    Netgear & Asus adds & enables code that collects data & phones home. Networking Monday at 7:41 PM
    WAN MAC address using large amount of data Networking Apr 10, 2017
    Can anything be done about data caps? Networking Mar 31, 2017
    Data port to IP phone Port? Networking Nov 17, 2016
    Business continuity vs Disaster recovery Networking May 21, 2012

  3. imagoon

    imagoon Diamond Member

    Joined:
    Feb 19, 2003
    Messages:
    5,199
    Likes Received:
    0
    Honestly only your company can decide that. The cost depends on what really broke. I could easily see it costing in excess of $2000 / drive.
     
  4. JerYnkFan

    JerYnkFan Member

    Joined:
    Apr 18, 2006
    Messages:
    152
    Likes Received:
    0
    The company needs to decide if the data is worth the cost. If you do want to move forward with it, I've used/recommended this person several times and he does really quality work for an excellent price:

    http://www.datarecoverynj.com/
     
  5. Oyeve

    Oyeve Lifer

    Joined:
    Oct 18, 1999
    Messages:
    19,556
    Likes Received:
    72
    A few grand is worth it. I just need a company to come thru. The email was a VM so if the VM file could be restored thats all I really need.
     
  6. drebo

    drebo Diamond Member

    Joined:
    Feb 24, 2006
    Messages:
    7,043
    Likes Received:
    1
    The biggest problem you're going to have is that the email server was in a VM, which means that it's not individual files, but rather one monolithic file. That means that it's extremely unlikely you'll get it back if there's any physical damage to the drive platters or any corruption in the actual data. Basically, you need the entire contents of the drive array to be viable in order to access the contents of the VM. A lot of times, just the control board on the drive fails and the drive can be restored by replacing that with another board of the same model and revision. If that's the case, recovery should be relatively straight forward.

    www.gillware.com is one that we use. Their prices are very reasonable, and they'll usually perform an initial inspection for free. I don't know what their prices are for VMWare file systems or RAID 5, though.
     
  7. rsutoratosu

    rsutoratosu Platinum Member

    Joined:
    Feb 18, 2011
    Messages:
    2,545
    Likes Received:
    1
    lots of lingos here, by VM do you mean a email of Voice mail or the email was on a vmware server..

    either way its a lot of work. the email was exchange jet format, you basically need to restore those edb, check for errors, and either build another 2003 exchange server with same info and mount the edb files

    i remember 2003 restore is a bit tough, you can actually get ebd parsers so you wont need to build a whole server just to read the file

    http://www.appassure.com/server-bac...overy/recover-emails/exchange-email-recovery/
    i would use that if you can get your edb back
     
  8. IndyColtsFan

    IndyColtsFan Lifer

    Joined:
    Sep 22, 2007
    Messages:
    32,364
    Likes Received:
    100
    Are you sure that the controller isn't just dead? Are you sure the drives are dead? Also, one drive and a hot spare dying shouldn't trash a RAID5 array.
     
    #7 IndyColtsFan, Nov 30, 2012
    Last edited: Nov 30, 2012
  9. sync_master

    sync_master Junior Member

    Joined:
    Nov 27, 2012
    Messages:
    2
    Likes Received:
    0
    Try Kernel for OST to PST converter, it is the best software.
     
  10. drebo

    drebo Diamond Member

    Joined:
    Feb 24, 2006
    Messages:
    7,043
    Likes Received:
    1
    It's only 3 drives in a RAID 5. No hotspare. 2 dead drives = dead array.
     
  11. Oyeve

    Oyeve Lifer

    Joined:
    Oct 18, 1999
    Messages:
    19,556
    Likes Received:
    72
    True dat. I took the 3 drives out and ran easeUS on them. Drive 0 is wiped, drive 1 has the correct partitions and drive 2 has the correct partitions. When the system took a dump drive 2 was yellow (indicating a bad drive) and drive 0 was blinking yellow-green intermittently. The fact that EaseUS sees the partitions and data on drive 1 and 2 (2 was the hot spare) makes me feel hopeful the data can be recovered. I was considering putting drives 1 and 2 back into the server to see if it boots.
     
  12. imagoon

    imagoon Diamond Member

    Joined:
    Feb 19, 2003
    Messages:
    5,199
    Likes Received:
    0
    RAID 5 wouldn't show "partitions." You might be able to slam them back in to the controller and get them to come up in a degraded state. If you do, get them online and start copying the VM's off.
     
  13. Oyeve

    Oyeve Lifer

    Joined:
    Oct 18, 1999
    Messages:
    19,556
    Likes Received:
    72
    It appears drive 0 was set for raid 1 and drives 1 and 2 raid 5. Running EaseUS show much data on drives 1 and 2 and nothing on drive 0. I didnt mean partitions in the logical sense, I meant partitions as to where I had the exchange database set. When all was working I created a drive Z: for the information store. Drive c: was win2ksvr. Oh well, new 2010 server will be installed tomorrow. Hopefully my new exchange server will be up by monday and then i can worry about retrieving the dead systems VMs.
     
  14. dawks

    dawks Diamond Member

    Joined:
    Oct 9, 1999
    Messages:
    5,059
    Likes Received:
    2
    This is pretty confusing but one thing is certain, data recovery on harddisks that were in a hardware based raid are extremely difficult to recover any data from. Almost impossible in fact, unless you use the same model raid card that created the array afaik (since each raid controller often has its own method of writing data to a disk).
    Ensure any thing you do these drives is read only. changing even a few bits will likely *** the entire array.
    If you had 3 disks in the raid 5 array, and only 1 was damaged, you'd be ok restoring the data with the same model array controller. If you only had 2 disks in the raid 5 array, and one was damaged, you're screwed.

    As mentioned in the previous thread, you're best bet (based on your scenario) is going to a hosted solution, you could be up and running in 1-3 days. Trying to get a new Exchange server online is going to take several days of configuration and testing just to get something working, which likely wont be exactly what you want and you'll have to start over. Exchange 2010 is a very complex server (to get configured properly), even for those with some exchange experience.
    At the least you could go to hosted exchange for a few months while you play with, learn, and configure your exchange server in the background. With Microsoft Office 365, you can actually run both their cloud hosting, and an on-site exchange server, having some accounts locally, and some in the cloud.

    You can also use a service like mailroute, which, in a case like this, would actually hold your email until you have a server back online, at which point it would release all your messages to the server.

    If just the harddrives are having difficulty, you might be able to restore their functionality with spinrite. The program works on individual drive sectors and doesnt give a shit about the type of the actual data (ie file systems, formats, raids).
     
  15. cmetz

    cmetz Platinum Member

    Joined:
    Nov 13, 2001
    Messages:
    2,296
    Likes Received:
    0
    Oyeve, just to be clear, you have THREE total drives, and TWO of them have failed. (in RAID 5, the array itself does not have such a thing as a "spare" drive because the parity is rolling, but many hardware controllers let you build an array PLUS have a spare drive assigned so that if the controller kicks out a drive it will auto-rebuild onto the spare)

    In this case, you will need professional data recovery, because they're going to need to find a way to resurrect one of those two failed drives, otherwise no data is getting recovered. With RAID 5 and only one drive, it's technically possible to pick out chunks of data by hand, but that's extremely labor intensive and you get what you get.

    dawks,

    >since each raid controller often has its own method of writing data to a disk).

    Not with a modern, quality controller. SNIA DDF FTW.

    >If just the harddrives are having difficulty, you might be able to restore their functionality with spinrite.

    spinrite bad. spinrite *baaaaad*.
     
  16. IndyColtsFan

    IndyColtsFan Lifer

    Joined:
    Sep 22, 2007
    Messages:
    32,364
    Likes Received:
    100
    I understand that, but he specifically said one drive and the hotspare was dead, implying he had four drives, three of which were participating in the array (just checked again and he said 3 drives in RAID5 and called a drive a hot spare, which implies a fourth drive). One dead drive and the hot spare failing to come online does NOT bring the array down as he would still have two good drives of a three drive set.

    This guy sees the same thing I saw in Oyeve's message. I think Oyeve was just using improper terminology. The array had three total drives and yes, 2 of them going down would destroy the array.
     
    #15 IndyColtsFan, Nov 30, 2012
    Last edited: Nov 30, 2012