Need help recovering files.

[MysticLlama]

Had a bit of a deal at work on Friday.

Turns out that someone in a sensitive position decided to quit, but before leaving they torched all of their files and e-mail.

E-mail is fine, I have the server keep deleted stuff for 30 days, so I simply recovered all the deleted items (also provided some nice proof of all the stuff that was forwarded to an outside account...)

I don't forsee any problems with getting the deleted files back off of the system itself, I'm just going to buy a file recovery program and undelete the stuff.

Here's the issue. There were several items on the user's network drive that we don't believe are on the workstation. This presents a problem because at this stage the network file storage isn't backed up, it's merely there to back up files that remain on your workstation. Because of this, I don't have any way to roll back.

Here's the problem, the network storage is a Maxtor MaxAttach NAS, which has four drives in it. It has 1 9GB partition on each drive which create two mirrors, the primary and backup OS. The remaining space on the four drives is divided up as a software RAID5, for a total of 200GB of storage. It's a great setup when you think about it that way, the problem is that all of the recovery software programs I've tried identify all the partitions separately (i.e. C: 9GB, C: 9GB, D: 9GB. D: 9GB, E:67GB)

Since it's not finding the partition as it's 200GB size, I can't recover the deleted files properly.

Is there any tool that anyone knows of that is RAID aware and could possibly cobble the stuff together, or am I most likely SOL since most recovery programs directly address the drives?

 

[LANMAN]

Dude,

All that hardware and no IDR??

It wasn't the same "sensitive" person that designed your disaster recovery plan, was it?

Seriously though, I have to agree with your final statement. Unless you have a tape backup or a mirror copy of your RAID, your not looking too good.

Wish you luck it getting it back!

--LANMAN

 

[Need4Speed]

i believe you might be screwed...ive not come across any software that will recover raid...depending on how important it is, recovery services can do raid drives

 

[vortix]

Whatever you do, if you want any chance of recovering data you probably should unplug the NAS and don't use it until you get your files back. The more it is being used to write files to, the greater chance your data will be permanently overwritten.

 

[MysticLlama]

Yeah, I realize that the disaster recovery plan doesn't really exist.

This thing has only been in service for a couple of months, and it's intention was to protect from desktop crashes, not from employees trying to delete stuff. There is a backup plan for it in the future, but that plan is still a little ways out, and we figured we'd make use of it in some form or another until then. (This is the first network storage of any kind at this place, I'm still working on getting us out of the dark ages)

I did already shut down the NAS, and I'm giong to contact their tech support and see if they have come across this problem before and have a solution.

It's no big problem on my part if the files are just unrecoverable, even though I run all of IT, I can still only work with what they give me at what times, and they know that we weren't set up for it yet, so they understand.

Thanks for the ideas so far though.