Creating RAID5 over existing data is bad

Irreversibly bad, in fact, if you do like here

I bought a Zyxel Nas540 … plugged my HDD’s with my data in them and created a RAID5 volume. I didn’t know it will change the file format completely. I tried to connect my hdd’s back to my computer to backup the data but all of the hdd’s are damaged. … Is there a way to restore last file system ?

No.

The RAID5 has parity interleaved with data on all disks. Once RAID5 is first synchronized, every Nth block of data on each of N disks is overwritten. Given typical block sizes used in RAIDs, this prevents any practical recovery.

 

Good encryption is not recoverable

If you set up something highly secure, you better have backup of it. Should it fail, more secure it is, more difficult it is to recover.

I have a QNAP NAS that had two large *.gho files (150GB – 200GB each) on a 1.5TB RAID Mirror 1 HDD.

These files are NOT Norton Ghost files but are True Crypt container files. I … managed to delete these two important files. I removed both HDD’s … in 20 secs of the deletion.

…. What do I do?

Nothing actually. If he’s really lucky, the EXT journal may still contain some leftover data; QNAP would use EXT3 or EXT4, both of them journal-enabled. If the journal does not have the original i-nodes, then TrueCrypt containers are no longer recoverable. The containers are specifically designed not to have any identifiable structure in them, or otherwise they would be breakable. Since there is no structure to work with, the fragments can’t be stitched together, and 150 GB is certainly larger than maximum practical limit for a contiguous file on EXT.

Dangers of filesystem check

This case highlights how a filesystem check can go wrong

This morning, I was copying files from one of the folders on the N4100pro to another folder on the same nas and hit an file system error.

Therefore, i did a file system check on NAS Admin page. The check took almost 12 hours to complete and when the nas restarted, my raid is gone.

The filesystem consistency check (and fix), does not normally makes things worse than they were. However, if the underlying RAID is somehow broken, or if the filesystem damage is real bad, the filesystem checker will trash the entire volume instead of fixing it.

These cases are usually not repairable. Filesystem check modifies the only existing copy of inodes (the key element of the filesystem) without leaving any copy of the original state. With the inodes broken, proper recovery is not really possible. You can get some bits here and there, but file names are gone.

Recuva and remote undelete

This conversation happens on Piriform’s forum,

I have deleted a file on a network Buffalo drive. I am using the free version of Recuva. I can navigate ok to the folder but the OK Button stays greyed out.

 

I believe recuva works only on local physical drives

 

Does the business edition of recova only work on local drives also?

Any version of any commercially available data recovery software requires the drive to be removed from the NAS. The definition of local physical drive may vary slightly, but certainly a drive still in a working NAS isn’t one of them.

 

Can I undelete a file on NAS drive?

The evergreen theme of undelete over the network comes up again on 7forums,

…D-Link 323 2 bay NAS driveā€¦

I accidentally deleted a couple of files … are there any utilities to allow me to undelete.

I tried a couple of Undelete programs I have – but they don’t see networked drives.

And the answer is again you can undelete, but not over the network. You need local access to the disks. With two bays, this should be rather straightforward, no fancy hardware required. We have this covered in our FAQ, and it applies to any NAS, by any vendor.

Recovery over network

The original question goes like this (source)

I have [whatever setup with] mapped network drives in the form: \\nas\pictures, \\nas\music, etc.

… accidentally deleted a folder ..

I am looking for a piece of software that allows me to scan network drives for deleted content and possibly recover it. Most everything I find is to install on a file server. In my case a file server doesnt exist for me to install a piece of software on.

and the short answer is, you can’t have that.

The longer answer is (already in our FAQ) that even if you want a couple of files undeleted, you still need a full-scale analysis with full-scale hardware setup, removing disks from the NAS, putting them into a PC, and so on. The PC is not required to be some kind of a file server, any modern Windows desktop will do. If you do not have one, you have to get it. This applies to any NAS you can have, in any configuration.

Theoretically, as NAS runs Linux, you can login into Linux, install some Linux-based undelete software, and run it inside the NAS. In the end of this process, though, most people wish they’d have gone with Windows and hardware setup route.