Good encryption is not recoverable

If you set up something highly secure, you better have backup of it. Should it fail, more secure it is, more difficult it is to recover.

I have a QNAP NAS that had two large *.gho files (150GB – 200GB each) on a 1.5TB RAID Mirror 1 HDD.

These files are NOT Norton Ghost files but are True Crypt container files. I … managed to delete these two important files. I removed both HDD’s … in 20 secs of the deletion.

…. What do I do?

Nothing actually. If he’s really lucky, the EXT journal may still contain some leftover data; QNAP would use EXT3 or EXT4, both of them journal-enabled. If the journal does not have the original i-nodes, then TrueCrypt containers are no longer recoverable. The containers are specifically designed not to have any identifiable structure in them, or otherwise they would be breakable. Since there is no structure to work with, the fragments can’t be stitched together, and 150 GB is certainly larger than maximum practical limit for a contiguous file on EXT.

Advertisements

Rebuild fails to complete

This case is mostly about maintenance, when 220 Black Armor fails to complete resync

I have a Seagate black armor 220 which keeps trying to repair a volume after a had drive failed as part of RAID1. I replaced the disk, added the member drive ran the S.M.A.R.T checks on the drives and started to recover … it gets to around 80% and the restarts. There are no error messages and this has been looping for about a week now…

Any ideas as to why it wont complete the recovery process and rebuild the raid volume? or how I can trouble shoot it?

This one is easy. The NAS is still readable, so the troubleshooting consists of five steps,

  1. Back up data from NAS to some other location.
  2. Destroy RAID1 in NAS.
  3. Replace disk which is still not replaced.
  4. Reconfigure RAID1 and wait for resync.
  5. Restore from backup.

The problem most likely is that the second (non-replaced) disk has developed a problem; SMART test can sometimes miss a bad sector, or the interpretation of SMART data either by the customer or by the NAS firmware is excessively tolerant. The inability to complete the rebuild is more significant observation than a SMART test result.

Data recovery for Terastation

This case has a common mistake of calling Terastation with two Rs. The correct variant is with a single R, derived obviously from Tera- as in Terabyte.

I just [mistakenly deleted] 700GB on a Networked RAID drive (A buffallo Terrasation)

Does ANYONE have a suggestion as to what Data Recovery software/undelete software I can use to undelete software over the network off a 700gig RAID array?

The only thing I have seen so far is Active UNDELETE Enterprise 5 (enterprise version supposedly can do network and raid …)

Actually, I have. Home NAS Recovery (www.nas-recovery.software) is quite good in undelete on Buffalo NAS.

Nothing works over the network, though. Active Undelete works with RAID, sort of, if you know the parameters for the RAID. Home NAS Recovery, on the other hand, is fully automated.

Rebuild goes wrong

Everything looked nominal. This case is actually kind of unexpected example of routine operation going belly up, the NAS owner ends up looking for recovery options after RAID 5 crash

Recently our quite old NAS Iomega Storcenter 200rl with a RAID 5 out of 4x500GB, reported a harddisk failure and our administration replaced one of the disks that was marked. Then the Storecenter told that it was synchronizing the data. After synchronization the NAS told that 100% of storage capacity is free and so it tell until now… I am interessted in options to revocer the data.

Certainly does not look like something was done wrong; if the NAS have sensed the rebuild cannot be completed, it would have had refused to even start the process. Certainly, with a wrong disk replaced, the rebuild does not happen. In this case, however, the rebuild was completed with no reported anomaly – something else went wrong.

With something unknown going wrong, it is difficult to predict if the case is recoverable. One can give our Home NAS Recovery a spin, but there is no guarantee of success. Cases when rebuild goes wrong for no apparent reason are always dicey.

 

 

Network Recycle Bin and undelete

This specific question is about IX4-300d, but it applies to virtually any NAS out there.

The question is about some Recycle Bin equivalent for a NAS.

As in most NAS (if not all) when a file is deleted from a share in IX4-300d it disaappear “completely” from the drive. No chances to recover it from a Recycle bin. I read in a post that UNDELETE by Diskeeper might be a solution creating a “virtual” recycle bin. I decided to try it and downloaded a trail version of the program. But it did not recognized the drive/shares in the NAS. Does anyone has any experience with UNDELETE in NAS?

First of all, some NAS vendors provide an equivalent of the Windows Recycle Bin. QNAP, for example, calls this feature Network Recycle Bin. It keeps files retrievable as best practically possible (subject to age and free space constraints).

Whatever delete protection mechanisms, they must be implemented and run on the NAS side, because it is the NAS filesystem that owns the files and performs deletions. Any Windows-based installable recycle bin software only works with locally attached disks.

After the files are deleted with no Recycle Bin in place, there is still a chance – our Home NAS Recovery can help (with varying success depending on how long since the deletion).

Lost RAID5 on Thecus

Trying to rebuild lost Raid5 on Thecus

I have lost a raid 5 in a 4200PRO and now I am desparatly trying to revive the Raidset.

What happened: The Raid5 over 4x 2TB WDGreen Disks degraded and I accidently marked the wrong disk as spare (this was definately my mistake, failure before always happend on drive #3, this time it was #4…), next boot the raid was gone.

[tried to fix the problem using Linux commands but to no avail].

Has anybody any experience how to get further than this?

Yes, but the success depends on what exactly was done during troubleshooting. Unless the rebuild was forced on a wrong disk order, Home NAS Recovery is a definite answer to the question.

Prior Planning Prevents Poor Performance

People seem overly concerned about how to do the recovery should their NAS go down. These two cases (first, second) concern Thecus NASes.

If I create RAID 1 and the N3200Pro hw fails beyond repair (for whatever reason), can I take out one of the HDDs out and read the files on it in a Linux or Windows PC? I am only interested in reading the data once at that stage, rebuilding the RAID is a non-issue …

and

Assuming that I have a Thecus N2310. Assuming that I have a disk that *was* part of a RAID1 but the other disk is missing. What steps do I need to do with the disk and the N2310 to rebuild the RAID array and get the data off please?

I was describing this at some length in another post, but just for a short repeat, if you are worried about recovering data should the NAS dies, why not have a backup for it? The data may get damaged for reasons other than a total and utter NAS hardware failure. Lightning strike, software issue, or a number of other reasons will damage both sides of the RAID1 at the same time. RAID does not replace a backup.