Page 1 of 1

Undelete from RAID 1 ReadyNAS

Posted: 08 Nov 2018, 00:33
by chadwixk
I accidentally deleted hundreds to thousands of video files from my ReadyNAS RAID 1 device (consisting of 2 - 3TB Western Digital drives). I immediately realized what happened and shut off the device. Noting was destroyed or corrupted in this case, I just accidentally deleted these files.

I have now used an Ubuntu Live USB to boot from and connected one of the physical drives and ran TestDisk to analyze it, but when I go into Advanced, the only available options are [type] [Image Create] [Quit]

When I select the disk, it defaults the partition type to EFI GPT and in the partition listings, it shows 3 of them, all as type Linux Raid. I've tried changing the type using various options, and none work. I can sometimes get a
  • option if I choose Linux Raid > ext3. But when I choose List, I just get the error: "Can't open filesystem. Filesystem seems damaged."

    Any ideas on how to proceed from here? (Thanks in advance!)

    Here is what is in the log:

    Code: Select all

    Wed Nov  7 23:27:07 2018
    Command line: TestDisk
    
    TestDisk 7.0, Data Recovery Utility, April 2015
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org
    OS: Linux, kernel 4.15.0-29-generic (#31-Ubuntu SMP Tue Jul 17 15:39:52 UTC 2018) x86_64
    Compiler: GCC 7.2
    ext2fs lib: 1.44.1, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
    /dev/sda: LBA, HPA, LBA48, DCO support
    /dev/sda: size       250069680 sectors
    /dev/sda: user_max   250069680 sectors
    /dev/sda: native_max 250069680 sectors
    Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
    Hard disk list
    Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - LITEONIT LMT-128M3M, S/N:TW0K2FVY550852AU1516, FW:VYDB
    Disk /dev/sdb - 8054 MB / 7681 MiB - CHS 1023 248 62, sector size=512 - Generic Flash Disk, FW:8.07
    Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00BEVT-22ZAT0
    Disk /dev/sde - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30 EFRX-68EUZN0
    
    Partition table type (auto): EFI GPT
    Disk /dev/sde - 3000 GB / 2794 GiB - WDC WD30 EFRX-68EUZN0
    Partition table type: EFI GPT
    
    Interface Advanced
    hdr_size=92
    hdr_lba_self=1
    hdr_lba_alt=5860533167 (expected 5860533167)
    hdr_lba_start=34
    hdr_lba_end=5860533134
    hdr_lba_table=2
    hdr_entries=128
    hdr_entsz=128
     1 P Linux Raid                    64    8388671    8388608 [2fe56952:0]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 4294 MB / 4096 MiB
     2 P Linux Raid               8388672    9437247    1048576 [2fe56952:1]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 536 MB / 512 MiB
     3 P Linux Raid               9437248 5860529071 5851091824 [2fe56952:data-0]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 2995 GB / 2790 GiB
    gpt_change_part_type
    Change partition type:
     1 P Linux Raid                    64    8388671    8388608 [2fe56952:0]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 4294 MB / 4096 MiB
    Change partition type:
     1 P Linux md 1.x RAID             64    8388671    8388608 [2fe56952:0]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 4294 MB / 4096 MiB
    gpt_change_part_type
    Change partition type:
     1 P Linux Raid                    64    8388671    8388608 [2fe56952:0]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 4294 MB / 4096 MiB
    Change partition type:
     1 P btrfs                         64    8388671    8388608 [2fe56952:0]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 4294 MB / 4096 MiB
    gpt_change_part_type
    Change partition type:
     1 P Linux Raid                    64    8388671    8388608 [2fe56952:0]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 4294 MB / 4096 MiB
    Change partition type:
     1 P ext3                          64    8388671    8388608 [2fe56952:0]
         md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 4294 MB / 4096 MiB
    gpt_change_part_type
    Change partition type:
    3 P Linux Raid 9437248 5860529071 5851091824 [2fe56952:data-0]
    md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 2995 GB / 2790 GiB
    Change partition type:
    3 P ext3 9437248 5860529071 5851091824 [2fe56952:data-0]
    md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 2995 GB / 2790 GiB

    3 P Linux Raid 9437248 5860529071 5851091824 [2fe56952:data-0]
    md 1.x L.Endian Raid 1 - Array Slot : 0 (0, 1, failed, failed, failed, failed, failed, failed, failed, failed, failed, failed), 2995 GB / 2790 GiB
    Can't open filesystem. Filesystem seems damaged.
    SIGINT detected! TestDisk has been killed.

Re: Undelete from RAID 1 ReadyNAS

Posted: 08 Nov 2018, 06:56
by cgrenier
It's recommended to connect both harddisks, start the raid devices "mdadm --assemble", run PhotoRec on /dev/mdX where mdX is the partition where your pictures where stored.
Be careful to store the recovered files on another disk.

Re: Undelete from RAID 1 ReadyNAS

Posted: 08 Nov 2018, 23:48
by chadwixk
Thanks for the overview. I was hoping to use TestDisk instead of PhotoRec, as I was hoping it would allow me to search for videos within the Videos folder only, and keep the files original file names as they were important to cataloging them...i.e. the file names are use prefixed by the date.

Is that process possible? Would I use the same steps, just with TestDisk instead?

Re: Undelete from RAID 1 ReadyNAS

Posted: 09 Nov 2018, 07:00
by cgrenier
It will not work with testdisk.
Videos recovered by PhotoRec will contains metadata including the date/time of the recording. It can be use to rename the recovered files, see "Renaming files using exiftools" in https://www.cgsecurity.org/testdisk.pdf for examples.

Re: Undelete from RAID 1 ReadyNAS

Posted: 09 Nov 2018, 18:07
by chadwixk
Ok, thank you very much! I'll check this out and let you know if I have any further questions.