recovering a Windows 2003 RAID 5 volume accidently deleted

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Gagou
Posts: 3
Joined: 12 Feb 2016, 23:21

recovering a Windows 2003 RAID 5 volume accidently deleted

#1 Post by Gagou »

Sometimes we are tired and are not really reading messages which are in front of us. :(

On windows 2003
I had a failed drive on a raid 5 volume ( created by windows ==> software RAID)
I replaced it with a bigger disk
but after having add it to the RAID 5 volume, I changed my mind and wanted to configure the partitions on this new bigger disk differently and to do that I have :oops: stupidly incidently destroyed the volume on each of the raid 5 disks.

What can I do now ? I just see with the disk manager non-allocated space at the place of my RAID 5 volume .
Is there a solution for this stupidity :oops: ?

Please Help me !

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recovering a Windows 2003 RAID 5 volume accidently delet

#2 Post by cgrenier »

Try TestDisk, Analyse, Quick Search on each disk to search for the missing partition.
Please post the testdisk.log file content.

Gagou
Posts: 3
Joined: 12 Feb 2016, 23:21

Re: recovering a Windows 2003 RAID 5 volume accidently delet

#3 Post by Gagou »

Hi Christophe
First of all, thank you for your help
I have done what you asked
I put the log on my dropbox here https://www.dropbox.com/s/x627ip9h8tsic ... k.log?dl=0

but to help on the results, I also put pictures of the config in the disk manager Originally this structure was done with three 500GB disks (disk 0,1,2)

As you can see the two first disks have 3 partitions, the 2 first partitions are actually operational to form a dual-boot and both OS are in mirror RAID.They are working without any problems
The last partitions on disk 0 and 1 and the fist partition on disk 2 created a volume named RAID-5_700 of ...700GiB which is the one I destroyed.

Disk 2 died, I replaced it by a bigger 1 terabyte disk. I rebuilt the volume RAID-5_700 and .... I suppressed the volume by error by acting on the new disk 2

By the way I have seen that you are french, so am I. As so I can continue in any languages of your preference. I guess english should be better on this international forum.

On the log, you probably will see that I scanned the disk 2 twice, which was also ...an error

Thank you again for your time

Gagou
Posts: 3
Joined: 12 Feb 2016, 23:21

Re: recovering a Windows 2003 RAID 5 volume accidently delet

#4 Post by Gagou »

Hello Christophe

Have you downloaded the .log file from my dropbox above

I'm a newbie on this domain but opened with notepad++ on lines 174-203 we have
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 32772537
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2048283
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 2039 254 63 32772537
NTFS, blocksize=4096, 16 GB / 15 GiB
NTFS at 2040/0/1
filesystem size 209712510
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 13107031
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2040 0 1 15093 254 63 209712510
NTFS, blocksize=4096, 107 GB / 99 GiB
NTFS at 15094/0/1
filesystem size 1468563456
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 91785215
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 15094 0 1 106507 216 3 1468563456
NTFS, blocksize=4096, 751 GB / 700 GiB
This partition ends after the disk limits. (start=242485110, size=1468563456, end=1711048565, disk end=976773168)
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

On lines 233-238
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 876 GB / 815 GiB)
The following partition can't be recovered:
HPFS - NTFS 15094 0 1 106507 216 3 1468563456
NTFS, blocksize=4096, 751 GB / 700 GiB
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

Here TestDisk to find 876GB clearly added in its calculation
16000 MB (1st partition named XPProMaster 15.63 GiB)
+ 102400 MB (2d partition named W2K3Master 100.00 GiB)
+ 751 GB ( the destroyed volume named RAID-5_700 of of 700GiB)
= 876 GB (total = 815 GiB)


on line 281 we can see:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 1938021 16 63
NTFS at 0/1/1
heads/cylinder 255 (NTFS) != 16 (HD)
filesystem size 1468563456
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 91785215
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 1456908 4 3 1468563456
NTFS, blocksize=4096, 751 GB / 700 GiB
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
I guess this are souvenirs from my 700Gib raid 5 volume

I 'm surprised at the fact there is a fat12 partition on sda ? does testDisk is looking for diskets too ?
and no vision of the raid partition on sda, quick scan I guess

So what can I do now ?

Locked