RAID 5, 10TB of data and... partition disappeared

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
krsf
Posts: 2
Joined: 02 Nov 2016, 22:57

RAID 5, 10TB of data and... partition disappeared

#1 Post by krsf »

Hello Folks!
The story of the server is quite long...

It has 12 physical drives, 1TB each. Configuration: RAID5 +hot spare.
One big partition – NTFS, almost 10TB.
Theoretically it should survive failure of a drive and after some time another one.
But it seems that nobody took care about this machine until the logical drive failed…

Then there came a HP service and they have found that 2 physical drives were dead and one was in state predictive failure.
So there still was a chance that the data was still recoverable.
So they exchanged the 2 dead drives. RAID started to rebuild. Great. When the rebuild was finished they exchanged the predictive failure drive to a good one. And now RAID says that everything is OK.

Unfortunately it is not like that. Windows says that it cannot see anything on the drive.
Chkdsk – can see partition name it san see that the file system is NTFS. It also can see some files and pretends that it is deleting some of indexes (every run it “deletes” the same files)
chkdsk2.png
chkdsk2.png (7.13 KiB) Viewed 1882 times
And now I’m trying with TestDisk.
Quick Search found partition with type MS Data (why not NTFS? – can anybody explain it, please?)
I can be wrong but it seems that it can see only part of files on it. I believe I should see some more directories…

Now on this machine there is DeeperSearch running… I’m waiting for the outcome.

So I have some questions:
- Why this partition is recognized as MS Data and not NTFS? Is it OK?
- Does it make any sense to run DeeperSearch in my situation?
- Any other suggestions?

Best regards
KRSF
Attachments
testdisk.log.txt.zip
(7.6 KiB) Downloaded 256 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: RAID 5, 10TB of data and... partition disappeared

#2 Post by cgrenier »

Your disk size is bigger than 2 TB, it'w why it's not using a PC Intel partition table but an EFI GPT.
With EFI GPT, NTFS filesystem are in MS DATA partition. There is no problem here.
As your partition is not lost/deleted, there is no need to search for it.

TestDisk has been able to list your files. As chkdsk is unable to fix your partition, the best is to use testdisk to copy all your files to another 10TB volume.
Once it's done, reformat the original partition and put your files back. Note that NTFS permissions will have to be setup again.
An alternative is to boot from a Linux LiveUSB, mount the NTFS partition in read-only and copy the files. It will probably be faster than using testdisk.
If you don't know how to create a Linux LiveUSB, read https://www.cgsecurity.org/testdisk.pdf there is a chapter about it.

krsf
Posts: 2
Joined: 02 Nov 2016, 22:57

Re: RAID 5, 10TB of data and... partition disappeared

#3 Post by krsf »

Thank you very much!
Now I'm copying the files. Still from TestDisk.
How big is the speed difference when I would attach this storage to Linux?

And one more thing - according to my knowledge some subfolders are missing. Of course with files.
Is there any chance to find them? If so - how should I do it search for them.

Of course I know that TestDisk has undelete options on NTFS but will it fork when the partition itself is not as visible as it should be?

best regards
KRSF

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: RAID 5, 10TB of data and... partition disappeared

#4 Post by cgrenier »

Well, the real advantage of copying your files under Linux is that you can use "rsync -a" to copy your files. It allows you to restart the copy if a problem arise.

Locked