Recovering MFT on RAID 5 after formatting

[EveS]

Background:
I have a RAID 5 system that, during reinstallation, was temporarily switched to RAID 1, formatted, and then switched back to RAID 5.

What I've tried so far:
- I used PhotoRec to recover some (not all) files. But without the file structure, many of them are not usable for me. That's why I'm now focusing on whether I can recover the MFT.
- chkdsk reports that the file system is RAW.
- In TestDisk, I selected the RAID 5 partition (Disk \\.\PhysicalDrive4 - 15 TB / 13 TiB), then "1 P MS Reserved ... [Microsoft reserved partition]" and attempted to use RebuildBS with different values for sectors_per_cluster (0, 1, and 8). It gives either "Boot sector Status: Bad", "ntfs_mft_load(): Failed." or "Extrapolated boot sector and current boot sector are different."

My hard disk list is

Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - PNY CS3030 1TB SSD,...
Disk \\.\PhysicalDrive1 - 7681 GB / 7153 GiB - CHS 933889 255 63, sector size=512 - WUS4BA176DSP3X3, ...
Disk \\.\PhysicalDrive2 - 7681 GB / 7153 GiB - CHS 933889 255 63, sector size=512 - WUS4BA176DSP3X3, ...
Disk \\.\PhysicalDrive3 - 7681 GB / 7153 GiB - CHS 933889 255 63, sector size=512 - WUS4BA176DSP3X3, ...
Disk \\.\PhysicalDrive4 - 15 TB / 13 TiB - CHS 1867757 255 63, sector size=512 - HPT DISK 0_0, FW:4.00

Questions:
1. Should I continue troubleshooting on the RAID 5 partition (Disk \\.\PhysicalDrive4 - 15 TB / 13 TiB), or would it be better to work on the individual drives (PhysicalDrive1, PhysicalDrive2, PhysicalDrive3) that make up the RAID 5 array?
2. Should I experiment with values like sectors_per_cluster, mft_lcn, mftmirr_lcn, clusters_per_mft_record, and clusters_per_index_record? (And if yes, what are reasonable values)
3. Any additional advice or guidance on how to proceed is very welcome

[recuperation]

Background:
I have a RAID 5 system that, during reinstallation, was temporarily switched to RAID 1, formatted,

Depnding on the way you formatted nothing is left anymore. Did you interrupt the format process?
I see at least on SSD in your RAID 5-array (Disk0).

> and then switched back to RAID 5.

What I've tried so far:
- I used PhotoRec to recover some (not all) files. But without the file structure, many of them are not usable for me. That's why I'm now focusing on whether I can recover the MFT.
- chkdsk reports that the file system is RAW.
- In TestDisk, I selected the RAID 5 partition (Disk \\.\PhysicalDrive4 - 15 TB / 13 TiB), then "1 P MS Reserved ... [Microsoft reserved partition]" and attempted to use RebuildBS with different values for sectors_per_cluster (0, 1, and 8). It gives either "Boot sector Status: Bad", "ntfs_mft_load(): Failed." or "Extrapolated boot sector and current boot sector are different."

TestDisk only allows for minimal MFT dammage.
If your MFT has been partly overwritten other recovery software should be used.

My hard disk list is

Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - PNY CS3030 1TB SSD,...
Disk \\.\PhysicalDrive1 - 7681 GB / 7153 GiB - CHS 933889 255 63, sector size=512 - WUS4BA176DSP3X3, ...
Disk \\.\PhysicalDrive2 - 7681 GB / 7153 GiB - CHS 933889 255 63, sector size=512 - WUS4BA176DSP3X3, ...
Disk \\.\PhysicalDrive3 - 7681 GB / 7153 GiB - CHS 933889 255 63, sector size=512 - WUS4BA176DSP3X3, ...
Disk \\.\PhysicalDrive4 - 15 TB / 13 TiB - CHS 1867757 255 63, sector size=512 - HPT DISK 0_0, FW:4.00

Questions:
1. Should I continue troubleshooting on the RAID 5 partition (Disk \\.\PhysicalDrive4 - 15 TB / 13 TiB), or would it be better to work on the individual drives (PhysicalDrive1, PhysicalDrive2, PhysicalDrive3) that make up the RAID 5 array?

Whatever you do, working on the individual disks will cut lengthy files into stripes - including the MFT. If a file is not that big but occupies more than one stripe, you will be lost as well.

2. Should I experiment with values like sectors_per_cluster, mft_lcn, mftmirr_lcn, clusters_per_mft_record, and clusters_per_index_record? (And if yes, what are reasonable values)

If you had another empty disk with a size of 15 TB, you could partition and format that empty disk. That will give you some ideas how your secret operating system or secret RAID controller will set the parameters. But recreating the boot sector of a NTFS partition won't bring you back the MFT.

[EveS]

Thank you for your answer, recuperation.

The formatting process was not stopped when it was RAID 1. PhysicalDrive0 is not part of the RAID array, but the drives which are (1-3) are also NVMe SSDs.

My secret operating system is Windows 10, the secret RAID controller is the HighPoint NVMe RAID controller. I will try to figure out the parameters on another disk, even though I understand from your post that after the RAID1 formatting it is unlikely that I will see my MFT again. Hope dies last. Thank you for the idea!

[recuperation]

Thank you for your answer, recuperation.

The formatting process was not stopped when it was RAID 1. PhysicalDrive0 is not part of the RAID array, but the drives which are (1-3) are also NVMe SSDs.

You did not mention the type of format operation. A quick format seems to behave less intrusively than a complete format. When dealing with flash storage like SSD, an operating system issuing TRIM commands might have deleted lots of data.

My secret operating system is Windows 10, the secret RAID controller is the HighPoint NVMe RAID controller. I will try to figure out the parameters on another disk, even though I understand from your post that after the RAID1 formatting it is unlikely that I will see my MFT again. Hope dies last. Thank you for the idea!

You could use a hex editor like HxD to examine the SSDs in question. If you only see a desert of zeros that'll be no good.