0

I did something very stupid because I did not back up before performing such operations, but I am trying to restore what I can restore.

We had a server which has malfunctioning motherboard. It had Windows 7 software RAID 1 (NTFS), but also a Linux system (Debian 9) installed. So I decided to transfer the disks to another machine to check everything. Unfortunately I assembled them in incorrect order, so that disks constituting the array (which were previously /dev/sdb and /dev/sdd) are now /dev/sdb and /dev/sdc. The script assembling this array with mdadm ran at the next startup and incorrectly assembled the array; after stopping the array one of the disks was somehow containing Windows restore files and other one actual data. And again, I foolishly did not back up at this point, as I tried to reassemble them in the other sequence, after which caja (file manager, or actually plugin interacting with mount, etc.) refused to mount the acquired mishmash and suggested me to boot into Windows and run chkdisk. I did so, and chkdisk (launched automatically at startup) printed bunch of stuff that looked like repairing the file system (clearing inodes or so). But afterwards the array contained only some 0.1% of original files. It was at that point I learned from the Internet that the chkdisk is not aware of software RAID.

Unfortunately, the array in Windows had the cache set to write-through, if I remember that term correctly.

I then booted back into Linux, and the array is perfectly mountable, with only those 0.1% of files. testdisk showed that both primary and backup boot sector are "bad" but identical, and rebuilding them by seeking for them on disk was unsuccessful. Listing files was also impossible ("filesystem looks corrupted") and the detected type of file system was actually "W2K Dynamic/SFS". In GParted, however, I saw that the partitions (1.8 TiB each) actually has 99% of the space INSIDE THE PARTITIONS unallocated, and what is seen and happily mounted by the file managers in both Windows and Linux are only first 7GB. So the data seems to still be there.

I also tried ntfsfix, with no results ("success" as the program itself thought, though).

I also tried diskpart utility in Windows, disassembling the array (it showed the mirrored disks as "failed" but "healthy" after the disassembling).

I also read this question and discussion: https://ask.metafilter.com/65106/Did-chkdsk-eat-my-files but only learned two things: that RAID (even RAID 1) is no backup and that I am an idiot.

My question is: can something be done at this point?! Should I try "check" option in GParted?

With deep gratitude for Your advice and time spent, Igors

2
  • There are a LOT of questions and answers about recovering data, which is pretty much all you can do at this moment. Start here: superuser.com/search?q=hdd+recover+data Commented Apr 15, 2019 at 18:25
  • Thank You! Tried Photorec but I am afraid that the previous backup from 3 months ago solves the problem better than it.
    – Esmu Igors
    Commented Apr 16, 2019 at 18:38

0

You must log in to answer this question.

Browse other questions tagged .