Recovering "unallocated" data

[Searz]

I had a RAID 1 set up and installed a few new components in the system. Then the BIOS changed SATA mode to AHCI for some f*****g reason, and my disks fell out of the array. So I tried simply setting it back to RAID and re-creating the array, but now they just show up as unallocated data in the disk manager.

I do have a backup, but it's a week old, and I'd prefer not to lose the new data. Is there any way of retrieving it?

 

[Aquinus]

There must be something else going on because just about every modern RAID implementation whether it's hardware, fake-raid, or software RAID, all store array information on the RAID disks which is how you can lose a controller and be able to replace it and still have your array remain intact. None of array information is actually stored in the BIOS. Switching back from AHCI back to RAID should still be able to detect the RAID without a problem if there was nothing wrong with the disks. If you re-initialized the RAID, all of that RAID configuration is gone and your data could be anywhere between intact to irretrievable. If you haven't written anything else to the disks yet or haven't done a full initialization, you may be able to use certain tools to retrieve it but, I suspect that re-creating the array could have blown it all away to a point that's non-recoverable. Or at the very least, the partition table has been destroyed and there could be questions as to if the file system itself is actually intact.

I think your best option would be to use Linux and DD (or ddrescue if a drive is failing,) on one or both of the drives so you can recover it later if it's even possible (if you have the disk space available at least,) then restore your backup so you can at least get going as quickly as possible.

 

[Searz]

There must be something else going on because just about every modern RAID implementation whether it's hardware, fake-raid, or software RAID, all store array information on the RAID disks which is how you can lose a controller and be able to replace it and still have your array remain intact.

I think your best option would be to use Linux and DD (or ddrescue if a drive is failing,) on one or both of the drives so you can recover it later if it's even possible (if you have the disk space available at least,) then restore your backup so you can at least get going as quickly as possible.

Well, I did update my BIOS a while back, which I've read is a common reason disks fall out of arrays, but mine didn't, so I assumed it was fine.

Using DD seems time-consuming. It seems like there might be programs that could do this for me. I found EaseUS Partition Master and Partition Wizard. Is there a good reason for not using these programs?

 

[newtekie1]

There must be something else going on because just about every modern RAID implementation whether it's hardware, fake-raid, or software RAID, all store array information on the RAID disks which is how you can lose a controller and be able to replace it and still have your array remain intact. None of array information is actually stored in the BIOS.

I suspect that re-creating the array could have blown it all away to a point that's non-recoverable

Very much this. Every time I've done something and switched the SATA mode back to AHCI from RAID, simply changing back to RAID mode automatically picked the array back up OR I've had to go into the RAID interface and use the recover option, not recreate the array. When you create an array with disks, it doesn't read the old RAID information and restore the old array. It deletes the old array information, it deletes all the data from the disks actually but doesn't do a scrub, and writes new RAID information to the disks and creates a new blank array. Saddly, I think the data is gone. Best to just restore from the backup and drive on, and learn from the mistakes.

 

[Searz]

Well, creating a new array was instant and didn't involve any disk activity, so I assume it only created a the basic things required for it to work and that it didn't actually overwrite or delete any of the data on the disk.

Update: I've ventured into Testdisk and it looks like my partitions and data are intact. The problem is just, how do I get them back now?

 

[qubit]

Well, creating a new array was instant and didn't involve any disk activity, so I assume it only created a the basic things required for it to work and that it didn't actually overwrite or delete any of the data on the disk.

You'll need disc recovery software or a specialist service to get your data back now as what you did is similar to a quick format. Be prepared for it to be completely unrecoverable though.

EDIT: Just seen your post 6. What makes you think the data is intact?

 

[Searz]

EDIT: Just seen your post 6. What makes you think the data is intact?

Using Testdisk I can navigate through my old partitions and the data. I could go through and back up the important files, but I'd prefer just to restore the entire thing if that's possible.
Problem is just that I'm completely new to Testdisk and have little idea of how this program works.

 

[qubit]

Using Testdisk I can navigate through my old partitions and the data. I could go through and back up the important files, but I'd prefer just to restore the entire thing if that's possible.
Problem is just that I'm completely new to Testdisk and have little idea of how this program works.

If you can see that data, then copy it ASAP! to another HDD, recreate the RAID array and copy it back to it. Then make sure to do daily backups or more frequently if necessary so you're not in this situation again.

You can try repairing that array if you like, but it's critical to copy that data first, as I think you're more likely to wipe everything.

 

[revin]

Try using GetDataBack NTFS and FAT, if all else fails. I have found it to be the best save my ass recovery for many times.
Even on twice formatted disk, reloaded window drives ect... it will retrieve files sector by sector.
Most was on 1Tb and smaller units, but it even got files where the first string is missing and kind of rebuilt them from different clusters or whatever they are written .

 

[Searz]

If you can see that data, then copy it ASAP! to another HDD, recreate the RAID array and copy it back to it. Then make sure to do daily backups or more frequently if necessary so you're not in this situation again.

Tried to, didn't work
All copies fail.
I'm considering just trying to restore one of the disks through testdisk since the same data should be on both of them.

 

[qubit]

Ok good luck.if one drive won't read, try the other.

 

[Searz]

Found a nice little guide for Testdisk: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I've now gone through the process of re-writing the partition table on one of my disks and it seems to have worked perfectly. All the files are here and I haven't noticed any corruption.
I'm still gonna blow the drive after I back up the new stuff tho, just to make sure. Wouldn't want any lingering errors.