drozwood90
Senior Member
Ok,
Time for everyone to put on their thinking caps. I'm stuck. It's strange, I've never been this kind of stuck before...
Here's the short of it (also, sorry for the use of present and past tenses mixed...I'm in the middle of "fixing" so things might not be as described...but the relevant information is there):
My server has 5 hard drives. 2 were strictly for movies, 2 were RAID1, 1 was the OS drive (where HS sits).
RAID 1 is built in Intel RAID. Due to my recent move to Win7, my backup has NOT been running (just have not set it up yet). Why would I need it IMMEDIATLY? Important stuff is on RAID1, everything else is on a nearly new drive (less then 1 year old), S.M.A.R.T. is enabled and no error flags. Two directories are the MOST MOST important. Video of the kids, and pictures of the kids. Everything else...well, important, but don't really care TOO TOO much.
In my experience, RAID cards (even Cheaper ones) tend to put configuration data ON the drives. Good idea, in case you move the drives over to another controller (same brand of course), it just picks up the array as if nothing happened. This built in INTEL one apparently can be overridden by the motherboard.
The week before Father's day, something happened where the BIOS was reset. So, the BIOS decided that all SATA drives would be emulated as separate IDE drives to the OS. Basically, during boot, I saw The INTEL RAID controller STILL saw the drives as RAID (and I saw as the PC was booting that it said so). What I lacked in seeing was the first POST flash, where it configured all drives as IDE drives. NOT a big deal to the SINGLE drives. BIG deal for the RAID array.
So, for that week, until about Thursday, we ran the server. IT would ACCEPT new files, and hold them there, hell, even let you read them (so long as they were in cache). The wife never noticed, as she dumps pictures / movies of the kids, then go about her business. Didn't go back to check anything. I didn't notice until I was working with some video. I wrote a file, then tried to read it back. NO GO. When I realized what happened (through a reboot and comb through the BIOS settings), I changed it back to RAID. After I did this, I lost access to folders and say 20% ish of all the files on the ARRAY.
First step I did was unplug the array. i.e. incurr no MORE damage.
Then bought 2 more 1.5TB drives. Booted a second PC with Acronis, and a blank and one original drive. Did a BINARY image of the drive.
21 hours later, powered down, unplugged the original and inspected. Looked like 80% of the files were there. Most things I noticed that were missing, were new stuff.
Great! In my mind, the OTHER drive was being written to, and this one read from. Explains the missing files, but no errors when being written to.
So, I turned off the system, swapped the blank for the second original. Re-imaged the drive.
Examined. Windows saw "stuff" (under disc manager), but didn't know what that partition was. So, I reset the PC, to allow checkdisk to try to fix things. It spent a good 3 hours going through that drive. Deleting things, recovering things. I felt good! After the PC finished booting, the drive was still showing up in the same way. Something was there, but windows didn't know how to deal with it.
GREAT...wasted 21 hours (as I over wrote the first spare drive).
Re-image the first original.
Setup xcopy to image the drive.
xcopy e:\ f:\ /e /v /c /i /f /g /h /r /y >c:\copylog.txt
(where e is the imaged drive and f is the second spare)
Done. Check, that's where I get the 80% from. I figure I couldn't copy 10% of the files. And there's (guessing) 10% not even showing up.
At this point, I setup check disk on my "image" spare drive before I left for work.
chkdsk e: /f /v /x >c:\chkdsk.txt
Based on that, it looks like the SAME stuff I saw during the boot check disk on the second original drive.
What other tools can I use? I can continue to re-image the originals over and over (21 horus but hell, if I can get my files off). So, I can make mistakes, or just "try" stuff.
My fear is, the MFT is goofed up, so, with that and goofed up files, I won't be able to get anything off. My hope is the drive that doesn't show as anything, will be able to be reconstructed (i.e. I hope the MFT is broke, and that drive holds 100% of my missing files...so how to reconstruct the MFT??).
Last tid-bit, my explanation that there are OLD files that are goofed up (mostly my "fun" stuff and SW tools and such...so I can't even USE my own SW tools to fix this!), the server defragments itself once a night. It appears any file that has been TOUCHED is broke. All the files that have not been touched in ages (up to the day the array got goofed up) seem fine.
Thank you for reading through my VERY verbose message.
--Dan
P.S. HELP!! I've not been in this kind of postion in a LONG time.
COPIED FROM MY POST ON HS SERVER:
http://forums.homeseer.com/showthread.php?...7886#post927886
Time for everyone to put on their thinking caps. I'm stuck. It's strange, I've never been this kind of stuck before...
Here's the short of it (also, sorry for the use of present and past tenses mixed...I'm in the middle of "fixing" so things might not be as described...but the relevant information is there):
My server has 5 hard drives. 2 were strictly for movies, 2 were RAID1, 1 was the OS drive (where HS sits).
RAID 1 is built in Intel RAID. Due to my recent move to Win7, my backup has NOT been running (just have not set it up yet). Why would I need it IMMEDIATLY? Important stuff is on RAID1, everything else is on a nearly new drive (less then 1 year old), S.M.A.R.T. is enabled and no error flags. Two directories are the MOST MOST important. Video of the kids, and pictures of the kids. Everything else...well, important, but don't really care TOO TOO much.
In my experience, RAID cards (even Cheaper ones) tend to put configuration data ON the drives. Good idea, in case you move the drives over to another controller (same brand of course), it just picks up the array as if nothing happened. This built in INTEL one apparently can be overridden by the motherboard.
The week before Father's day, something happened where the BIOS was reset. So, the BIOS decided that all SATA drives would be emulated as separate IDE drives to the OS. Basically, during boot, I saw The INTEL RAID controller STILL saw the drives as RAID (and I saw as the PC was booting that it said so). What I lacked in seeing was the first POST flash, where it configured all drives as IDE drives. NOT a big deal to the SINGLE drives. BIG deal for the RAID array.
So, for that week, until about Thursday, we ran the server. IT would ACCEPT new files, and hold them there, hell, even let you read them (so long as they were in cache). The wife never noticed, as she dumps pictures / movies of the kids, then go about her business. Didn't go back to check anything. I didn't notice until I was working with some video. I wrote a file, then tried to read it back. NO GO. When I realized what happened (through a reboot and comb through the BIOS settings), I changed it back to RAID. After I did this, I lost access to folders and say 20% ish of all the files on the ARRAY.
First step I did was unplug the array. i.e. incurr no MORE damage.
Then bought 2 more 1.5TB drives. Booted a second PC with Acronis, and a blank and one original drive. Did a BINARY image of the drive.
21 hours later, powered down, unplugged the original and inspected. Looked like 80% of the files were there. Most things I noticed that were missing, were new stuff.
Great! In my mind, the OTHER drive was being written to, and this one read from. Explains the missing files, but no errors when being written to.
So, I turned off the system, swapped the blank for the second original. Re-imaged the drive.
Examined. Windows saw "stuff" (under disc manager), but didn't know what that partition was. So, I reset the PC, to allow checkdisk to try to fix things. It spent a good 3 hours going through that drive. Deleting things, recovering things. I felt good! After the PC finished booting, the drive was still showing up in the same way. Something was there, but windows didn't know how to deal with it.
GREAT...wasted 21 hours (as I over wrote the first spare drive).
Re-image the first original.
Setup xcopy to image the drive.
xcopy e:\ f:\ /e /v /c /i /f /g /h /r /y >c:\copylog.txt
(where e is the imaged drive and f is the second spare)
Done. Check, that's where I get the 80% from. I figure I couldn't copy 10% of the files. And there's (guessing) 10% not even showing up.
At this point, I setup check disk on my "image" spare drive before I left for work.
chkdsk e: /f /v /x >c:\chkdsk.txt
Based on that, it looks like the SAME stuff I saw during the boot check disk on the second original drive.
What other tools can I use? I can continue to re-image the originals over and over (21 horus but hell, if I can get my files off). So, I can make mistakes, or just "try" stuff.
My fear is, the MFT is goofed up, so, with that and goofed up files, I won't be able to get anything off. My hope is the drive that doesn't show as anything, will be able to be reconstructed (i.e. I hope the MFT is broke, and that drive holds 100% of my missing files...so how to reconstruct the MFT??).
Last tid-bit, my explanation that there are OLD files that are goofed up (mostly my "fun" stuff and SW tools and such...so I can't even USE my own SW tools to fix this!), the server defragments itself once a night. It appears any file that has been TOUCHED is broke. All the files that have not been touched in ages (up to the day the array got goofed up) seem fine.
Thank you for reading through my VERY verbose message.
--Dan
P.S. HELP!! I've not been in this kind of postion in a LONG time.
COPIED FROM MY POST ON HS SERVER:
http://forums.homeseer.com/showthread.php?...7886#post927886
