Case:
The group’s server RAID information is lost. The array has the user’s SQL database for the past year, the system: Win2003 Servers.The Data Recovery Center received a call from the customer for help, saying that one of their (ST) 3.5 -inch SAS*4 server was paralyzed, and there were users in the array of SQL databases in the past year.According to the user’s description, the array is listed as RAID5. Because the 2003 operating system is used, there is a MFT record number. However, because the user provided a wrong information at the beginning, let our engineer enter the misunderstanding of the judgment of the array type.Previously, the customer was sent to a data recovery company in Dongguan. After one night of recovery, the customer verified that the data could not be accessed and used normally.
Solution:
In the process of analysis, our engineers found that there are many residual error partitions and DBR information in the array, and the incorrect MFT positioning is positioned to the current MFT, and the size is 512SEC.In the mirror of 4 plates, I can’t find the verification block, because the two plates in the second block are normal MFT records (everyone knows that if there are four plates in the raid of the odd number plate, then the normal MFTThe verification block must be garbled after XOR).The engineer discussed whether the Dell server data was RAID5. The discussion results were: the array is likely to be RAID0 (because the starting position of the MFT is located in 786432 clusters/4).However, because the user is the administrator of the computer room and has certain experience, after an hour of repeated confirmation, it is determined that the array is listed as RAID0, which is normal after reorganization.Users have previously allowed another data to restore the company to see their conclusions that the RAID5 has been synchronized and cannot be made!Our engineers have successfully restored the Dell server data after unremitting efforts and rich experience.