Archive for the ‘Data Recovery’ Category

Running RAID Reconstructor

Wednesday, August 29th, 2007

Reconstructing a RAID is not a trivial task. There are many things that can cause the software to not produce the correct settings to ensure a properly constructed array. There are a few steps you will need to follow.

1. You will need to attach all the drives to a non-RAID controller so that the operating system can see all the drives as single drives inside of Windows.

2. You will need to start the software and choose your type of array at the top of the screen with the number of drives included in the array. If you have a RAID-0 with more than 2 drives or a RAID-5 with more than 11 drives, you will need to use our RaidProbe service. You can find more information about this service at http://www.runtime.org/raid.htm#raidprobe. If you have a 2 drive RAID-0, be sure to watch our tutorial about this type of recovery at http://www.youtube.com/watch?v=DWNq5rAhZ9Y.

3. You will then need to enter all these drives into RAID Reconstructor by right clicking on the white space next to the drive number and selecting the drives that belong in the array. If your RAID is a RAID-5 with one drive missing, leave one field empty. Once this is done, open the drives by clicking the open button at the bottom of the drive list on the right hand side.

4. You will now need to analyze the drives in the step 2 box at the top right hand side of the software. When this finishes, you must look at the bottom of the analysis screen to see if you received a RECOMENDED ENTRY. If you received a RECOMMENDED ENTRY, then click finish and go to step 5 of this article. If it says RESULT NOT SIGNIFICANT, then the software did not properly put the array together because it does not have all the information needed. If you are unable to produce a RECOMMENDED ENTRY, do not make an image of this RAID because it will just produce non-working files. You should then consider letting us do a RaidProbe which will allow us to put the array together by hand. Once it is completed, we will send you all the parameters and detailed instructions on how to rebuild the array for you. You can find more information about the RaidProbe at http://www.runtime.org/raid.htm#raidprobe.

5. Once you have your settings, in step 3 of the software, you have the choice to make a virtual image, an image or write the data back to a drive directly. You would usually choose the virtual image. (If you are using a file system other than FAT or NTFS, there is no sense in making an image as we do not make data recovery software for file systems other than FAT and NTFS.) If you choose to write the data directly to a drive, this will only work if the reason for the RAID failure was a controller failure. Otherwise there is something wrong with the file system or partition table that has caused the array failure in the first place and you will need to run GetDataBack to recover the data at that point.

6. Once you created the virtual image or the image, there are two options to recover your data.

Option 1: Mount the image with Captain Nemo
You should use Captain Nemo if there is little or no file system damage. The advantage of Captain Nemo over GetDataBack is that Captain Nemo gives you immediate access to your files while GetDataBack will need to scan your image first. Download Captain Nemo (http://www.runtime.org/nemopro.zip) and mount the image you just created. You can now copy the files to another location.

Option 2: Scan the image with GetDataBack
If there is significant file system damage or Captain Nemo does not bring the results you expect, you will need to download GetDataBack for NTFS (http://www.runtime.org/gdbnt.zip) to process the image you just created. We have also created a tutorial on how to do this at http://www.youtube.com/watch?v=XQBprGyy_Ko.

If you run into problems with any of these steps, let us know right away so we can help you.

Creating a Bart PE CD

Thursday, May 31st, 2007

We get email all the time with people having problems with the creation of a Bart PE CD.

Since we do not make the Bart PE software, we do not support it. However here is a video tutorial of making a Bart PE CD. If you have any questions, email us at support@runtime.org.

Testing your files in the demo version of GetDataBack…

Friday, May 18th, 2007

We cannot stress how important it is to test your files in the demo version of GetDataBack before you purchase the software.

From step 3, open a few files in order to test them. The fact that you see the folders, files, file names, the right file size, etc. is a good sign but does not mean the file content is there and that those files will be usable. You will not be able to test huge files or files that need to be imported correctly into their native application, like for example Outlook PST files.

Select files that are easy to check, for example Word documents, pictures or mp3 files. Open these files by double clicking them or by using the built in file viewer(F3). Remember that before you can open a file that you double click on, the application associated with that program must be installed.

If you have any questions, feel free to email us.

Data Encryption in Data Recovery and DriveImage XML…

Friday, May 11th, 2007

Here is a questions we get all the time, “Why can’t I extract a working copy of my encrypted data from my recovery or my DriveImage?

Recovering encrypted data with GetDataBack…

This can be answered with a question: Why did you encrypt your data? The answer induces anger in most people because they do not think it through before they encrypt their data. The answer is ‘because I do not want anyone getting access to my data’. That is the entire point of encrypting your data, so no one can get access to it. Computers do not have self awareness, they do not look through their own monitor and say “Oh, its my owner, give them access to the data.“, Once you lose a partition table, or suffer file system damage, GetDataBack can not recover encrypted data because of the exact reason you encrypted it in the first place, so someone can not get access to your data, including yourself. You might be able to send the drive to a hardware recovery company like DriveSavers and have them do it by hand and recover the encryption key and apply the key to the files and recover them.

Extracting encrypted data with DriveImage XML…

When you are using DriveImage XML and trying to extract a file that is encryted, it will give you the message telling you it can not extract encrypted data. This is because the software does not look for the encryption key, it just does not let you copy the data. However if you restore the image to a drive and boot from it, you can have access to that data again because the key is restored and the data matches the key as it did when you made the image.

Conclusion…

If you decide to encrypt your data, keep a backup of it in a safe place. You can not use DriveImage if you want to extract files from the image at a later time without restoring the entire drive. Put it on an external drive that you keep in a safe or keep it on a CD or DVD that you can hide someplace as well. If you need data recovery for encrypted data, it will be expensive and time consuming.

Using exclusions in GetDataBack

Tuesday, May 1st, 2007

There are times when you need to do a data recovery without recovering certain data. Lets say your server goes down and you need to do a data recovery. Now you happen to have about 3GB of text file or log files that keep track of your server statistics that you do not need to recover. You can exclude those files easily in the software before, or even after you scan the drive.

From step 1 or step 2, click on Tools>Options and in the bottom right hand corner, you will see the option that says Excluded files. From there you can exclude any file type you like. For example, if you want to exclude log and text files you simply enter: ‘*.log; *.txt’. Then when you get to step 3 you will see that those files are no longer in the recovery tree. You can also exclude files by the first characters as well. For example if you want to exclude all jpg files that start with a number you can enter: ’0*.jpg; 1*.jpg; 2*.jpg;’. You can do the same thing with alpha characters; ‘a*.jpg; b*.jpg;’.

If you have any questions about what you have read or any questions in general, please contact us at support@runtime.org

What Is Data Entropy?

Saturday, April 28th, 2007

The concept of Data Entropy is greatly used in RAID Reconstructor. Invented by Claude Shannon in 1948, it provides a way to measure the average number of bits needed to encode a string of symbols.

When looking through an unknown set of raw data on a drive, we calculate the number of bytes needed to encode the content of any given sector. Since a sector contains 512 bytes, this is a number between 0 and 512. If we divide this by 512 we are dealing with a number between 0 and 1. A sector containing only ‘a’s has an entropy near 0. A highly compressed JPEG has entropy near 1.

Have a look at popular compression utilities such as Winzip or Winrar. If these programs compress a file with 1,000,000 bytes to 1000 bytes the entropy is around 1000/1,000,000 which is 0.001. A 1,000,000 bytes file compressed to 900,000 bytes has entropy of 0.9. Shannon’s formula enables us to calculate the entropy without actually performing the compression.

But how does this help us to reconstruct broken RAID’s? Most files have consistent entropy that does not vary much between sectors. For example, the entropy of the English language averages 1.3 bit per character. This means you need 666 bits (=83 bytes) to encode a sentence with 512 characters (stored in one sector). Our entropy of this sector containing English text would be 83/512 which is 0.16. You can assume that sectors with similar entropies belong together. This is how RAID Reconstructor decides what the drive order and the block size are for drives that previously belonged to a RAID. It also explains why sometimes RAID Reconstructor’s analysis fails. If the probed areas on the drives contain a huge amount of all the same kind of data, there is nothing RAID Reconstructor can “see”.

Next week I will have a look at RAID Reconstructor’s Entropy Test.

Uwe

Scanning the image from RAID Reconstructor

Thursday, April 19th, 2007

Now we will look at how to scan that image that was made using RAID Reconstructor in the previous post. An image is just a file copy of a physical drive. There is no difference in scanning a physical drive over scanning an image, they contain exactly the same data.

Start GetDataBack for NTFS and from the Welcome screen, choose what type of recovery you want to do and click next. You will now be presented with the available drives to scan for recovery. Under the physical drives and logical drives, you will see the option that says Image Files (load more…). You can click on Load More and you will be presented with a select file box. You can then browse to your image and select it to open that image as the drive to scan. Once you have done this, click next in the bottom right hand corner to scan the image in the exact same way as a physical drive.

Please watch the tutorial for more information and detail on how to do this exactly. If you have any questions, feel free to email us at support@runtime.org

Watch the tutorial

How Long Will A New Hard Drive Work?

Wednesday, April 4th, 2007

Hard drives not only can fail, they definitely will fail sooner or later. Drive manufacturers express the reliability of a drive as the MTBF (mean time between failures). A modern hard drive, such as a Western Digital Caviar WD400EB, is given the impressive MTBF value of 500,000 hours. This is more than 57 years.

Does this mean you can run the drive for 57 years on average? No. The MTBF figures are only valid during the Component Design Life or Service Life, e.g. five years for the Western Digital above. If you bought 1000 drives you could expect one drive failure every 500 hours (21 days). If you operate 100 drives you will have a failure every 5000 hours (208 days).

Since the MTBF specification is only applicable within the service life you cannot predict how long the drive will run thereafter. A drive rated with an MTBF of 1,000,000 hours will not run twice as long as a drive rated 500,000, it might even have a shorter life. The first drive will fail half as often in the first five years. If you want to realize the total running time of 57 years you would have to buy 12 drives and operate them successively, replacing one drive every five years.

It is important to understand that MTBF and Service Life are theoretical and estimated figures. A drive manufacturer does not test a new drive for five years before releasing it. He will use historical data from similar drives and failure rates of the components of the new drive to calculate its MTBF. It is probably a more realistic picture to use the Warranty length as the Service Life, because that is what will cost the manufacturer money.

MTBF and Service Life are meant to be average figures when operating the drive within its environmental specifications. Administrators who operate a hard drive in a dusty industrial surrounding can tell that they often fail within a year.

A typical temperature rating is 5 C to 55 C. You must not use the drive at freezing temperatures. The high end of the scale is easily reached if the drive is mounted in a case without sufficient cooling. Overheating can destroy the electronic board on the drive or damage the platters inside.

The altitude rating (e.g. -1000 feet to 10000 feet) is important because the heads ride on a cushion of air. The altitude determines the thickness of the air cushion. 10000 feet is the upper limit. This is a vital restriction to remember when traveling by airplane. The cabin pressure of an airplane is usually maintained at the equivalent of 5000 to 8000 feet. In case of a catastrophic decompression the cabin altitude can increase to the actual airplane altitude of up to 40000 feet before the pilot descends to a lower altitude.

A drive’s read/write heads have direct contact with the platter when the drive is not spinning. As soon as the rotation speed reaches the operating speed the heads ride on a cushion of air. During acceleration from a stop and deceleration from full speed spinning the heads will be abraded by the special platter area they are riding on. Hard drives are designed for a limited number of these start/stop cycles only. A typical drive is rated 40000 start/stop cycles. This value is meant to be the minimum of cycles the drive can endure before failure.

At the end, a defective electronic board, abraded read/write heads, scraped platters or misaligned platter stacks, can cause the failure. Normally, the drive still spins but you will hear a clacking and rattling noise. At this point, the only thing you can do is sending the drive to a data recovery lab.

Fortunately, hard disk failures do usually not appear sudden. They develop over time and an attentive user can catch the warning signs soon enough to save the data. The most telling signs of a disk that soon will fail are abrupt recalibrations (clicking and moving of the heads) and the development of bad sectors. You should try to backup your data immediately. If the file system’s logical structure is already damaged, you can recover your files with GetDataBack. It is always a good idea to create a sector-by-sector image of a failing drive. Thus you reduce the stress for the drive and can do the data recovery with GetDataBack from this image.

Uwe
Runtime Software

Welcome to Runtime’s Data Recovery blog!

Saturday, March 31st, 2007

We have created this Blog to inform you about new products, developments and technical issues. On a regular basis, we will provide background information about data recovery, procedures, tips, tricks and cheats.

You are welcome to leave comments and suggestions!

Runtime Software,
March 2007