A new client approached Data Recovery Specialists with a LaCie 2Big Thunderbolt 2 network configured as a RAID 1 amounting to 12TB. RAID 1 uses two hard disk drives which mirror each other to create an identical copy of the data on each disk. This was configured for maximum safety rather than speed. Our client was a graphic design agency and the files were from the Adobe Creative Suite. The system had failed and our client was unable to access any data although they could still see the data structure and file thumbnails. Files had been moved, renamed and deleted which suggested to our data recovery engineers that the system had failed logically.

When the client tried to copy their data, it took them ages to for even small files and when they interrogated the copied data, it was badly corrupted. To exasperate our problems the client had tried a number of utilities in a desperate attempt to recover their data. Unfortunately these attempts had further damaged the file structure and overwritten some of the previous data.

The two hard disk drives were examined in our lab and we could not find any evidence of physical failure. Also they appeared to remain as a mirror of each other. Although this was used on a desktop network, the device was Unix based and we diagnosed a problem with the controller. The drives had five partitions with the largest in XFS format and the others in Linux swap and Ext2. In theory we can read the data from Linux with XFS loaded but the drives did not have a mount point.

After imaging the disks and using one as a ‘control’, we used our proprietary software to read the XFS partition. By scanning the iNodes we were able to recover all the files. Thankfully Unix disks keep track of the number of iNodes used and allocated. We are able to read these values and store them forensically, enabling us to verify the data and determine files that are missing.