Sunday, November 30, 2014

How does one recover data from a "not initialized" drive that was part of a BitLocker encrypted USB RAID 1 array?

The drive was used inside a CR-H212 external RAID enclosure. The drives were working fine until I did the following:



  • Safely removed (in Windows) and fully unplugged

  • Opened and removed the two drives

  • Switched enclosure to normal mode

  • Put in a different drive and plugged in to see its contents (it was fine)

  • Safely removed (in Windows) and fully unplugged

  • Switched enclosure back to RAID 1 mode

  • Put the original two drives back in

  • When plugged in, now shows as not initialized


After checking the manual again, it does warn about switching modes... I totally forgot! I'm guessing when you switch the mode back to RAID 1, the enclosure thinks you're starting a new array regardless of what is already on the drives. What it writes to disk to get things started I don't know. I know it didn't completely wipe the drives since the lights only blinked a few times and then stopped. In theory the data is still there.


I took the drives out again and connected one directly to SATA in my Linux machine and am dd-ing it to a backup file.


I do have a third drive that I rotated out of the array a while ago and I can access the (outdated) data just fine outside the array. The other drives show as "not initialized" whether they are in the array or not. I tried comparing partition info between the third drive and the not initialized ones (using testdisk) and they seem to be the same (which I guess makes sense) but which data specifies being initialized or not? What else can I compare with and what should I look for?


I was thinking of initializing the array and formatting it to what it was before (NTFS) and then copying the raw data from the backup to the array, but I don't know if that will do the trick. Would I need to copy data from/to a certain offset?

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...