May 23

Data Recovery: What I had to do to recover data from a RAID 0 volume.

  I recently was called upon to perform a data recovery on an HP desktop that was setup with a RAID 0 volume.  As you can imagine the volume failed when one of the hard drives started acting up.  I had to resort to all my old tricks and some new ones in order to get some (but not all) of the data my friend required.

  Step 1) This involved using my old friend, DOS based Ghost run from a boot disk.  Last version I have from this era is 11.5.  I was able to image 143GB of 166GB.  Ghost hung on massive numbers of bad blocks.  This was going to take days so I decided to stop here.  I wasn’t sure what data I had until I can get it to a working system.

  Step 2) Normally, once I have a ghost image I would open GhostExplorer.  This wasn’t an option since the Ghost Process didn’t finish normally.  I then started to look around to what I could get/use to recovery the data.

  Step 3)  This was a process I didn’t try before.  I actually created a .vmdk file from the collection of ghost files (*.gho’s) the DOS version created. 

  Once I had this .vmdk I loaded it into a virtual machine to see what I could recover.  To my surprise it actually worked rather well.  I was able to get most of the User Profile folder and some Program Data folders that were critical.  This was the first time I attempted a Data Recovery from a RAID system.  I’m rather good about backups, so I personally never have to perform any data recovery myself.  But knowing how people are at home, I know every day someone out there loses everything on their hard drives never to see it again.  I also know Hard Drives don’t last forever, so I rotate my data to new media every few years.

  Lesson here is to be proactive with your data.  Backup at least every quarter so you don’t lose everything in the even of a failure.  I’ll add on an expanded section to review the commands I used to create a .vmdk from ghost files and the few hurdles I had to overcome due to a bad ghost image.