Recovering data from a RAID1 NAS drive

The problem to solve was a NAS storage device (Lacie 2 Big network) that was not responding any longer. It is a device that is accessed over a network and contains 2 disk drives in RAID 1 format. Being RAID1 means each is an identical image of the other. This means that one can fail, and all data will be retained on the second.

The two disks were examined and neither had any physical problems, they also appears to have the same data. Therefore the problem was not due to disk failure. Although the drive had been used on a PC network (XP, Vista etc) as it is a NAS device it means that it can store data in any way it likes and this unit was Unix based. Something had probably failed in the controller and so the data could not be accessed.

The drive in fact had 7 partitions of data, but the largest one was XFS, smaller were Linux swap and Ext2 format. In theory it should have been possible to read the data from a Linux system with XFS loaded, but the drive did not appear to have a mount point set. Although it was probably possible to configure Linux to read the disk, the solution taken was to use CnW Recovery software to select and read the XFS partition. By scanning for all iNodes, all files were found and recovered

One feature of Unix disks is often the superblock keeps track of the number of iNodes used and allocated. The CnW software will read these values and store them the forensic part of the log which helps verify that all files have been read, or in the case of a badly damaged disk, the number of files that are actually missing.