Monday, October 20 2008, 18:07
How to recover data from an unrecognized dual-disk external drive
Several weeks ago, I built a Media-Center using a spare laptop I had. The point of this move was to be able to watch holidays pictures and movies on the Plasma TV of the living room along with music, so that the TV can also serve as an Hi-Fi system. This system also replaced the bulky (desktop) home server that was in the food storage room. Obviously, a laptop’s internal hard drive is way too small for such activities and I plugged an Iomega 1TB external (2x500GB) dual-disk USB hard drive that was previously used on the desktop. Unfortunately, that external drive was doing so much noise that it couldn’t be left switched on all the time: what was acceptable in the food-storage room wasn’t in the living room, so I switched it off and decided we would switch it on only when needed. All was well until last week-end, when I decided to switch it on and the disk wasn’t recognized by Windows…
Obviously, the first thing I did was to switch it off and back on again, as well as rebooting the Media-Center laptop. Unfortunately, the result was always the same and my disk was still undetected by Windows no matter what I tried: not only no drive were assigned to it, but it wasn’t even visible under the Disk Management Console (diskmgmt.msc). Things started to look bad and I also noticed some repetitive click sounds coming from the external drive. Obviously this kind of noise is never good noise when it comes to hard drives, especially in this kind of situations.
By now, probably some of you are thinking: “and I bet he didn’t have any backups”… well, fortunately I did back up the most important things from the drive to an external 2.5” hard drive connected to the docking station of my laptop. It was done so I could access the most important things on that drive when it was switched off and at a better speed, so I did have a backup of the most important stuff, but obviously not everything… backing up more than 700GB of data isn’t an easy task unless you have another drive large enough to hold the said backup.
Most of this space was taken by pictures, videos, and recorded shows on TV (what we could except on a media-center drive, after all), which weren’t that important, but I still didn’t want to lose, and I was curious to see if I could reuse these drives somehow (I paid €150 for that external storage device after all), so I took my screwdriver and removed the two hard drives from its enclosure. They were 7200RPM 500GB hard drives using a SATA interface, which surprised me since I was kinda more expecting 5400RPM IDE drives. Unfortunately, none of the computers I have at home have SATA connectors, but I had purchased a USB connection kit that allows you to connect any IDE or SATA hard drive and connect it to the computer using an USB cord. That would allow me to connect at least one drive to the laptop, but not both at the same time since I only had one of these kits.
Then, I went to the Disk Management Console and noticed that the first drive I plugged was detected by Windows, but didn’t try to mount/assign a drive letter to it: as both drives are supposed to work together, it likely would have failed. One of the things to remember when working on data recovery is to avoid doing anything that could have a destructive action and that it is always better to use tools specifically designed for the purpose of data recovery. The best is even to create sector-by-sector images of the failed drives before working with the,m but as I said earlier, I didn’t have enough contiguous space to store two 500 GB files, so I couldn’t afford the luxury of absolute safety.
First, I wanted to ensure how damaged the two drives were so I used HD Tune on them, which is a tool allowing to see which sectors of the hard drive are inaccessible by showing them in red. It is a useful tool for disk diagnostics and recovery and there is a free version available on their website. Both drives returned completely green and free of any bad sector. This left me wondering why I wouldn’t get any drive letter when the drives were in the enclosure: my most possible hypothesis is that it was the enclosure that actually had an hardware problem and not the drives themselves, but more importantly, it raised good hopes of recovering the data.
One of the software I have in my toolbox is Active@ File Recovery, which is an excellent recovery software for Windows that gave me tangible results in the past. This kind of software is able to read an unmounted drive, analyze the file system and find the files, for example by reading the MFTs (Master File Tables) or detect files based on their file format signatures (for example, header bytes) on a very damaged recovery system. As I said earlier, the system was made of two 500GB disks combined together to form a big 1TB drive, a bit like RAID0 except that the system used here actually is spanning/JBOD (Just a Bunch of Drives), as we will see a bit later. So, the goal here was to get the first drive from the array and have Active@ File Recovery try to figure out the file system (directory and files names, location, and hierarchy), which is different than the data contained in the files themselves. It is important to get the first drive because it is usually the first drive that contains the important NTFS file system information like the MFTs. Not knowing which drive was the first of the array, I grabbed one of the two and plugged it to the USB converter and ran the QuickScan option on Active@File Recovery. Nothing was found so I figured out that it actually was the second drive of the array and that the other one would be the first one. I retried the QuickScan operation with the other drive and after one or two minutes, the file-system hierarchy was fully displayed in the left panel.
From there, you can simply right click on a file or folder and then click on “Copy”, which will prompt you to select a destination location. As far as I could remember, the drive contained roughly 700GB of data so I expected most of them to be on the first drive and so was the case. I could recover without any problem most of the data I wanted to get back. However, as I had expected, some directories and files were not completely recoverable, because their data were either partly or completely on the second drive. At this point, I had recovered the most important things as they were on the first drive, but for the sake of the completeness and as an opportunity to further polish my data-recovery skills, which may turn useful at work in the future, I decided to try to get the remaining data back as well. Unfortunately, I couldn’t plug both drives at the same time as I had only one USB converter, so I called it quit for this sunday, knowing that the next day, I would be able to use a SATA-compatible spare computer at the office on which I could plug both drives at the same time.
Reassembling the array
So I did and was able to plug both drives and get them recognized by Active@ File Recovery. Then, I told it that the two drives worked together, which is done by clicking the RAID button on the toolbar. Here, we are presented with different options to combine the drives, especially to inform the software which virtual volume method these two drives originally used to work together. I wasn’t really sure so I tried the default option, RAID0 at first, but it didn’t work. Indeed a RAID0 controller on a reasonably-priced external USB drive system would have been surprising, so I switched to “Span” and moved the two disks from the “Available Disks” list to the “Selected Disks” one.
One important thing here is to add them in the good order: the first drive in an array being at the top of the “Selected Disks” list. Since they both bear the same make, model number, and capacity, it isn’t really easy to tell one apart from the other. The only thing different being the 80h and 81h codes as shown in the picture. As seen earlier, by doing a QuickScan, we can determine which one is the first of the array. By remembering its code, we can add the drives in the proper order in the RAID Reassembly dialog. In my case 81h was the first, but your mileage may obviously vary as it depends on how each drive was physically plugged to the computer. Once done, the software will add a new item to the tree list at the left named “Physical Span” and indicating the combined drive size in parenthesizes. You can browse the file system under and copy the files the same way as shown before, but here, the software will be smart enough to get the appropriate data from both disks if required.
To be honest, all of this turned out much better and easier than I expected it. Having read and heard very bad stories about recovering data stored on multiple disks, I wasn’t expecting much success but eventually managed to recover 100% of the data stored on that drive. Obviously, the software helped a lot by virtually reassembling the array originally maintained by the components inside the enclosure. When I considered buying this external storage device, I wasn’t very happy with the fact that it used two drives as I know that hard drives fail sooner or later and that a single little hard drive failure could mean the loss of everything as there is no redundancy. But back then the price was attractive (much more than that of 1 big 1TB drive + a 3.5” enclosure) and went for it. Iomega is a well-known name in the storage market and while I was agreeably surprised by the disks used, the fact that it is actually the enclosure’s controller that died is certainly disturbing: I was expecting a bit more coming from them than noname-hardware grade quality. I feel they could have saved a bit on the hard drives (using 7200RPM and SATA hard drives on a USB2 device doesn’t offer much benefits over 5400RPM IDE) to make sure the enclosure would work durably, which is particularly important on dual-disks systems.
I will now wipe and format these two drives, and sell them on eBay to fund the acquisition of one or two 500GB 2.5” external disks that will be much less noisy, self-powered and less likely to have problems. Unfortunately, 2.5” disks that large didn’t exist back when I bought the Iomega. While this recovery could not have turned out better, I’m not going to bet on it again and will now stick to my first impression and avoid any storage system involving several disks unless it has some kind of redundancy… but knowing how I hold RAID5 in little esteem, how RAID1 is a space-waster, how anything better than that is expensive, and finally that single disks get constantly bigger and cheaper, I feel I’m going to stick with single-drive-based storage for some time, as far as I am concerned as a home user at least.