We received a call from a reputed hotel , regarding a server failure. It was a mail and hotel booking server , which stops working and their two drives went offline. Client does not want to send their server to our CSSI lab and request us to work onsite.
We found two drives went offline and hot spare drive was not kicked in. Internal IT team and their support team already did research by putting new drive and change the drive order. Which is the most tough job for recovery engineers to find the correct drive order.
As both SAS drives had huge bad sectors and we managed to clone bot drives at client end , after that we have to find out RAID type and parity. Engineers told us that it was configured with Raid 6 dual parity. We manually search individual MFT records in all drives for checking order and parity, we found that two drives had parity with , HP delayed parity order.But all combinations were failing, we created virtual Raid with all Raid 6 parities. Few data was working and some had garbage.
After checking several MFT records in different hard drives, we found that it is a RAID 50, In hex editor we created virtual RAID and we were able to jump all partitions properly. We recovered all the data and live their server. Hotel had no clues regarding their guests bookings , after successful data recovery of Raid 50 , they start working. We took two nights and one day for successful Job.
If any requirement regarding Data recovery, contact Support@indiacssi.com
