Server data recovery environment:
A server in an educational institution in Beijing has a RAID5 array composed of 3 disks, and the Windows server operating system is installed on the server.
Server failure:
The server suddenly paralyzed during operation and could not work normally. Beiya Qian's data recovery engineers went to the site to inspect the faulty server and found that a hard disk in the raid5 array of the faulty server was offline due to unknown reasons, and the partition storing important data in the server could not be identified.
After communicating with the user, we learned that after the server failed, the server administrator performed a series of operations to save the server data: restarting the server to bring the failed hard drive back online to synchronize data. When the data synchronization was nearly halfway done, the administrator forced the server to shut down.
Server data recovery process:
1. Take out all the hard disks in the failed server after numbering them. After the hardware engineer checked, no hard disks were found to have hardware faults. All disks are fully mirrored in read-only mode. After the mirroring is completed, all disks are restored to the original server according to their numbers. Subsequent data analysis and data recovery operations are based on the image file to avoid secondary damage to the original data caused by subsequent operations.
2. Analyze the underlying data of all disks based on the image file, obtain the information related to the raid5 structure, and use this information to virtually reorganize the raid5 array and perform verification. As a result, only part of the data passed the verification. After analysis, it was found that the reason why only part of the data passed the verification was that the data was destroyed by the online synchronization operation of the offline hard disk. The data extracted after trying multiple methods is damaged, and you can only try to repair the damaged data.
3. Scan & analyze the data files of the unrecognizable partition and find that the data file directory of the partition is not visible.
4. Scan the free space data page of the partition, and Beiya Qian data recovery engineers will analyze and reorganize the scanned fragments. After the reorganization is completed, verify the integrity and validity of the files reassembled using the fragments, and extract the data after passing the verification.
5. Connect the upper-layer application to the database to verify the availability of the recovered data. After verification, the database file can be loaded normally and the upper-layer application can be used normally. This server data recovery work is completed.
