File Data Recovery Step by Step

File Data Recovery Guide Problem: A file that you now need has been deleted from your hard drive data on the C drive. Solution: Shut down the computer. It is important not to run the machine anymore. Windows works under the idea that areas of the harddrive that have been used before are used first. This means that as you are surfing looking for a solution you can potentially be overwriting file data. NOTE: Make sure that you click the arrow next to shut down and select restart. We do … [Read More...]


SAN Data Recovery – iSCSI RAID 6 Issue

Serial attached SCSI devices have been a high speed blessing to the SAN, NAS, and Enterprise Storage Array class of systems. These devices offer a clear solution for any storage requirement due to capacity and configuration. Whether it is Fiber Channel mounted VMware or iSCSI configured raw data access these devices are undoubtedly a smart choice for any enterprise. With that being said when these systems go down due to multiple hard drive failures it is up to the data recovery expert to extract … [Read More...]

Master File Table Entry

Lost File System Recovered

The Mysterious Case of the Missing File System Sometimes there is just no way to ascertain the events leading up to the loss of an entire file system index. The client may have no idea what happened. When looking at the file system as a whole there are no telltale markers left behind. So the only course of action is to analyze what you have and repair the anomalies. In retrospect it was an interesting exercise in data recovery, however, not knowing how it happened is still irritating. DTI … [Read More...]


Troubleshooting Basic Hard Drive Problems: You Need to Format the Disk

A common hard drive fault that I think most of us have run in to at one time or another is : “You Need to Format the Disk in Drive:”. This problem seems to be even more prevalent with the popularity of portable external hard drives like the Seagate Goflex or the Western Digital My Passport. I attribute the problem to not safely removing the USB drive from the operating system before unplugging the drive. The reason this causes a problem is that Windows is always caching to the hard drive … [Read More...]


Hard Drive Recovery: What does it mean?

Hard drive recovery is a very broad term. However, data recovery companies use it to describe a situation where the hard drive itself is no longer functioning. A hard drive can have many different file systems from Windows, MAC, Linux or, even a very proprietary file system for a specific use. So, when we here at DTIData receive a call from a user that is unable to access their data we have to determine if the hard drive needs to be recovered or repaired to a state where we can then access … [Read More...]


VMFS File System Recovery

Part 1 - Part 2 - Part 3 - Part 4 VMFS File System Reconstruction (Part 4) In the last three installments we have taken an in depth look at the VMFS file system. As we have seen there are many different components that make up the file system where each component not only does its own job, but is interdependent on the other components to do their job. This dependency is either manifested in a staging manner, for example the component may need to perform a certain task before the other … [Read More...]

VMFS Inode Scanner Screenshot

VMFS File System Reconstruction (Part 3)

Part 1 - Part 2 - Part 3 - Part 4 In the last two sections we covered the coarser portions of the VMFS file system. First we looked at what a volume consists of and the best way to find a volume on a storage device where the file system has been corrupted or lost (See VMFS File System Reconstruction - Part 1). In addition DTI provided a software tool to scan a storage device and search for volume specific attributes and in return display those attributes in an easy to read format. This tool … [Read More...]


VMFS File System Reconstruction (Part 2)

Part 1 - Part 2 - Part 3 - Part 4 In the first installment of our explanation of rebuilding the VMFS file system from a damaged volume we covered some of the attributes of the volume on disk data structure. In addition to that we reviewed some tools and methods for finding the placement of a VMFS volume in order to reconstruct the volume boot handler. Finally we discussed the role the GPT in union with the EFI specification play in managing and ultimately help in processing the ESXi boot … [Read More...]

vmfs raid 10 array

VMFS File System Reconstruction (Part 1)

Part 1 - Part 2 - Part 3 - Part 4 Recently DTI Data received a challenge in the form of a VMWare ESXi 5.1 server which contained 16 (sixteen) 2 (two) terabyte Seagate ST2000DM001 hard drives. These drives were configured as a RAID 10, 8 (eight) drives for each side of a RAID 0 mirrored. The RAID had dropped what looked like 3 (three) drives and this is what degraded the array to the point of where it no longer functioned. In a RAID 10 all that really needs to happen is to drop one drive … [Read More...]

raid 5 rebuild

Unable to Rebuild a RAID 5 Array

RAID Configuration: 4 Seagate Barracuda Green 2 TB SATA hard drives (model ST2000DL003) configured as a RAID 5 connected to an on-board Intel RAID controller. Problem with RAID: Because of the nature of Green drives, specifically that they will spin down in low use periods, the array will periodically have a disk report as offline.  The fix this customer was using was to mark the offline drive as active and rebuild the RAID.  Unfortunately, a drive eventually did fail and on trying the … [Read More...]


Server room

Missing Exchange Data File

I had a customer recently that called saying his Network Attached Storage (NAS) device had crashed and now his Exchange Priv.edb was missing. He tried running checkdisk on it, tried several undelete and file recovery programs with no luck. The weird thing about it was that viewing the properties of the drive letter under windows showed 140 GB in use even though the only other file on the drive was the Priv.stm streaming file which was 60 GB in size. Luckily for me that it was a network drive, … [Read More...]


Exchange Data Recovery Guide

First and foremost, DON’T PANIC.  I cannot remember how many times I have seen somebody (myself included) do something completely idiotic and often times irreversible because they didn’t take the time to think things through.  For example, wanting SO badly to get the database mounted again before anybody notices that you don’t do the MOST important step when recovering any data, making a backup and working off of the backed up copy rather than your live data. That being said, here are … [Read More...]

Recovering a badly fragmented Outlook PST file after a few rounds with chkdsk The Final Installment

Welcome back!  As before, we still have the problem where chkdsk was run on a RAID with a stale drive.  We have had a brief explanation of how NTFS 5 works and how the data is stored on the volume.  Lets take a much more detailed look as to how the data is stored in a virtual database and how this helped me recover the PST file. There are two types of databases.  Static, and virtual.  A static database is allocated before run time, and the size stays the same.  In addition, the record … [Read More...]

Image 1d

Starting Exchange Server with a blank Information Store

Starting Exchange Server with a blank Information Store There are some situations where starting Microsoft Exchange with a blank database may be necessary. In my line of work, I run across a large amount of businesses that have had their Exchange Private Information Store corrupted and the whole organizations Email capabilities halted as well. Quite often, getting the users back up and running takes precedence over getting the data back. Don’t get me wrong; the data is still extremely … [Read More...]

Exchange Server Tools: Use ExMerge To Import PST Files

Exmerge is a very usefull tool that can import PST files back into your Exchange Server Information Stores. Here is a tutorial from our Exchange Engineer John Best on how to use ExMerge.     Using ExMerge to import PST files 1.       Place all of the PST files that you want imported into a single Folder 2.       Make sure the Exchange Information Service is started 3.       You need to make sure the account you are logged in with is an administrative account and … [Read More...]