Single drive content from Raid 5/6

[IndianX]

Hi,

I had 9 drive Raid 6 setup on Synolgy 2415+ Nas Storage setup. I have deleted the raid and resetted the NAS and sold the NAS and 4 drives form bay 2,3,4 and 5. I kept the rest.

I completely forgot but i was wondering since I have not formated or securely deleted the data on those 4 drives is it for the other person possible to read or recover any files on those 4 drives? Can he find out what was on it? Any Filename readable from single drives?

Just want to know if anyone can find what was on those 4 drives out of 9 drives raid 6 setup. Iam also not sure if encryption was enabled.

Thanks

 

[kdh]

Crap shoot. It may not be enough to build complete files. The data is stripped across all the drives. raid 6 has 2 parity drives. If one of the remaining 4 drives was a parity drive, he may be able to recover "something".. but most likely not complete data or files. if they were SED drives, you don't have much to worry about.

 

[IndianX]

Crap shoot. It may not be enough to build complete files. The data is stripped across all the drives. raid 6 has 2 parity drives. If one of the remaining 4 drives was a parity drive, he may be able to recover "something".. but most likely not complete data or files. if they were SED drives, you don't have much to worry about.

Thanks a lot for answering. I dont care about the data. I don't know much about raid.

I kept the drives from bay 1, 6,7,8 and 9. Basically I kept 5 out of 9. You think that simple data recovery software might see some file names??? Highly unlikely the person might go ahead to go to professional recover my company . Just want to be sure that the person cannot see the filenames at all.

 

[drescherjm]

Some of the filenames will be recoverable by looking at the individual disks. The files will mostly be not recoverable (some 1 sector sized files may be recoverable if you can find them).

 

[IndianX]

So if I use a normal recovery file software I should see some filenames? I do have 5 drives. Would like to give it a test run. Any suggestion which software I could use. Just want to make sure what might come up as curiosity.

Thanks

 

[drescherjm]

So if I use a normal recovery file software I should see some filenames?

Normal recovery will likely need enough disks to start the raid (which you don't have), however if you look at a hex dump of the filesystem on the individual disks the file names should be present burred in between the data. This will be a manual process and take time. I am assuming here that you did not encrypt your filesystem.

 

[IndianX]

50/50 I have encrypted it. Overall might i be at ease here becauee they have only 4 out 9 drives and since it is a manual process they might not bother to find anything.

 

[kdh]

So if I use a normal recovery file software I should see some filenames? I do have 5 drives. Would like to give it a test run. Any suggestion which software I could use. Just want to make sure what might come up as curiosity.

Thanks

Its a crap shoot. It depends on the implementation of raid on the card itself and the underlying format of the filesystem. Meaning your original post said something about a Synology array. A quick google shows it uses BTRFS which appears to use Linux as its OS.

So using a basic tool like Recuva(kinda my favortie for windows) wouldn't work as its focused on NTFS/Fat32 Filesystems.

There appears to be a few ways to recover deleted files with BTRFS via google, but they are also assuming you have an online functioning volume to begin with. You have only pieces of it. Anything is possible, but unless someone is super savy with the BTRFS, the implementation of it, and the underlying raid card setup running it, it'll be very hard for the average DIYer to get anything valid off of it much less a professional service. As others have stated, you may see filenames and piece of the files, but thats about it.

As a basic ugly test.. You could take one of your drives, USB it into a Linux machine. Once you have the device ID, you could do something ugly like "cat /dev/sdd | strings | less" and just see what human readable gobbly gook is in there. That is what I usually do when I'm looking a oracle asm headers on volumes trying to figure out how they are labeled or if they are even being used.

 

[drescherjm]

You could take one of your drives, USB it into a Linux machine. Once you have the device ID, you could do something ugly like "cat /dev/sdd | strings | less" and just see what human readable gobbly gook is in there. That is what I usually do when I'm looking a oracle asm headers on volumes trying to figure out how they are labeled or if they are even being used.

I second this recommendation. Very good advice.