Single drive content from Raid 5/6

Discussion in 'SSDs & Data Storage' started by IndianX, Sep 3, 2018.

  1. IndianX

    IndianX n00bie

    Messages:
    4
    Joined:
    Sep 3, 2018
    Hi,

    I had 9 drive Raid 6 setup on Synolgy 2415+ Nas Storage setup. I have deleted the raid and resetted the NAS and sold the NAS and 4 drives form bay 2,3,4 and 5. I kept the rest.

    I completely forgot but i was wondering since I have not formated or securely deleted the data on those 4 drives is it for the other person possible to read or recover any files on those 4 drives? Can he find out what was on it? Any Filename readable from single drives?

    Just want to know if anyone can find what was on those 4 drives out of 9 drives raid 6 setup. Iam also not sure if encryption was enabled.

    Thanks
     
  2. kdh

    kdh Gawd

    Messages:
    652
    Joined:
    Mar 16, 2005
    Crap shoot. It may not be enough to build complete files. The data is stripped across all the drives. raid 6 has 2 parity drives. If one of the remaining 4 drives was a parity drive, he may be able to recover "something".. but most likely not complete data or files. if they were SED drives, you don't have much to worry about.
     
  3. IndianX

    IndianX n00bie

    Messages:
    4
    Joined:
    Sep 3, 2018

    Thanks a lot for answering. I dont care about the data. I don't know much about raid.

    I kept the drives from bay 1, 6,7,8 and 9. Basically I kept 5 out of 9. You think that simple data recovery software might see some file names??? Highly unlikely the person might go ahead to go to professional recover my company . Just want to be sure that the person cannot see the filenames at all.
     
  4. drescherjm

    drescherjm [H]ardForum Junkie

    Messages:
    13,915
    Joined:
    Nov 19, 2008
    Some of the filenames will be recoverable by looking at the individual disks. The files will mostly be not recoverable (some 1 sector sized files may be recoverable if you can find them).
     
    Last edited: Sep 4, 2018
  5. IndianX

    IndianX n00bie

    Messages:
    4
    Joined:
    Sep 3, 2018
    So if I use a normal recovery file software I should see some filenames? I do have 5 drives. Would like to give it a test run. Any suggestion which software I could use. Just want to make sure what might come up as curiosity.

    Thanks
     
  6. drescherjm

    drescherjm [H]ardForum Junkie

    Messages:
    13,915
    Joined:
    Nov 19, 2008
    Normal recovery will likely need enough disks to start the raid (which you don't have), however if you look at a hex dump of the filesystem on the individual disks the file names should be present burred in between the data. This will be a manual process and take time. I am assuming here that you did not encrypt your filesystem.
     
  7. IndianX

    IndianX n00bie

    Messages:
    4
    Joined:
    Sep 3, 2018
    50/50 I have encrypted it. Overall might i be at ease here becauee they have only 4 out 9 drives and since it is a manual process they might not bother to find anything.
     
  8. kdh

    kdh Gawd

    Messages:
    652
    Joined:
    Mar 16, 2005
    Its a crap shoot. It depends on the implementation of raid on the card itself and the underlying format of the filesystem. Meaning your original post said something about a Synology array. A quick google shows it uses BTRFS which appears to use Linux as its OS.

    So using a basic tool like Recuva(kinda my favortie for windows) wouldn't work as its focused on NTFS/Fat32 Filesystems.

    There appears to be a few ways to recover deleted files with BTRFS via google, but they are also assuming you have an online functioning volume to begin with. You have only pieces of it. Anything is possible, but unless someone is super savy with the BTRFS, the implementation of it, and the underlying raid card setup running it, it'll be very hard for the average DIYer to get anything valid off of it much less a professional service. As others have stated, you may see filenames and piece of the files, but thats about it.

    As a basic ugly test.. You could take one of your drives, USB it into a Linux machine. Once you have the device ID, you could do something ugly like "cat /dev/sdd | strings | less" and just see what human readable gobbly gook is in there. That is what I usually do when I'm looking a oracle asm headers on volumes trying to figure out how they are labeled or if they are even being used.
     
    drescherjm likes this.
  9. drescherjm

    drescherjm [H]ardForum Junkie

    Messages:
    13,915
    Joined:
    Nov 19, 2008
    I second this recommendation. Very good advice.