Hardware and RAID configuration

4 x 3-TB SATA hard drives from a QNAP NAS.

Problem:

The RAID was working, but movies were accidentally deleted.

Diagnosis:

• The RAID settings were quickly determined. The file system was ext4.
• Typically when data is deleted from an ext3 or ext4 volume, one can only perform raw recovery. ext4 wipes the metadata of a deleted file almost completely. Standard recovery is not possible. Raw recovery uses the file header signature to locate it. File types without a signature cannot be recovered. Fragmented files whose contents are not stored contiguously on disk cannot be recovered.
• Thanks to a quirk in ext4 a very large file retains some of its metadata after being deleted. With the remaining metadata and by using advanced raw recovery techniques we were able to locate and restore the fragments of each movie file. Then we assembled the fragments into the original movies but without filenames.
• ext4 usually wipes the filename during deletion. However in this case it was by pure luck that the filenames were of equal length and, because of this, survived the deletion. Over 95% of filenames were restored.

Solution:

• First we ran File Scavenger® to restore the deleted movies without name.
• Then we manually recovered the filenames and matched them to the movie files.

Result:

• Over 95% of movie files were completely restored with name.
• Less than 5% were not restored due to their small size (thus not triggering the ext4 quirk). For these files only the first extent was restored using the header signature.