Hardware and RAID configuration

8x1TB SATA hard drives from an HP SAN device that was configured with HP thin provisioning.

Problem:

The SAN device failed. No other details were provided. It contained 4 logical volumes with sizes ranging from 1TB to 2TB.

Diagnosis:

• The RAID settings were quickly determined as being standard HP settings.
• All four logical volumes were in NTFS format.
• The HP SAN had its own virtual file system. Each logical volume was a virtual disk file in the HP file system. We determined early on that recovering the virtual file system was difficult.
• With thin provisioning storage is allocated dynamically as it is needed. Therefore the virtual disk files were highly fragmented. Each virtual disk file consisted of thousands of fragments.

Solution:

• We used advanced file carving techniques to find the fragments for each virtual disk file. With the understanding of the HP SAN disk space allocation policies, we were able to locate 95% to 98% of the fragments.
• Finally the fragments were assembled into the original virtual disk files. The recovery of files and folders from the virtual disk files was straightforward using File Scavenger®.

Result:

• Between 95% and 98% of data was recovered.
• The unrecoverable files were mostly large binary files. For this customer they were unimportant.