Altirium logo

Archive for the ‘Data Recovery’ Category

Unlucky 13?

Being a generally optimistic person and not believing in bad luck, not even if someone turns up with an OnStream cartridge, the prospect of 13 x LTO2 tapes containing ARCserve backups was not of particular concern. Then the additional information was provided, they had been to another company for restoration and there was a problem with the data, the backups were corrupted and could not be restored, “was there anything we could do”?

Not having seen the tapes it was not honest to give more than a cautiously optimistic opinion. No-one here had encountered a corrupted ARCserve backup since some problems with Adaptec 1542 cards and MSDOS with too much memory installed back in the early 1990s. It seemed more likely we would find that they were either not ARCserve at all, or else were encrypted.

When the tapes arrived it all became clear. They were ARCserve with multiplexing, which means that the backup data from several backups can be interleaved and any attempt to proceed in a linear manner without first loading and interpreting the ARCserve MUX (multiplex) tables is going to end in tears, or at least with worthless data. The next challenge was restoration within an average life-span, restoring a single backup would be relatively straightforward one the MUX tables had been correctly interpreted, but with over a hundred backups per tape the idea of restoring one set at a time was not overly appealing as each tape would have to be read over 100 times, effectively turning a 13 tape restore into a 1300+ tape restoration exercise. This is where the benefits of developing software for tape restoration come to the fore, and being able to modify code to enable the simultaneous processing of all backups so each tape took less than 3 hours to read.

Once the tapes had been catalogued the required Exchange email data was located. Anyone fancy a guess at which number tape it was on? Sorry, that would have been too poetic, it was on tape 7.

 

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)

What’s in your toolbox?

If you’ve ever wondered what tools a technical data recovery engineer might use on a daily basis, then here are my top five  tools, although they may not be quite what you’re expecting.

If you think that data recovery is just about running a bunch of software tools on hard disks or RAIDs or data from backup tapes then for a professional technical company, this is far from the truth. As a data recovery expert my job at Altirium involves interrogating raw data and writing software to solve often complex problems. This is one thing that I think sets us apart from some of the other companies in the data recovery industry. Yes we use “off the shelf” recovery software where it’s appropriate but often they are found lacking and don’t give the best results or properly report their findings. Therefore to recover data where there are no tools available, we develop them in-house.

Some of the achievements we’ve delivered in the past 12 months, using my top five tools include:

  • Reverse engineering the MS SQL Server data structures and written software to recover data from dropped tables, where off the shelf tools failed.
  • Extending our Tivoli Storage Manager recovery software capabilities, adding extractors for more data sources and software compressed data.
  • Identifying and implementing the processing of many undocumented structures in the Microsoft Tape Format, used in software such as  Symantec BackupExec.
  • Reverse engineering Atempo Time Navigator backup format including processing of software compressed data.

All of this has contributed to solving genuine data recovery issues and has saved the companies that have come to us, thousands of pounds in lost revenue, many hours of support time and countless terabytes of potentially “unrecoverable” data.

Here are the top five tools that I use pretty much every day during the course of my job.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 9.0/10 (4 votes cast)

Recovering dropped table data from an MSSQL MDF file

Many off-the-shelf  Microsoft SQL Recovery tools state that they can recover from corrupt files, deleted data and some claim to recover from dropped tables, so the recent arrival of an MSSQL Recovery into the lab (all of the tables within the database had been dropped) gave us the ideal opportunity to undertake some tests. From looking at the MDF file of the database, the data was still present, yet out of the 4 or so packages we tried “NONE” of them could retrieve any of the dropped tables, yet we were still able recover the required data for our client.
Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)

Data recovery from a partially rebuilt RAID

I’ve often heard it said, “the RAID has been rebuilt – the data cannot be recovered” and often this is the case. With RAID5, if the configuration is changed, and new parity is calculated, then there will be a significant loss of any data that was previously stored on the RAID.

As Hamlet so eloquently put it “There are more things in heaven and earth, Horatio, than are dreamt of in your philosophy.”, just because something is outside of our normal experience does not mean that it is not possible.
Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 7.0/10 (3 votes cast)

How do you restore Tivoli TSM data for forensic examination purposes

Tivoli Storage Manager (“TSM”) provides a sophisticated heterogeneous data storage environment within which large volumes of data can be held. These might include email backups, user documents and SQL database, in fact all of the information that might be just a little bit useful in a computer forensic investigation or a tape data discovery exercise.

So, you are an investigator who has been handed a case containing 25 LTO4 cartridges from a TSM archive, now what?
Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)

Recover a bit but lose a block

When attempting a data recovery from a Microsoft Exchange email server after a catastrophic failure, and when I say catastrophic I mean, no backup to restore from and file system corruption or file deletion that has rendered the Exchange information store files inaccessible, one of the tools in Altirium’s data recovery arsenal was to trawl the entire disk or RAID volume and identify pages of Exchange data and rebuild the information store from the ashes. However when Microsoft engineers decided to change their page error correction method so that they could correct a single bit error in a page this seemingly minor ‘upgrade’ had dramatic effect in the ability to identify Exchange page data.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 8.0/10 (1 vote cast)

Is a NAS RAID reconfiguration the end of your data?

The popularity of Network Attached Storage (NAS) RAID units has never been higher. For a small outlay a low powered, easy maintenance, storage device of 1TB or higher can be plugged in and used where once an expensive server with disk storage would have been the only option. Whilst RAID5 gives a high degree of reliance against the failure of any one disk in the NAS unit, other problems can result in an apparent total loss of data and a requirement for a NAS Data Recovery.

A NAS storage device  in need of recovery was delivered to us last week. The customer had been using the device and on Friday evening all data was present and correct, but when the customer went to access the device on the Monday morning it was operational but there was no data present. So where had it gone and could a data recovery be achieved?

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)

TK50 data recovery, look out for media degradation

TK50 was a major player in tape backup on VAX/VMS systems several years ago. Being fundamentally ½” (half inch) tape of the type used in open reel drives, but housed as DLT style cartridge, it suffers from the same long term storage problems as some brands of 1/2″ media. TK50 drives could store 70MB of data, and took quite a long time to fill, so have long since ceased to be a viable backup option even if you can find drives and media. But, there are a surprising number of tapes out there with data on them and recent weeks seem to have brought forth a flurry of requests to get data from them, and in one case to copy some. In a high proportion of these cases the data transfer operation has ended up being a data recovery exercise involving considerable work in the lab.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 7.0/10 (1 vote cast)

Data Recovery – Don’t take no-fix for an answer

When I first started in the data recovery industry back in 1995 data recovery was very much a specialist area of expertise. There were no ‘off the shelf’ data recovery software tools. We had to develop our own methods and techniques to get the job done. These days however the data recovery market place is flooded with companies offering such services, so how do you know who to choose?

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 7.5/10 (2 votes cast)

Data Recovery when everything fails

Much data recovery work involves the salvage of data from one specific type of storage, a hard drive, RAID array, backup tape or DVD. Occasionally a requirement pops up that transcends this norm.

Having faithfully adhered to a regime of nightly backup of a SUN UNIX system, the failure of the hard drive appeared to be an inconvenience that would soon be overcome for this customer. The hard drive having swiftly been replaced, the backup tape was brought back from storage and the restore process initiated. Five minutes in, however, and the DLT drive made a nasty noise, the cleaning lights came on and ufsrestore became ufs-cannot-restore.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)