We had an admin delete some folders from a CIFS share. He was in the process of moving data off of our EMC to our HP 3par. After robocoping the data to the new location he had forgot to disable the share on the EMC. He had waited several months to wipe the data off of the EMC and didn’t realize that users were still mapped to the EMC. At this point you would think we could restore from backups. Not so lucky. The backups we had are stale. He had disabled backups from this location to conserve space on our backup device. What about snapshots you say? Well that share was configured without snapshots. I have already looked.
I’m looking for a way to recover that data without sending it offsite to a data recovery company. I have performed several recoveries before but always had direct access to the drives. This was not setup for iSCSI so I’m not sure how to gain direct block level access to the drives. There are 18 3tb drives in the Capacity Pool and it is set to RAID 6. I have considered pulling drives out of the EMC and try direct attaching them to my PC. But not all 18, just what I need to rebuild the array for recovery.
Where should I start? How can I gain access to the drives to try to perform a recovery? Is this even possible?
3 Spice ups
You are way out of your league. Don’t touch it, call EMC and data recovery companies.
3 Spice ups
EMC uses a proprietary file system (UxFS). On the 3150e is a bit of a Frankenstein box. There are several OS’s melded together with RSA’s voodoo hypervisor.
The Block side managed by the windows based FLARE OE, uses UxFS. It then create LUNs and presents them to the Unix based DART NAS code which then stripes a file system on top of the existing file system.
You stand absolutely zero chance of recovering this on your own.
These devices have quite a few odd quirks, and I’ve seen them trigger resume generating events way to many times. In this case though it was self inflicted at least.
7 Spice ups
I’ve never looked into the architecture of these things- what do you mean by RSA voodoo?
2 Spice ups
Think it was called C4 or something. I think they quit using it with the 100x improved VNX3200e.
2 Spice ups
We have already come to the conclusion that the data is lost. Upper management doesn’t want to spend 15 to 20 thousand to recover the data. If we could recover the data in house it would be a bonus but not critical. I’m just looking into if this is realistic to do in house.
FYI, I’m not the one that created the problem. Just the one that was asked to look into the resolution.
Call EMC is my best advice then.
3 Spice ups
Nope. As was stated above:
1 Spice up
EMC has already told me that they are not into data recovery. They have pointed me in the direction of Ontrack. I will contact Ontrack to see if there software will help me out in anyway. I doubt it though as I’m sure I would need direct access to the drives some how.
Thanks for your input. This lets me know that it is probably way out of my league.
Unfortunately I am also very negative on your chances here. We or Ontrack could always take a look. It would probably be an exercise in futility though if the data isn’t that critical and the company isn’t willing to put money into it like you said.
No snapshots or recycle bin?
I agree there isn’t much you can do on your own. Someone would need block access to do the lower level stuff but then the proprietary nature can be a major hindrance. There is no commercial utility for CIFS. I know you could find some raw data scraps but it probably would not be very helpful depending on the block size, the type of data, and the way this device works. As a longer running research project, someone might find some way to get larger chunks of data together, but that’s reaching and from your statements it’s likely nobody wants to do that.
2 Spice ups
We have decided to send the EMC off to 24 Hour Data (www.24hourdata.com) for recovery. I was able to use your post’s to guide upper management into making the decision to send it off for recovery. Thanks for all the replies.
Keep us posted on how it goes!
1 Spice up
Just curious about end of this story?
petricarosca
(Petri (Greater Boston Area))
15
All server storage companies do not perform data recovery. At best, they would recommend somebody.
As far as this case, indeed, the proprietary nature of the file system will pose some heavy challenges.
