Dell PowerEdge T630 RAID recovery: a deleted folder found across ten drives
Ten drives from a Dell PowerEdge T630 came in, set up as a RAID 10 file server and three RAID 1 pairs. The customer suspected a folder had been deleted from one of the arrays. After the drives were copied, the engineers found several virtual machines with multiple partitions, which were scanned and copied to portable drives. The deleted folder was then found.
| Service | RAID 10 data recovery |
|---|---|
| Drive | 10 drives: RAID 10 file server (1.82TB) + three RAID 1 pairs (930GB each for the two server pairs) |
| Make and model | Dell PowerEdge T630 |
| System | Server: file server, mail server, mail database, installation media |
| Symptom | Folders suspected deleted |
| Diagnosis | Virtual machines with multiple partitions on the arrays |
| Work done | Sector-by-sector copies, virtual machines found and scanned, deleted folder found |
| Outcome | Deleted folder found; virtual machines copied to portable drives |
The server and what the customer noticed
A Dell PowerEdge T630 with ten drives, numbered 0–9. The customer was after deleted data and suspected that folders had been deleted in one of the configurations.
What examination established
- Drives 0 and 1: RAID 1, installation media, which didn't need recovering.
- Drives 2–5: RAID 10, the file server (1.82TB in total).
- Drives 6 and 7: RAID 1, a mail server (930GB in total).
- Drives 8 and 9: RAID 1, the mail database (930GB in total).
What changed the approach
Once the drives were copied, the arrays turned out to hold several virtual machines with multiple partitions, which meant a lot of data in total.
What the lab did
- Copied the original drives sector by sector.
- Found the virtual machines and their partitions.
- Scanned the virtual machines and copied them to portable hard drives for the customer to keep as backups.
- Found the deleted folder and copied it to one of the portable drives.
Engineer's notes
After clones of the original drives were made, the engineers had managed to find multiple virtual machines with multiple partitions, this meant that there was a lot of data in total.
Outcome for this case
The deleted folder was found, and the virtual machines were copied to portable drives as backups.
What this case shows
A server can hold several arrays, and the arrays can hold virtual machines. Here the work went in sequence: copy the drives, find the virtual machines, scan and copy them, then find the deleted folder. This was a logical failure: the data had been deleted.
What it doesn't show
How long the work took, or what it cost.
Related: RAID 10 data recovery · QNAP RAID 10 recovery: six drives from two NAS units: failed drives, not deleted data
Deleted data on a RAID server? Stop using it, and contact us. No recovery, no fee for most jobs.
Contact R3 Data Recovery
To discuss a data loss incident, contact our team by telephone or submit an enquiry online. An engineer will review your situation and advise on next steps.