A customer we recently took over, suffered a catastrophic failure last week due to (what appears to be) hard drive failure, and possibly caused by a faulty power supply. (Take this time to laugh at them for not having recent backups. This question is not about that.)
They were running Windows Small Business Server 2003 R2 Premium, on an Intel-based Xeon with 2GB RAM, and two 250GB Western Digital SATA drives in a RAID 1 configuration.
As it turns out, the RAID was configured with two virtual disks, namely OS and Data. As soon as we realised that the data was corrupt, we used Acronis True Image to image the RAID set.
Once we realised that the Active Directory was beyond repair (all backups were too old to be of any use), we decided to rebuild the box, with a new power supply and new drives. We replaced them with two 1TB SATA drives, in the same RAID 1 configuration. The Acronis image was put on the new RAID set to allow access to their old data.
Now comes the interesting part.
Once the box was rebuilt, a new domain configured, all user accounts recreated, and old email Exmerged from the repaired EDB file, we noticed something very odd. The most recent datestamp on any file, email and SQL database record, was 28 August 2010.
In an attempt to figure out what was going on, I slaved up one of the original drives from the RAID mirror, and noticed that the date was more recent on a number of files, but the data beyond any question of repair.
So my question is: is it possible that the RAID mirror actually failed on 28 August 2010, and this catastrophic failure was coincidental? There is no practical chance to recover anything useful off the drives if slaved up individually, but as a RAID set, we have the Acronis image to work from, but with a 28 August 2010 latest date.
What gives? Where is the last month of data? I'd be interested if anyone can spread some light on this matter.