Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A customer we recently took over, suffered a catastrophic failure last week due to (what appears to be) hard drive failure, and possibly caused by a faulty power supply. (Take this time to laugh at them for not having recent backups. This question is not about that.)

They were running Windows Small Business Server 2003 R2 Premium, on an Intel-based Xeon with 2GB RAM, and two 250GB Western Digital SATA drives in a RAID 1 configuration.

As it turns out, the RAID was configured with two virtual disks, namely OS and Data. As soon as we realised that the data was corrupt, we used Acronis True Image to image the RAID set.

Once we realised that the Active Directory was beyond repair (all backups were too old to be of any use), we decided to rebuild the box, with a new power supply and new drives. We replaced them with two 1TB SATA drives, in the same RAID 1 configuration. The Acronis image was put on the new RAID set to allow access to their old data.

Now comes the interesting part.

Once the box was rebuilt, a new domain configured, all user accounts recreated, and old email Exmerged from the repaired EDB file, we noticed something very odd. The most recent datestamp on any file, email and SQL database record, was 28 August 2010.

In an attempt to figure out what was going on, I slaved up one of the original drives from the RAID mirror, and noticed that the date was more recent on a number of files, but the data beyond any question of repair.

So my question is: is it possible that the RAID mirror actually failed on 28 August 2010, and this catastrophic failure was coincidental? There is no practical chance to recover anything useful off the drives if slaved up individually, but as a RAID set, we have the Acronis image to work from, but with a 28 August 2010 latest date.

What gives? Where is the last month of data? I'd be interested if anyone can spread some light on this matter.

share|improve this question
1  
I hope you're making it a priority to ensure that in future the data is properly backed up. –  John Gardeniers Oct 14 '10 at 2:16
    
Yes. Our SLA covers full recovery. We inherited the customer very recently. I've voted up your comment. –  user3914 Oct 14 '10 at 2:22
add comment

1 Answer

up vote 2 down vote accepted

I would bet you're right and the mirror has been degraded since 28 August. Whether the disk got bumped loose, the controller suspected the disk was failing (SMART data/read errors) or some other reason, that second disk stopped getting updated then. The system continued to run using with the mirror in a degraded state (one disk spinning, one disk idle) and that spinning disk was no match for a failed power supply.

share|improve this answer
    
That sounds feasible. I didn't notice any errors on startup from the RAID controller, and it said both disks were fine, but it may be wrong due to the dodgy power supply. +1 for you. –  user3914 Oct 14 '10 at 1:26
1  
Sounds the most logical explanation. Have you tried taking a look at the other disk in the old RAID set, you may find more recent data on that. Also, for what it's worth, I've known some cheaper RAID controllers to fail a disk, but provide no feedback about the event until a reboot. All but useless –  Ben Quick Oct 14 '10 at 6:53
    
The data on both disks individually was corrupt, for practical use, although the one did have more a recent date. –  user3914 Oct 14 '10 at 19:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.