0

I have a server in a web farm, with Microsoft Windows Server 2008 Standard Edition used as a Web Server with IIS.

This morning it was not reachable, and after connecting with the KVM I see that it was stuck at boot: No OS Found on any device... or something similar.

I was thinking about a disk failure, but the web farm technicians told me that the hardware is all fine, no RAID issue, all disks are fine, controller ok, etc... and maybe someone has attacked the server and deleted everything.

I'm wondering if it's possible, even if you have the administrative privileges of the OS, to delete a whole machine included all the OS files. Please note that no KVM was connected until this morning issue.

4
  • 1
    A better question would be what partitions are on the disk.
    – Greg Askew
    Commented Dec 17, 2018 at 17:20
  • 1
    Been there and seen that and it WAS a bad raid controller that managed to delete the partition somehow. Nothing to be found, happened once in 10 years on one machine. Rare enough "not to care" (as I actually DO make backups minimum twice per day)
    – TomTom
    Commented Dec 17, 2018 at 17:55
  • If you replace the controller card you might find that the partitions are still there.
    – Larryc
    Commented Dec 18, 2018 at 3:10
  • Web farm technicians have admitted a hardware failure. After replacing the RAID controller, or maybe the whole MB, the system has restarted, re-sync the discs, and fortunately without any data loss.
    – Giox
    Commented Dec 19, 2018 at 22:51

1 Answer 1

0

In theory it might be possible to wipe or modify the MBT of a drive, reconfigure a RAID controller, or wipe a BIOS configuration while the system is active.

It isn't necessarily a hostile action however. A stray gamma ray or magnet could flip the wrong bit or a power surge could hit the system and cause the issue you've described. It's highly unlikely but it has happened. The hardware may not be malfunctioning now, or may simply may not appear to be malfunctioning, but an intermittent failure could have caused the issue as well.

What I would encourage, is to use a tool to see if you can recover drive data. I think TestDisk is what I used last time I accidentally deleted a partition. If it's windows, you might try the mbr repair options like bootrec.exe /fixmbr.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .