cancel
Showing results for 
Search instead for 
Did you mean: 

Raid 5 failed, but got a v2i image of it.. but not working..

OxYi
Level 3
My E drive was my data drive with raid 5, which it just 2 HD just failed, but I have three different images stored onto the USB HD.

Now when I tried to mount the recovery point,  it woudl tell me that drive is not formatted , and ask me to format it.  All three of them.

When I tried to restore to a empty HD, I get : 


Error EC8F178F: Cannot complete the restore of recovery point: C:\E_Drive092.v2i. Error EC8F03F2: Cannot copy data from the recovery point to the destination. Error EBAB000E: 71119692 is not within the valid range for this value. Details: 0xEBAB000E  Source: Backup Exec System Recovery


When I do the VHD conversion, I get :

Error EC8F1F48: The conversion process could not be completed. Error EC8F1F45: Cannot convert image file. Error EBAB000E: 71119692 is not within the valid range for this value.
Details: 0xEBAB000E
Source: Backup Exec System Recovery


I've verify my image and it says the recovery point is valid.  When I did my backup, I have the verifiy backup after it's done checked.

When the recovery point is mounted, it would show "data" which is the name, and the size 40gb, but can not access anything at all.

Anyone know what's going on and a fix for it ? 

thanks !
3 REPLIES 3

David_F
Level 6
Employee Accredited


 
Oxyi,

This problem often occurs due to disk layout of the volumes, file system structures, and the behavior of the operating system at the time the recovery point image was made.

Though verification is turned on during the imaging process, the verification process only validates that what was backup was indeed what was seen during the snapshot phase of a drive at that specific time. If there was drive corruption, not severe enough to prevent us from backing up the drive in the first place, BESR - being a sector base imaging product - will backup the drive even if file system corruption exist.

If the corruption is a disk descriptor needed to give our mounting driver the ability to read the disk layout stored within the image, such as what the utility Recovery point browser will do when opening a recovery point image, it will open the image but would show you a drive of empty contents as you have described. If you run a validation of the image again it will come back still valid since the data, at the sector level, matches the copied snapshot image per check sum per block of data at the time of its creation; it does not validate the file system integrity.

If you do not have recovery point images dating back before the file system corruption I would perform the following steps:

1. Check you windows system event logs to see if you have system events from the source ‘Disk’; investigate the event Id assigned to it.
2. Within your troubleshooting you ran a Check disk on the original RAID 5 array. And you got an error similar to: File system is RAW; CHKDSK is not available for RAW drives.
3. Drive shows up in Disk management, and a drive letter has been given to it, but prompts to be formatted

If so, and you still have the original disks, I suggest seeking out data recovery service or software; you might still be able to recover data from these volumes.

If you do not have the original drives still and though you got these errors, if this occurs near the end of a restore proceed in seeing if you can recover the data through a recovery service or software.

I have not seen, << has anyone else in the forums>> if a recovery service or software is capable of restoring files from a software mounted drives. If it was able to as soon the drive is dismounted, for what ever reason, the changes to the virtual drive, at least through BESR would be lost; changes made to a mounted recovery point image are not saved to its corresponding recovery point file.

-Dave

OxYi
Level 3
Hi David,

Thanks for getting back at me. 

When I mounted the recovery point, it dind't show me an empty content, it doesn't show me anything but the HD icon, and if i want to access it, it asked me if I want to format it.

But this maybe the same thing as what you described.

I tried mounted the reocvery point and run the recovery software, and it doens't show the mounted drive at all, so there is no way of me accessing it right now.
We had a good image back at Dec, 2008, so I guess we will have to restore back to that one.

Just some thought about this,   if I was just let BESR run the backup according to its schedule, and everytime it tells me the backup was good, and now when I tried to restore the data because of HD failure, and I am not able to,  isn't that defeat the purpose of verify the backup job or the purpose of my work buying this software ?  So in order for me to make sure that my backup is good, I would need to take each image and mount them? 

Thanks,

marcogsp
Level 6
OxYi,

BESR is like any other backup solution, as it is susceptible to GIGO, or Garbage In, Garbage Out..  As BESR is a sector based backup product, it is most likely verifying the image based on check sums of the sectors that are imaged.  Whether the sectors contain useful data is another point altogether.  As long as the check sums match, then the drive would be considered successfully imaged.  I know your story has caused me to be more vigilant about opening my BESR images with the image browser to verify that the data is useful.

As for David F's question about BESR images being useful for forensic recovery, it might depend on how closely BESR comes to imaging bit for bit.  I know when electronic media is involved in a criminal investigation, it is extremely important that every bit remain intact on the original media, or the case is lost.  For that reason, a forensic image of the media must match bit for bit if it is to be used as evidence.  I'm not sure of the standard for data recovery, but it stands to reason that if the images are up to criminal investigation standards, then the recovery will have a better chance of succeeding.

When I was a field service tech, I sometimes got asked about sending drives off to a recovery service.  The standard I always used was that the data had to be worth at least $1000.00 to make it feasible.  The fee to get the drive on the bench is going to be $200.00 to $400.00 (possibly more) before any data recovery even begins.  If recovering your system from a December 2008 image and bringing the data up to date costs less than or around $1000.00 in labor, then you are better off to go that route

Marco