Indexes in the NTFS

The term index is used to define an ordered list of files which are meeting certain criteria. The simplest and most common index is a group of files in a directory, sorted by name.

Thus, such indexing used in NTFS filesystem (storing copies of some attributes) can lead to great performance improvement since the number of disk read requests is decreased. For a regular operation, NTFS filesystem requires both Master File Table records and indexes. But it should be noted that to restore data from the NTFS file system, indexes are not required for MFT entries alone are sufficient. This is because exactly the same data as in index is contained in MFT records themselves. So it is not required to take into account indexes when extracting data from the NTFS filesystem.

But in case of chkdsk tool, it has to make sure that all the indexes are in a consistent state, otherwise NTFS filesystem is not able to work in a normal (fast) way. It is interesting that if chkdsk tool works on the disk which is copying data, then the tool may show false errors. This is due to MFT and indexes updates may be not synchronized.

Restoring digital image files from memory cards

It often happens that while doing the digital photo recovery, typically off an SD card, the small image previews (called thumbnails) are recovered OK, but full size images are damaged. This behavior is explained by so called "file fragmentation". The fragmentation is said to occur if the file is stored on the disk in multiple non-contiguous blocks. The sketch explaining the fragmentation can be seen at the Photo Recovery Limitations page.

In most cases memory cards use FAT or FAT32 and when the file is deleted on the FAT filesystem, only the information about the 1st fragment remains. The second and the following data blocks cannot be recovered. Thumbnail image is usually small and it is placed near to the very start of the file, hence it can be often extracted OK, while the high resolution photo will be lost.

Of all the data recovery types, fragmentation mostly affects digital photo recovery and unformat on FAT filesystems. Using the file recovery utilities in this case is almost always useless, for there is no needed data in the restored file.

What are the chances to recover NAS with Linux OS?

On www.nasrecovery.info it is mentioned that you can use Linux to recover NAS. In practice it does not work at all or at least you cannot obtain any meaningful results.

Imagine the following: you assemble RAID inside VMware with md-raid driver. Then you restart VMware and see that one of the array member disks has dropped out off the array. Sad but true - this situation is fairly common. Although it is proved that VMware always works reliably - it is known that hardware can fail in different ways while failures of a virtualized hardware are rare and always the same.

So there is very little chance to recover the RAID with valuable data using Linux. Keep in mind that it makes sense to try several different Linux versions because, as of now, quite a number of Linux versions are available for downloading in the web.

Still, there is a bright aspect of the issue, which is never advertised at www.nasrecovery.info - some NASes do, in fact run under Windows Embedded.

Network Attached Storage and backup power

They say you should test your NAS in different ways. One of the aspect of such testing is to see how your NAS responds to a power failure. Most interesting cases are where NAS is combined with UPS unit. Just cutting off the power is not sufficient to check an UPS. In normal operation Network Attached Storage receives the messages from an UPS unit constantly and reacts at once.

However, NAS is unable to accept the notifications on power failure during the start up. Additionally, one should consider that the entire cycle (start up then shut down) may require a couple of minutes.

Let's imagine such a scenario:

1. power failure occurs,
2. your NAS unit works on battery for some time and then it shuts down,
3. then power comes back and the Network Attached Storage begins to start up,
4. at this moment power is off once again.

Now the most interesting thing - until NAS starts up it cannot find out that the power failure has occurred.
Once Network Attached Storage loads, it finds out that the power is off and sends a command to shutdown. But it may happen that the system will not be able to shut down correctly since UPS is not capable of supplying power long enough due to battery exhaustion (during the first cycle).

You can avoid such an issue by setting the NAS up in such a way that it shuts down as soon as it gets a message about power failure. All this allows saving battery charge to do one more cycle.

Alternative would be to set the Network Attached Storage up to restart manually, but not in automatic mode after the power failure has occurred.

Complex level RAID100

If you go to Wikipedia you note that RAID 100 is categorized as the nested array layout. There RAID100 is defined as RAID0 that is built on several RAID10 arrays. Thus it turns out that data stored on the disks in RAID100 is exactly the same as in RAID 10.

 So, it is possible to get RAID 0 from RAID 100 array by excluding one disk in each mirror pair. And one more consequence is that RAID100 recovery boils down to RAID0 recovery given that you can get RAID0 form the member disks of RAID10 arrays.

Difference between RAID5 and RAID 5+0/RAID6 and RAID60

Let's consider what is common between RAIDn and RAIDn+0 and how do they differ?

• given arrays are the same with regard to fault tolerance;
• RAID 5 and RAID 50 can withstand only one member disk failure;
• RAID 6 and RAID 60 can survive two disks failure supposing we talk about a 100% probability.

RAIDn+0 arrays have more chances to survive more than one (in RAID50) or two (in RAID60) member disks failure, although not a 100% probability. You can estimate survival probability for various RAID layouts at www.raid-failure.com.

• During the rebuild, RAIDn+0 delivers greater performance as compared to RAIDn which is good.
• RAIDn+0 overhead to provide fault tolerance is more than for RAIDn arrays. RAIDn+0 overhead is one disk per each RAIDn disk group.

Let's make a conclusion - RAID n+0 should be used in case of a large storage while RAIDn - in small (I mean number of disks) arrays.

One of the basic data recovery rules is to verify the recovered data

Most data recovery tutorials insist on verifying the recovered data, but usually most people ignore it. So the following scenario may happen:

1. you recover files and the folder tree seems good enough,
2. the disk is formatted or disk data is destroyed some other way,
3. then you see that the restored data is not recovered properly.

It is evident you need to restore disk content once again. Unfortunately, the original hard disk content does no longer exist.

To sum up the above - it is needed to verify the extracted data first and only then begin to fill the original disk with new files.