RAID 5 Recovery and XOR Mathematics in NTFS 5 (Part 3)

In this installment we will explore the practical use of XORing within the context of a RAID 5 recovery. Although the use of this math function in and of itself does not constitute RAID recovery, there are attributes of the mathematics that lend itself to data signatures that can then be used to acquire the RAID 5 configuration. In order to apply the XOR operation we must first understand the format of the Master File Table (MFT), the very crux of the Microsoft NTFS file system.

 

File systems, like most database handlers, use a simple flat file, index method to do look ups and quick displays. The flat file being the MFT, and then INDX record used for fast lookup and displays. Each has its own use within the file system and to a large part are dependent upon each other.

Since the INDX record is not used in the context of RAID 5 recovery for this particular grouping of tutorials we will dispense with its use within the NTFS file system architecture.

Let us leave it to say that in a more advanced context the INDX record does have its uses when assessing a RAID 5. The MFT however offers the clearest path to drive order and stripe size when using the XOR operation. The figure below (Figure 1) is a generic RAID 5 with three drives. The MFT is exposed using the utility WinHex in order to better illustrate how we use XOR to find the parity block within a RAID 5.

mft-boot-record

Figure 1

 

6 Steps To Microsoft Exchange Server Migration

News that Microsoft is to end support for Windows Server 2003 on 14 July this year has masked a more pressing issue for small businesses using Windows Small Business Server 2003 (SBS2003) – the Exchange email component of their system has not been supported since 8 April 2014. This means that should something go wrong with your email server, Microsoft will not provide any patches, service or support, placing your data in jeopardy.

The obvious solution to this problem would normally be to upgrade to the newest version of Windows Small Business Server, thereby addressing both the Windows 2003 and Exchange 2003 problems simultaneously. But Microsoft dropped the Small Business Server (SBS) edition when Windows Server 2012 was released.

This leaves you with a choice – upgrade to SBS 2011 which is already four years old, or make the move to Windows Server 2012 Foundation. The sticking point is that the entry-level Server 2012 Foundation edition offers no native email functionality. Instead Microsoft is encouraging small businesses to adopt the Office 365 service which includes hosted email.

But whether you choose to adopt SBS2011 or Server 2012, you will still need to carry out an Exchange Server migration. Because SBS2011 is relatively aged, this guide will look at the move to Office 365. For further information about upgrading SBS2003 to SBS2011, see this Technet guide.

1. Specify the Office 365 subscription your business needs

Although you can purchase Office 365 subscriptions direct from Microsoft, you may find that in terms of accuracy and speed, using the services of a VAR (value-added reseller) may be more appropriate. They will help you understand how many subscription licenses you need to cover your workforce, and the difference between the available plans.

Because you are replacing your Exchange 2003 server with Office 365, you will need to select the Office 365 Business Premium plan which includes hosted Exchange email. On the plus side

About Data Recovery

When it comes to data recovery there are a lot of myths out there. People are recommending Scandisk or some 10 year old DOS utility as the most sophisticated data recovery tools.

When turning to a discussion group for help after a system crash, you often get to hear: "Just recover from your back-up - you have one, don't you?" Now - that's helpful!

Be assured, most of what you hear about data recovery is not true. Read on...

How to Restore a Single File from VMware VM Backups

I just spent quite some time helping a friend to recover a corrupted virtual machine in VMware Fusion. It’s indeed a long and interesting (sometimes frustrating too) process that I learned quite some that I would never otherwise. I think you might find it useful as well. Hopefully, you don’t get a corrupted virtual machine, but in case you do, I am sure the post will help you.

The Problem

Let’s first look at what happened. Somehow the Windows 7 virtual machine could not boot itself with the following on the virtual machine console:

Windows Boot Manager
Windows failed to restart. A recent hardware or software change might be the cause. To fix the problem:
1. Insert your Windows installation disc and restart your computer.
2. Choose your language settings, and then click “Next.”
3. Click “Repair your computer.”
If you do not have this disc, contact your system administrator or computer manufacturer for assistance.
Status: 0xc0000225
Info: The boot selection failed because a required device is inaccessible.

How did the virtual machine get caught to this state? It’s not very clear, but probably caused by the upgrading of VMware Fusion from 6 to 7 while the Windows virtual machine was starting. Remember the little dialog reminding you that a new version of Fusion is now available and asking if you want to upgrade to it. It’s very easy to click the upgrade button, especially when multitasking on other things.

Anyway, once getting into this state, it’s no longer important on what exactly caused the problem, but how to fix the problem as a user. That’s where the long journey started.

Repairing a Damaged Microsoft SQL Server Database

Symptoms

You may receive the following message in your Microsoft SQL Server Logs:

A read operation on a large object failed while sending data to the client. A common cause for this is if the application is running in READ UNCOMMITTED isolation level. This connection will be terminated.

In particular, you may find this error appears in your Microsoft SQL Server logs while performing an XML Backup, which subsequently fails.

Diagnosis

You may receive this message even if the correct isolation level is set. Execute the following query (replacing confluence-database with your database name):

Get Help Now

Thank you for contacting us.
Your Private Investigator will call you shortly.