OK guys, sorry for the delay but here it is...
you only actually need 2 tools for the job. DD and another progrma called foremost. I have a huge array and that was my main concern because I did not han an array as big as the one with datat lost to copy an image of the drive using dd to another array.
This instruction that I am providing by no means will provide 100% data back. It also asumes you have some basic linux /unix skills. I just happened to be very lucky and all my images were the first things dropped in the array. So I only needed about 60G of space to recover my pics as they took the initial 40 some gigs of the array.
first tool you will need is dd. If you can make an image of the entire drive even better, if you cannot them make the image as big as possible. In my case my array was over 1.2TB but I was very lucky that when I did DD to this array I only transfered about 60G because thats all the space I had left, it just so happens that the pictures were there as they were the first thing recorded into the array.
Once you have the DD image. You are going to need a program called foremost wich can be used on windows or any linux / unix env. I am enclosing the readme for reference.
FOREMOST
----------------------------------------------------------------------
Foremost is a Linux program to recover files based on their headers and
footers. Foremost can work on image files, such as those generated by dd,
Safeback, Encase, etc, or directly on a drive. The headers and footers are
specified by a configuration file, so you can pick and choose which
headers you want to look for.
Here's a sample set of headers and footers:
# extension case-sens max-size header footer (option)
#
# GIF and JPG files (very common)
gif y 155000 \x47\x49\x46\x38\x37\x61 \x00\x3b
gif y 155000 \x47\x49\x46\x38\x39\x61 \x00\x00\x3b
jpg y 200000 \xff\xd8\xff \xff\xd9
once you get this program installed and confured you can modify the headers and footers like metioned above to scan for the file types that are on that dd image. You need to know the headers and footers of the file types. If you don't the program will not work. Once you change and add the footers and heathers to the config file all files in the dd image that match these will be placed on a folder in directory called output.
There are 2 things to take into account. In my case I was just looking fopr images. These files do not take a lot of space so it was easier. In the even your looking for executables or large " 1G++ files " you will need at least 2 places to put data. If you only have 1 drive available and its 120G drive you can split it in 70/30 70% for dd image and 30% to place the files it found. If you need the functionality of searching by keywords if you dont have headers and footers information I would suggest you fully read the sleuthkit and autopsy documentation. Its a little more elaborate than this but if you dont have headers and footers this is the way to go. I have asked other people and they have had very good results with these two programs including on large raid systems. You will find files that were deleted. If you broke the raid conf or reconfigured the raid in any way your pretty much $%#^ed....
So as long as they were just deleted you have a very good chance in getting them back. Just make sure you dont use the same raid to store the files it found or else you will be overwritting everything and recovery will be inpossible.
I hope this helps... and if anyone has any sucess all I ask is for you to post here what were you able to recover and how so that other people can benefit from this as it is a very hard and debatable subject and a lot of people say its almost impossible. I am a living proof that it can be done. Hell these programs might as well just saved me a divorce hahahahahah.
Good luck to everyone needing this.
POPKORN
