Directory Reset - Files Gone

[lundp]

Problem: Mac OS X 10.3.9 Server - Retrospect 6.1 - File Directory

I have a Mac OS X Server setup with two external Firewire HDs configured in a RAID (mirror). The format of the drives is Extended Journalling. Last week, we put another external FireWire hard drive on the server to backup the files using RetroSpect. We did the backup Jan 9, 2006. The rest of the week thru Jan 13th, the server users happily did their work, storing files for the newspaper production.

On Monday morning, the server locked up around 3:15 am in the morning. The staff came in at 8:15 am and rebooted the server. The reboot brought the server online again. However, the files stored on the server after Jan 9th, were missing. There were a couple dozen photo files from Jan. 13th, but all Quark and Word files were missing. Other scanned images, and related newspaper files were gone. No where to be found.

The use of DiskWarrior and Tech Tools (latest versions) did not find any files or problems.

I am enclosing the Console log file of the events from the reboot this morning. Can anyone tell me what happened as to the loss of all those files?
I am speculating that the Mac OS X journalling feature has something to do with writing a backup of the file directory to the external hard drives that store our data. Otherwise, I can say that I have never seen a case like this happen before.

And the Retrospect logs do not show someone restoring the backup over the files. Just in case someone was think that was the case.

Thanks.

---------------------
Jan 16 03:15:01 server syslogd: restart
Jan 16 03:15:01 server 700.daily.server.cyrus: Error: '/etc/MailServicesOther.plist' dictionary 'postfix' does not contain a dictionary with key 'log_rolling_days_enabled'.
Jan 16 08:13:43 server kernel: AppleRAID::completeRAIDRequest - error detected for the set, "Herald_Data_1", status = 0xe00002ca.
Jan 16 08:18:38 server kernel: AppleRAID::completeRAIDRequest - error detected for the set, "Herald_Data_1", status = 0xe00002ca.
Jan 16 08:21:48 server kernel: AppleRAID::completeRAIDRequest - error detected for the set, "Herald_Data_1", status = 0xe00002ca.
Jan 16 08:24:40 server last message repeated 3 times
Jan 16 08:37:16 localhost syslogd: restart
Jan 16 08:37:16 localhost syslogd: kernel boot file is /mach_kernel
Jan 16 08:37:16 localhost kernel: standard timeslicing quantum is 10000 us
Jan 16 08:37:16 localhost kernel: vm_page_bootstrap: 252904 free pages
Jan 16 08:37:16 localhost kernel: mig_table_max_displ = 68
Jan 16 08:37:16 localhost kernel: IOKit Component Version 7.9:
Jan 16 08:37:16 localhost kernel: Wed Mar 30 20:07:52 PST 2005; root(rcbuilder):RELEASE_PPC/iokit/RELEASE
Jan 16 08:37:16 localhost kernel: 77 prelinked modules
Jan 16 08:37:16 localhost kernel: Copyright (c) 1982, 1986, 1989, 1991, 1993
Jan 16 08:37:16 localhost kernel: The Regents of the University of California. All rights reserved.
Jan 16 08:37:16 localhost kernel:
Jan 16 08:37:16 localhost kernel: using 2621 buffer headers and 2621 cluster IO buffer headers
Jan 16 08:37:16 localhost kernel: Adaptec78XXSCSIController: Adapter verified by HIM.
Jan 16 08:37:16 localhost kernel: Adaptec78XXSCSIController: Resetting Hardware.
Jan 16 08:37:16 localhost kernel: Local FireWire GUID = 0x393ff:0xfe6720fa
Jan 16 08:37:16 localhost kernel: enableClockSpreading returned with 0
Jan 16 08:37:16 localhost kernel: Security auditing service present
Jan 16 08:37:16 localhost kernel: BSM auditing present
Jan 16 08:37:16 localhost kernel: From path: "/pci@f2000000/ADPT,2940U2B@14/@0:9,\mach_kernel", Waiting on <dict ID="0"><key>IOPathMatch</key><string ID="1">IODeviceTree:/pci@f2000000/ADPT,2940U2B@14/@0:9</string></dict>
Jan 16 08:37:16 localhost kernel: Got boot device = IOService:/MacRISC2PE/pci@f2000000/AppleMacRiscPCI/ADPT,2940U2B@14/Adaptec78XXSCSIController/IOSCSIParallelDevice@0/IOSCSIParallelInterfaceProtocolTransport/IOSCSIPeripheralDeviceNub/IOSCSIPeripheralDeviceType00/IOBlockStorageServices/IOBlockStorageDriver/IBM DDRS-39130D Media/IOApplePartitionScheme/Composition@9
Jan 16 08:37:16 localhost kernel: BSD root: disk2s9, major 14, minor 15
Jan 16 08:37:16 localhost kernel: jnl: replay_journal: from: 1691648 to: 152576 (joffset 0xf9000)
Jan 16 08:37:17 localhost kernel: Jettisoning kernel linker.
Jan 16 08:37:17 localhost kernel: Resetting IOCatalogue.
Jan 16 08:37:17 localhost kextd[87]: registering service "com.apple.KernelExtensionServer"
Jan 16 08:37:20 localhost kernel: Matching service count = 1
Jan 16 08:37:21 localhost kernel: NVDANV10HAL loaded and registered.
Jan 16 08:37:21 localhost kernel: AppleRS232Serial: 0 0 AppleRS232Serial::start - returning false early, Connector or machine incorrect
Jan 16 08:37:34 localhost kernel: AppleRAID::raidTimeOut - slice missing for the set, "Herald_Data_1", degrading set.
Jan 16 08:38:00 localhost kextd-parent[86]: IOKitWaitQuiet() timed out
Jan 16 08:38:00 localhost SystemStarter: Welcome to Macintosh.

[sourcehound]

It may indeed have had something to do with Journaling, if there was an issue with the RAID, the journal file might have been played back to a state where the backed up files weren't in the HD catalog. I would try a data recovery utility such as Prosoft Data Rescue rather than one like DW or TT meant to fix the directory damage.