Recovering data fro...
 
Notifications
Clear all

Recovering data from a degraded RAID5 array

8 Posts
4 Users
0 Likes
624 Views
(@jeffcaplan)
Posts: 97
Trusted Member
Topic starter
 

Hello Everyone,

I'm hoping someone here can help me. I've posted for help in a few other forums, with no luck yet. I'll try and be brief but include all relevant info. For starters, I have

- HP Server with 6 SATA drives connected to a SATA RAID controller
- 1 80GB SATA drive is partioned by itself and has Windows Server 2003 installed on it
- 5 250GB SATA drives configured in a RAID 5 array and partioned as 1 1TB NTFS partition
- Over the weekend, office got really hot, arrived on Monday morning and people couldn't access data which was located on the 1TB partition, server had an error message related to the logical volume, and the server was making noises (clicking hard drive, and controller was beeping)
- We shut down the server, called HP, they came out with a good 250GB SATA hard drive; we swapped out the bad hard drive with the good one and booted.
- RAID Controller BIOS indicated that the RAID5 array was running in a degraded mode and also had another message saying that required members were missing from the RAID5 array.
- Went into the RAID Controller Configuration Utility and there was no RAID5 array displayed (not even any recovery options to rebuild an array, or load array configuration information from disk) This particular RAID controller sucks…
- Called HP tech support and they were absolutely no help; at this point I'm thinking data recovery…
- Next step is to grab images of all 4 good hard drives using EnCase v4.20, I do this and try and build the RAID array using the Edit Disk Configuration utility…I know the stripe size is 64KB, and I know the order the drives were in, so I do all this, and after rebuilding the array, I get an error message Invalid read request for 8 sectors starting at sector 1953102367. Total sectors 1465191504. I post a message on Guidance's forums asking for help, but haven't received anything useful as yet.
- Next I decide to try RAID Reconstructor from runtime.org. Follow all directions and after analyzing all 4 drives of the 5-drive array, it's supposed to recommend the proper raid sequence, parity-striping order and stripe size…well it doesn't have any recommendations for me. I'm still waiting to hear back from runtime.org's support for help with this.

So now I'm turning to you all…I've already offered dinner to anyone who could help me on Guidance's forums, so I'll do the same here…$40 gift certificate to the restaurant of your choice to anyone who can help me sucessfully rebuild this array and recover some data. Let me know if you have any questions and please let me know if you have any recommendations. Thanks all.

Jeff Caplan

 
Posted : 07/04/2006 9:05 pm
(@farmerdude)
Posts: 242
Estimable Member
 

Jeff,

whatever became of this? Have you tried SMART for Linux and its RAID Reconstructor?

So you acquired each of the four disks individually (not as the logical RAID array)?

You mentioned "and after rebuilding the array" … how did you do this, using EnCase or another tool? The RAID was in a degraded mode before you acquired it. Did your rebuild tool run through the process of fixing the RAID array?

regards,

farmerdude

 
Posted : 11/04/2006 10:15 am
 Andy
(@andy)
Posts: 357
Reputable Member
 

Jeff, how does the disk appear in Windows Disk Management? Is it possible you need to first initialise the disk in order for the RAID to rebuild?

Andy

 
Posted : 11/04/2006 2:42 pm
(@jeffcaplan)
Posts: 97
Trusted Member
Topic starter
 

farmerdude,

Yes, all 4 disks were acquired individually. When I mentioned "rebuilding the array", I was using EnCase v4.20 to do this. It has the ability to create a "virtual" array of n-1 disks from a RAID5 array which you can look at as one logical disk structure. In my case, I saw one 1TB NTFS partition, but absolutely no data, and when I clicked on the partition, I got the error message which I described. I have not tried any other products, but right now I'm 0/2, and both are very very popular, so I'm not seeing why a 3rd would work unless I can get an explanation as to what's going wrong now.

Andy,

If I initialize the disks, the data goes away. The RAID was a hardware RAID, and not a software RAID, so working with disk management in Window won't change anything.

Jeff

 
Posted : 11/04/2006 6:50 pm
(@farmerdude)
Posts: 242
Estimable Member
 

Jeff,

You could try using the 'md' software driver in Linux to rebuild your array, initialize it, and see if your data is accessible. You could try the evaluation version of SMART to see if its RAID Reconstructor provides you with better mileage.

I have no idea how EnCase does their RAID stuff. But wouldn't a problem be the RAID had 5 drives and you acquired only 4, and EnCase's formula for a RAID 5 is n-1, which in your case is 4-1=3, which wouldn't give you the data you need then, would it?

regards,

farmerdude

 
Posted : 11/04/2006 10:35 pm
(@jeffcaplan)
Posts: 97
Trusted Member
Topic starter
 

I have no idea how EnCase does their RAID stuff. But wouldn't a problem be the RAID had 5 drives and you acquired only 4, and EnCase's formula for a RAID 5 is n-1, which in your case is 4-1=3, which wouldn't give you the data you need then, would it?

I meant that it could rebuild a RAID 5 array of n-1 disks, in this case the array was 5 disks (5-1=4) and I had 4 disks…

I'll check out some linux solutions, but again I'm not seeing why other programs are going to offer me a different result than the top 2 RAID recovery software programs.

Jeff

 
Posted : 12/04/2006 12:40 am
(@farmerdude)
Posts: 242
Estimable Member
 

Jeff,

Was just trying to help. If you don't feel that other solutions may offer you assistance then don't look into them. That would lead you back to the Guidance forum, then. And honestly, if I paid the price for EnCase and I had an issue I would hound them until I got an answer that satisfied me.

I thought you posted here because you were up for other possible alternatives. If you're curious as to *why* I mentioned them it's because mileage can and sometimes does vary, between both programs and operating system environments. The fact that both options I mentioned can be tried free of any financial cost associated with acquiring them I thought would be of interest to you. Especially since you know the key ingredients, parity, stripe, and RAID level.

But then, if "the top 2 RAID recovery software programs" didn't help you, then it must be a lost cause! 😉

(You detect my sarcasm … I hope … because I would never consider either of those programs to be the top two RAID recovery software programs … lol )

regards,

farmerdude

 
Posted : 12/04/2006 2:00 am
(@akaplan0qw9)
Posts: 69
Trusted Member
 

Dear Jeff,

I had a similar experience several months ago and a successful recovery of close to 100% of the data (I have not noted anything I did not recover.) In glancing through your system setup, I see many differences and perhaps the only similarity is the frustration of not getting this beast up and running (in my case it took about a month to find a solution! And only a few hours after the solution was found. ). Just so you can see the many differences, I will describe my system.

I had Four-300 GB Maxtor SATA drives in a RAID 0+1 NVIDIA Array. At the time of the failure, I had no other HDs on board. My Mother Board is an ASUS A8n Deluxe. Fortunately all of my work related images were stored externally on External HDs that were isolated from the system. My backups were spotty (Who needs a backup when the array includes a backup?) I week or so earlier, I needed space for an image and stupidly wiped an external HD that had contained significant backups.

The failure was characterized by an inability of Windows to read the array and an inability to rebuild the array. Initially ASUS copped out to the problem being a failure of their MoBo. They sent me a new one, but that did not help. The MS Windows “Experts” wanted me to nuke every out and reinstall Windows, as did the Maxtor “Experts”. NVIDIA was somewhat more help, referring me up to their Level III, who eventually through in the towel also.

I tried several programs like GetDataBack, RaidReconstructor and DiskExplorer. They were no help. Their support tried unsuccessfully. The thing that kept me going was the fact that I could actually read what appeared to be uncorrupted text when I used WinHex. In fact I could read data on several and possibly all of the drives in the array at one time or another, seemed to fly in the face of the experts who reasoned that since RAID 0 was stripes and RAID 1 was a mirror image of that, all I could ever expect to get back off a single drive were blocks of data – not complete files.

It was obvious that no matter what I ended up doing with the array, I was not going to make the mistake of installing my operating system on an array again. I installed two additional 300 GB (IDE) Drives, one for my new C drive and the second to use for any data I was able to salvage from the 4 Drives that used to be the array.

After installing the new OS on my new C Drive, I installed WinHex on my C Drive. Windows could still not read any of the 4 drives in the array, but WinHex could read them one at a time. WinHex allows you to create what Stefan Fleishman, the author, calls a Drive Contents Table. I picked one of the four drives that were in theory supposed to contain only stripes, and found that I could move all the folders to one on my two new drives. I don’t recall which one or exactly how I did it. Although WinHex was not made for this, it must have been pretty darn intuitive – because I did it. WinHex as you may know is a lot more flexible, and easier to work with than its sister X-Ways Forensics, which is the same program with built in locks to keep us forensic guys from screwing up and putting evidence in the wrong place. If you have never used either, I recommend WinHex for this. There are no specific instructions for the recovery procedure I used, but I might be able to remember it if I had a file and the program in front of me.

I have no explanation of why I was able to get a virtually complete recovery off a single drive from a striped array, and last I heard, they still haven’t figured out how a bumble bee can fly either.

One last thing, WinHex has a utility that appears to be designed to help examine arrays. That is a fairly new modification and I have never used it. It was not available at the time of my recovery.

Good Luck!

Al

 
Posted : 12/04/2006 5:40 am
Share: