Page 1 of 2

Recover Synology Raid

Posted: Mon Nov 16, 2015 9:48 pm
by rawiblev
Hello All,

I'm hoping you can help. I had bought an older version of R-Studio (7.0) over a year ago when I was trying to rebuild a failed synology raid that I bought around 5 years ago and was made of 5 disks. I had taken the disks out at the time without noting their correct location. One of the disks is completely bad and I had pretty much given up working on it until recently. I have imaged the 4 working drives and am working from those copies. I've been able to decipher the drive order and the offset and that it is Raid 5, but the logical order seems to be out of sync. It rebuilds the images complete, but they're put together in the wrong order, like instead of it being put together 1, 2, 3 it would be 1, 3, 2. I hope that makes sense. I was able to find an apple xml music library file that allowed me to follow the logic order and it appears to be left synchronous. I'm really hoping you can point me in the right direction of what to look at to try. Thanks for any help.

Re: Recover Synology Raid

Posted: Thu Nov 19, 2015 12:37 pm
by Alt
rawiblev wrote:Hello All,
I've been able to decipher the drive order and the offset and that it is Raid 5, but the logical order seems to be out of sync. It rebuilds the images complete, but they're put together in the wrong order, like instead of it being put together 1, 2, 3 it would be 1, 3, 2. I hope that makes sense. I was able to find an apple xml music library file that allowed me to follow the logic order and it appears to be left synchronous.
Frankly, I don't understand what the "logic order" is. Do you mean "Block order"? You may try the order types one by one, there are only 4 of them.

Re: Recover Synology Raid

Posted: Thu Nov 19, 2015 1:51 pm
by Data-Medics
Make sure you are adding in the missing 5th disk placeholder to the virtual array. Without it R-Studio will be expecting parity data in all the wrong places. Finding drive order can be a bit tricky sometimes, but there's a few shortcuts that can usually speed it up if you know what you're doing. Also auto detect won't work unless all drives are there, so don't bother even trying it, it won't work.

Re: Recover Synology Raid

Posted: Fri Nov 20, 2015 10:37 am
by rawiblev
Yes, I did mean block order. Sorry. Yes, I did add the missing disk. I tried running it under all of the available block orders with no success. I did however find some logs that synology created that stated that the large partition on each drive was configured as raid 6 which seems to make sense that I remember only having around 5-6 TB of data available on the array. Reclaim me said the configuration was raid 5, but I guess the other partitions on the disks could be configured as raid 5 and threw it off. I haven't gotten to play with the raid 6 configurations a lot yet. The log said version 1.20 raid 6. Is that significant to anything and how does the offset play into retrieving the data? Is there a way to figure it out? The log did have the drive order listed, so I hope that's right. Thanks for your help.

Re: Recover Synology Raid

Posted: Mon Nov 23, 2015 12:00 pm
by Alt
Can you detect the area on the disks which is supposed to be configured as a RAID6? If yes, I recommend you to create disk regions on that area and create a RAID6 out of it? You may try to find the block size as it's described in the article Finding RAID parameters. And then again play with the RAID6 presets.

Re: Recover Synology Raid

Posted: Tue Nov 24, 2015 6:10 pm
by Data-Medics
Yes, this is an important step what he mentioned. Most NAS boxes have a RAID 1 partition which is mirrored on all drives. The RAID 5 or 6 portion generally starts right after it, but might be a few sectors off in some cases. Usually you can look at the partition table and get an idea what's going on.

Re: Recover Synology Raid

Posted: Sat Dec 19, 2015 8:23 pm
by rawiblev
Sorry, I am just now getting back. I've been through it over and over again looking at the data and have verified it is Raid 5 (Left-Synchronous). I've compared a file it recovers to the real complete file and there seems to be chunks of structured data that's been written into the data. It hasn't overwritten any data, it's been inserted in between the data. For example the very first block of a picture shows this data towards the end of the block and it looks like this (.a+..a+..) and takes up 8 sectors (4kb) of data. The a is an a with a ~ on top and the + has a line underneath it the a and the + repeats throughout the chunk, but a different character may appear in front of it like it's displaying all symbols and characters found in the ascii table. It appears about 10 times throughout the 20 mb file and seems to be what is causing the file to load in the wrong order. What would this be? Thanks for any and all help.

Re: Recover Synology Raid

Posted: Sun Dec 20, 2015 9:16 am
by Alt
What is the block size of the RAID? 4 KB?

Re: Recover Synology Raid

Posted: Sun Dec 20, 2015 3:45 pm
by rawiblev
It is 64kb. And the unrecognized data has been inserted at 48kb for the first block of data read for every file and then consistently at other points in the file if it's big enough. The unrecognized data seems to be different for every place it occurs. What could this be? Thanks for all your help.

Re: Recover Synology Raid

Posted: Mon Dec 21, 2015 12:53 pm
by Alt
Looks like this is a synology hybrid RAID rather than a common RAID5.