RAID5 recovery when only the RAID volume is visible

Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
Ben01
Posts: 12
Joined: Sat May 04, 2013 7:45 am

RAID5 recovery when only the RAID volume is visible

Post by Ben01 » Sat May 04, 2013 7:53 am

Hello

I'm looking to recover a 3 disk RAID5 after an expansion (to add two additional disks) failed.

R-Studio sees the RAID5 volume with the correct size and name (pre-expansion), but I'm not sure how to proceed from here. The manual seems to say that I should create a virtual RAID volume with the component disks, but I can only see a single virtual disk made up from the 3 physical disks. Should I just scan that and assume that R-Studio will work out that it's seeing a RAID5 volume?

The RAID card is a Highpoint 2314 running with Mac OSX 10.8.3, so an HFS+ filesystem.

Thanks
Ben

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: RAID5 recovery when only the RAID volume is visible

Post by Alt » Sun May 05, 2013 6:32 am

Well, this is probably on of the worst cases for data loss in RAIDs, because the original data from the 3 disks have been scattered to 5 disks. And it's not always known to which extent.
Some more information is needed: what did actually happened: the RAID expansion didn't actually started, it failed somewhere in the middle of the process, or the expansion process finished but without success?
When I learn that, I'll be able to give you some advices.

Ben01
Posts: 12
Joined: Sat May 04, 2013 7:45 am

Re: RAID5 recovery when only the RAID volume is visible

Post by Ben01 » Mon May 06, 2013 10:47 am

Thanks for replying...

The expansion stopped halfway though due to a power cut. When the power was restored, the expansion process carried on and completed, but the RAID was then seen as an unrecognised volume by the Mac.

Looking at the partitions, the total amount of the expanded RAID is visible, but with the original partition in place and the rest as unformatted free space. I believe that this is the expected result - if the partition/directory structure was correct, I'd just be able to expand the original partition to fill the available space.

R-Studio sees the expanded volume and the original (unexpanded) partition with the correct name and size in device view.

Is there anything else that would be useful for you to know?

Thanks
Ben

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: RAID5 recovery when only the RAID volume is visible

Post by Alt » Tue May 07, 2013 11:17 am

And this is the worst case of the worst case - when a RAID expansion stopped somewhere in the middle. Now the question - can you preview files on that partition which R-Studio sees?

Ben01
Posts: 12
Joined: Sat May 04, 2013 7:45 am

Re: RAID5 recovery when only the RAID volume is visible

Post by Ben01 » Tue May 07, 2013 1:21 pm

Oh dear. I was hoping you wouldn't say that!

I can see some of the files - maybe 30% and some of the folder structure. Almost all the data on the disk are video files, but I've only been able to preview some of the smaller ones - up to about 1GB. The larger files that make up 95% of the data are 4-10GB .mkvs and when I try to preview those a new instance of R-Studio appears to launch, 'bounces' in the dock for about a minute and then disappears without any result or message.

I tried running a scan after creating a virtual volume for the RAID and that yielded the same result, as far as I could see. I noticed that the block size was set as 8KB rather than the 64KB that the RAID was originally built with, so I'm in the process of running another scan having selected a 64k block size.

Please let me know if there's anything else I can do.

Thanks
Ben

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: RAID5 recovery when only the RAID volume is visible

Post by Alt » Wed May 08, 2013 5:36 am

Recovery is extremely difficult when the original data is scattered in a new pattern over the old disks. So, maybe you should think about going to a data recovery pro. If this is not an option, be ready for a long work with uncertain results. And always have R-Studio's help on hand as a reference.
First, you need to create disk images from all RAID disks to keep the original data safe.
Second, create a virtual RAID out of the 5 (new and old) disks. Check that all RAID parameters like disk order, etc., are correct.
Third, make a RAID consistence check to see how long the RAID expansion has been successful. Write down the parent sector numbers for that.
Then, make the same procedure for the old RAID, that is, create a RAID out of the old disk and see if there is old RAID pattern is present.
We'll see what to do after that initial inspection.

Ben01
Posts: 12
Joined: Sat May 04, 2013 7:45 am

Re: RAID5 recovery when only the RAID volume is visible

Post by Ben01 » Wed May 08, 2013 5:57 am

Thank you. The cost of data recovery for this size of RAID (12TB) makes it impossible for me to go to a company to do this, unfortunately.

I just want to make sure that I've understood a couple of the things you've said correctly...
Alt wrote:Second, create a virtual RAID out of the 5 (new and old) disks.
Should I create a 'virtual block RAID' to do this? As far as I can see, I'd somehow have to break the current RAID to do that - the card has created a single volume that's presented to the OS, so I can't see the individual disks... Or does this method work with creating a virtual volume RAID in R-Studio?
Alt wrote: Check that all RAID parameters like disk order, etc., are correct.
Presumably that's disk order, block/sector size and offset? I know the block and sector size, but the RAID management software doesn't give me anything else. can R-Studio find the other parameters?
Alt wrote:Then, make the same procedure for the old RAID, that is, create a RAID out of the old disk and see if there is old RAID pattern is present.
Do you mean the original three disks that were in the RAID before the expansion?


The scan going on at the moment - virtual volume with the correct block size - should finish in a few hours. might that provide anything useful to report back with?

Thank you for all your help so far!
Ben

Ben01
Posts: 12
Joined: Sat May 04, 2013 7:45 am

Re: RAID5 recovery when only the RAID volume is visible

Post by Ben01 » Wed May 08, 2013 10:55 am

Hi Alt

Just to follow up...the scan has now completed and I see the following in Device view:
Virtual volumes set 1 with the following partitions:
EFI System Partition
The original data partition
Extra Found Files
Recognised2

If I right click and select Open Drive Files, the original partition returns a message to the effect that nothing is seen or the file system is corrupted.

With Extra Found Files and Recognised2, files are found and in Recognised2 a number of folders are seen, but all with names starting $$$Folder followed by a numeric string of either 5 or 20 characters. In these folders are a number of the original data files, correctly named and, I think, with the right sizes. Some of the other folders contain what seems to be system information and a couple have video files with short number strings as their name.

I've tried to preview a few and they open the Hex/text editor, rather than playing.

All of the folders and files have a red 'x' through the icon.

What do you think?

Thanks
Ben

Ben01
Posts: 12
Joined: Sat May 04, 2013 7:45 am

Re: RAID5 recovery when only the RAID volume is visible

Post by Ben01 » Fri May 10, 2013 8:04 am

Hi Alt

Can you get back to me so I can run the checks that you suggested.

Thanks
Ben

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: RAID5 recovery when only the RAID volume is visible

Post by Alt » Fri May 10, 2013 8:22 am

From what I know now, I may say that RAID expansion did actually happen, and you can't recover much from the volume you see right now. Maybe, only some small-size files.
1. Yes, you have to break the RAID, don't do in through the RAID controller, just take the drives off the case. You also must create images from those drives. R-Studio can do it, see its On-line Help. Don't scan the drives while creating images, it won't yield anything meaningful. I understand that finding disk space for that may be a pain in the neck, but for a such complex data recovery work this is A MUST! To things to remember: don't use the RAID controller as a port to connect the drives, it may write something on the drives, and mark the drives as drive 1, 2 accordingly.
2. Yes, you have to create a virtual block RAID. Its parameters is another pain in the neck, usually even RAID card vendor tech support isn't much of the help. There's a free Windows program ReclaiMe Free RAID Recovery software.
3 Yes, the original three disks that were in the RAID before the expansion.
So, you see the work you'll have to do.

Post Reply