Recovering from RAID 5 Failure

Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
PhilFCS
Posts: 3
Joined: Tue Dec 31, 2013 12:52 pm

Recovering from RAID 5 Failure

Post by PhilFCS » Tue Dec 31, 2013 1:37 pm

I have a RAID5 array using ICH8 chipset Intel Matrix Storage controller.

The user neglected the server and at some point a single disk failed, it is clicking.
Then sometime later something caused the two remaining disks to send the array into a failed status.

A previous company looked at the problem and I'm uncertain of the arrangement of the disks.
Following the excellent article here: http://www.r-tt.com/Articles/Finding_RAID_parameters/
I was able to determine the offset is 0, and as suspected the stripe size is the default 64KB, and it seems I now know the order of the disks, the failed disk is disk1, and the other two disks which a quick test shows are fine are disk 2 and 3. Oh and it is Left Asynchronous. (which seems normal for an intel raid)

Prior to creating my image (hadn't run into R-Studio at that point) I read on the Intel site that removing the array and re-establishing the same parameters can get you to the point where testdisk may detect the partition and re-write it to the drive.
So I did this, found a partition after scanning for a long time and wrote it without checking if it had a file listing (regretting that now) it failed to bring up a working partition. I then found R-Studio and created compressed images of the disks.

So to my questions:
1) On the images when I add them to the Virtual Raid they show "Info/Bus" showing one disk as #0 RAID 0:0 (serial ending in 9TN) and the other #2 RAID 0:2 (serial ending in XWR) this doesn't match my analysed partition scheme (failed, XWR, 9TN) or the invalid raid layout I did when I recreated the array (i did 9TN(0), XWR(1), new blank disk(2)), so where is it pulling this from, is this just showing where it was connected on the motherboard when I imaged it? The array was deleted when I imaged them so I'm not sure where it pulled that from.

2) What does check raid consistency do in my situation? I assume it won't be effective because the raid has a "missing disk" added.

3) When I put the raid together it doesn't find any partition (unless I run a scan) is this because it was on the failed disk or because I may have squashed it with testdisk? Pretty sure I know the answer here :(

Based on the situation I feel I should be able to get something from this disk, despite my having written a partition table to the raid when the disks were in the wrong order. But maybe I'm wrong, I did find an $MFT record on one of the working disks, and found several FILE0 records which following them proved to me the sequence of writes to the disk.

I can get a directory tree with almost all the folders using the disk order that I analysed, but any file over 64KB is corrupted(even some under 64KB are no good). This tells me the disk order may be wrong. Am I right?

PhilFCS
Posts: 3
Joined: Tue Dec 31, 2013 12:52 pm

Re: Recovering from RAID 5 Failure

Post by PhilFCS » Tue Dec 31, 2013 4:44 pm

Another note, I just realized that the drive image ending in 9TN is 30GB while the XWR drive has 226GB (these are compressed disk images) still I would think they would be closer in size than that. Perhaps my problem is a failed image or maybe that drive really is trashed despite being "readable". I really can't be certain what the other IT company did before I stepped in on the situation.

PhilFCS
Posts: 3
Joined: Tue Dec 31, 2013 12:52 pm

Re: Recovering from RAID 5 Failure

Post by PhilFCS » Tue Dec 31, 2013 4:49 pm

Another question, are the disk images read-only?

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recovering from RAID 5 Failure

Post by Alt » Thu Jan 02, 2014 2:51 pm

PhilFCS wrote:
So to my questions:
1) On the images when I add them to the Virtual Raid they show "Info/Bus" showing one disk as #0 RAID 0:0 (serial ending in 9TN) and the other #2 RAID 0:2 (serial ending in XWR) this doesn't match my analysed partition scheme (failed, XWR, 9TN) or the invalid raid layout I did when I recreated the array (i did 9TN(0), XWR(1), new blank disk(2)), so where is it pulling this from, is this just showing where it was connected on the motherboard when I imaged it? The array was deleted when I imaged them so I'm not sure where it pulled that from.
That shows the hardware port to which the disk was connected during imaging and has nothing to do with the RAID scheme.
PhilFCS wrote: 2) What does check raid consistency do in my situation? I assume it won't be effective because the raid has a "missing disk" added.
Exactly - a missing disk has no data and is used to create a required RAID scheme.
PhilFCS wrote: 3) When I put the raid together it doesn't find any partition (unless I run a scan) is this because it was on the failed disk or because I may have squashed it with testdisk? Pretty sure I know the answer here :(
Not necessary. Damaged data on other disks may be the cause.
PhilFCS wrote: Based on the situation I feel I should be able to get something from this disk, despite my having written a partition table to the raid when the disks were in the wrong order. But maybe I'm wrong, I did find an $MFT record on one of the working disks, and found several FILE0 records which following them proved to me the sequence of writes to the disk.

I can get a directory tree with almost all the folders using the disk order that I analysed, but any file over 64KB is corrupted(even some under 64KB are no good). This tells me the disk order may be wrong. Am I right?
Maybe. Or other RAID parameters are incorrect. It's hard to say much without seeing the actual data.

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recovering from RAID 5 Failure

Post by Alt » Thu Jan 02, 2014 2:54 pm

PhilFCS wrote:Another note, I just realized that the drive image ending in 9TN is 30GB while the XWR drive has 226GB (these are compressed disk images) still I would think they would be closer in size than that. Perhaps my problem is a failed image or maybe that drive really is trashed despite being "readable". I really can't be certain what the other IT company did before I stepped in on the situation.
Indeed, that looks suspiciously. I would make some hardware tests of those disks. Quite often a failed image is a result of a hardware failure.

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recovering from RAID 5 Failure

Post by Alt » Thu Jan 02, 2014 2:56 pm

PhilFCS wrote:Another question, are the disk images read-only?
Yes, for the compressed one, no for byte-by-byte ones.

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recovering from RAID 5 Failure

Post by Alt » Thu Jan 02, 2014 3:03 pm

PhilFCS wrote: Then sometime later something caused the two remaining disks to send the array into a failed status.
Any clues - was that a hardware problem of the controller/disks, or something like a system crash?

I don't think TestDisk did much harm, it just overwrote some disk partition information leaving the rest data untouched. Seems that the difference in image sizes is of much more concern, I'd really double-check disk conditions.

Post Reply