Raid 0 recover (nvraid on windows)

Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
thepuss

Raid 0 recover (nvraid on windows)

Post by thepuss » Sat Feb 19, 2011 6:38 pm

I'm trying to recover a 2 disk RAID 0 array after a MoBo failure.
I'm working from disk images and I *believe* the disks themselves to be in an OK state.

Each disk is 153.39Gb (164Gb on the label)
The RAID 0 volume is coming up as 306.77Gb

I know the disk order.
I don't know the stripe size.

I have followed the general instructions in the excellent "Finding RAID parameters" document on your website, but have got a bit confused towards the end where stripe size it determined.

I'm not sure if this is a problem, but there appears to be a FAT16(?) partition at the start of the first disk, so I was wondering if the second disk needs some offset or other as a result, so that is starts at the same place as the NTFS partition on disk #1? Or will this be handled automatically?

Anyway, I have mounted my two images: "Disk#1" and "Disk#2" and I know that they are in this order, so I believe I should only really need to look at "Disk #1" for all the general parameter info, since "Disk #2" is just going to be striped data... is this correct? (In any case I have not found an MBR on Disk#2...)

So, I have found an MBR in "Disk#1": Sector 0 "with 2048 sectors preceding the partition"
As I only have 2 disks the calculation for starting to look for the NTFS Boot Sector = 2048, and indeed that is where I find it!

The Boot Sector info is basically the same as in your example:
Bytes/sector = 512
Sectors/Cluster = 8
Logical Cluster# for $MFT = 786432

Now, looking for the MFT:
Calculation is: 786432*8/(N-1=1) = 6291456 / 1 = 6291456

I find the MFT record at sector: 6293504 which seems about right.

So far, so good.

Now, I get confused...
I can see the "File Record Number" of this first position... it is 00 00
If I skip forward 2 sectors, it changes to 01 00 (obviously the hex is inversed)

But, as I have neither 3 disks no parity in my case, I am lost at this point.
All the subsequent "2 sector skips forward" increment the File Record Number by 1, right up to FF 4E at sector 6405022 !
I'm sure this can't mean that my stripe size is 1K (2 sectors) can it ? That seems rather ludicrous...

Could someone point me in the right direction with this bit, and possibly tell me if I need to do anything else on Disk#2 or if it just has to be added to the Raid Set when it is defined.

At the moment I am going ahead with a full scan of the set, using the 64k stripe size, as this seems to be the NVRaid default ("Optimal"), and I can't think it would have been changed.


Any assistance much appreciated!
Thanks,

Puss.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Raid 0 recover (nvraid on windows)

Post by Alt » Sun Feb 20, 2011 5:18 am

Well, it's a bit hard to give advices without thoroughly browsing through the actual data on the disks. So, excuse me if I tell you something irrelevant or misleading.
thepuss wrote: I'm not sure if this is a problem, but there appears to be a FAT16(?) partition at the start of the first disk, so I was wondering if the second disk needs some offset or other as a result, so that is starts at the same place as the NTFS partition on disk #1? Or will this be handled automatically?
It may be a remnant of a file system that had been on the disk before you made the RAID, or something else.
The offset of the second disk should be as you specified it when creating the RAID. Usually, the offsets for both disks are the same, but may be different.
thepuss wrote: Anyway, I have mounted my two images: "Disk#1" and "Disk#2" and I know that they are in this order, so I believe I should only really need to look at "Disk #1" for all the general parameter info, since "Disk #2" is just going to be striped data... is this correct? (In any case I have not found an MBR on Disk#2...)
No, you should look on both disks, as the MFT, if large enough, may be stripped too, and be on both disks.
thepuss wrote: Now, I get confused...
I can see the "File Record Number" of this first position... it is 00 00
If I skip forward 2 sectors, it changes to 01 00 (obviously the hex is inversed)

But, as I have neither 3 disks no parity in my case, I am lost at this point.
All the subsequent "2 sector skips forward" increment the File Record Number by 1, right up to FF 4E at sector 6405022 !
I'm sure this can't mean that my stripe size is 1K (2 sectors) can it ? That seems rather ludicrous...

Could someone point me in the right direction with this bit, and possibly tell me if I need to do anything else on Disk#2 or if it just has to be added to the Raid Set when it is defined.
Stop!!! Here you missed the point. You need to find a place in the MFT where the file record numbers, which until that place should be continuously changing by 1 (0, 1, 2, 3, 4, 5... - in inverse HEX, of course), are abruptly interrupted. Say, from 63 to 127, in inverse HEX once again. Then you should look at the second disk and find a file record number 64, to be sure that the MFT is not damaged. You should see that the length of such continuous block is also 64 file records. Then, the block size equals to 1 KB (the file record size) x the number of file records in the continuous block, 64KB for this case. Don't forget they start from 0 rather than 1!
I give these numbers for the most common case of 64KB stripe size. If it's different, the numbers'll be different.
As you have only two disks and no parity, and you know the disk order, your task is much easier. You don't have to determine which disk is which.
thepuss wrote: At the moment I am going ahead with a full scan of the set, using the 64k stripe size, as this seems to be the NVRaid default ("Optimal"), and I can't think it would have been changed.
I agree with you.

thepuss

Re: Raid 0 recover (nvraid on windows)

Post by thepuss » Mon Feb 21, 2011 5:45 am

Hi Alt!

Thanks a lot of this info... I see I have to go back and redo some of this now.
I really appreciate you setting me right about the File Record Numbers!

Puss

ThePuss

Re: Raid 0 recover (nvraid on windows)

Post by ThePuss » Mon Feb 21, 2011 5:03 pm

Hi again, ALT,

Ok now I'm really, really confused...

When I find the first FILE0 record, the File Record Number is 00.
I scroll down in the text editor by 2 sectors and I find a FILE0 record with FRN = 01
I do it again... FRN = 02...
This continues until I get to FRN = 0F, which is not followed by any FILE0 records for a while.

Now this is a group of 32 sectors (512/sector) which implies a 16K block size, I believe.

(now let's skip the bit about looking for continuation on the 2nd disk for a moment)

When I look for the next set of FILE0 records on Disk#1 I get a match, and FRN = 18 but that is after a block of 16 sectors (8k) all empty.

At this point, the FRNs increment (by 1) every 2 sectors until I get to FRN = FF 4E !!!

There is no interval in the sequence!
The 8k "gap" that I find is just the right space to hold the missing FRNs from 10 thru 17!
There doesn't seem to be anything consistent with any of this on the second disk!


I am beginning to think that these disks that I have been given may not be a RAID-0 pair at all, but something like a JBOD pair.
I have managed to get a pile of stuff off disk 1, although I can't really see a correspondence between recovery success and either filesize or "block/stripe" size.... I have some <500k files that won't recover, and some >1Mb files that will!

I think that I am beyond forum help, unless you have any way that I can identify what this disk pair really represent.

(The user just doesn't know. All I do know is that they came out of an AlienWare 5500 desktop, which was "supplied" with two disks configured as RAID-0... but it has probably had its OS reloaded at some point.... "at least" [users words])....

Thanks for your help anyway... I now know a huge amount more as a result!

Puss

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Raid 0 recover (nvraid on windows)

Post by Alt » Mon Feb 28, 2011 11:18 am

I think, you indeed have a jbod layout. The rest is hard to determine without seeing the actual data.

Post Reply