Recover Synology Raid

Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
rawiblev

Recover Synology Raid

Post by rawiblev » Mon Nov 16, 2015 9:48 pm

Hello All,

I'm hoping you can help. I had bought an older version of R-Studio (7.0) over a year ago when I was trying to rebuild a failed synology raid that I bought around 5 years ago and was made of 5 disks. I had taken the disks out at the time without noting their correct location. One of the disks is completely bad and I had pretty much given up working on it until recently. I have imaged the 4 working drives and am working from those copies. I've been able to decipher the drive order and the offset and that it is Raid 5, but the logical order seems to be out of sync. It rebuilds the images complete, but they're put together in the wrong order, like instead of it being put together 1, 2, 3 it would be 1, 3, 2. I hope that makes sense. I was able to find an apple xml music library file that allowed me to follow the logic order and it appears to be left synchronous. I'm really hoping you can point me in the right direction of what to look at to try. Thanks for any help.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover Synology Raid

Post by Alt » Thu Nov 19, 2015 12:37 pm

rawiblev wrote:Hello All,
I've been able to decipher the drive order and the offset and that it is Raid 5, but the logical order seems to be out of sync. It rebuilds the images complete, but they're put together in the wrong order, like instead of it being put together 1, 2, 3 it would be 1, 3, 2. I hope that makes sense. I was able to find an apple xml music library file that allowed me to follow the logic order and it appears to be left synchronous.
Frankly, I don't understand what the "logic order" is. Do you mean "Block order"? You may try the order types one by one, there are only 4 of them.

Data-Medics
Posts: 148
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA
Contact:

Re: Recover Synology Raid

Post by Data-Medics » Thu Nov 19, 2015 1:51 pm

Make sure you are adding in the missing 5th disk placeholder to the virtual array. Without it R-Studio will be expecting parity data in all the wrong places. Finding drive order can be a bit tricky sometimes, but there's a few shortcuts that can usually speed it up if you know what you're doing. Also auto detect won't work unless all drives are there, so don't bother even trying it, it won't work.

rawiblev

Re: Recover Synology Raid

Post by rawiblev » Fri Nov 20, 2015 10:37 am

Yes, I did mean block order. Sorry. Yes, I did add the missing disk. I tried running it under all of the available block orders with no success. I did however find some logs that synology created that stated that the large partition on each drive was configured as raid 6 which seems to make sense that I remember only having around 5-6 TB of data available on the array. Reclaim me said the configuration was raid 5, but I guess the other partitions on the disks could be configured as raid 5 and threw it off. I haven't gotten to play with the raid 6 configurations a lot yet. The log said version 1.20 raid 6. Is that significant to anything and how does the offset play into retrieving the data? Is there a way to figure it out? The log did have the drive order listed, so I hope that's right. Thanks for your help.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover Synology Raid

Post by Alt » Mon Nov 23, 2015 12:00 pm

Can you detect the area on the disks which is supposed to be configured as a RAID6? If yes, I recommend you to create disk regions on that area and create a RAID6 out of it? You may try to find the block size as it's described in the article Finding RAID parameters. And then again play with the RAID6 presets.

Data-Medics
Posts: 148
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA
Contact:

Re: Recover Synology Raid

Post by Data-Medics » Tue Nov 24, 2015 6:10 pm

Yes, this is an important step what he mentioned. Most NAS boxes have a RAID 1 partition which is mirrored on all drives. The RAID 5 or 6 portion generally starts right after it, but might be a few sectors off in some cases. Usually you can look at the partition table and get an idea what's going on.

rawiblev

Re: Recover Synology Raid

Post by rawiblev » Sat Dec 19, 2015 8:23 pm

Sorry, I am just now getting back. I've been through it over and over again looking at the data and have verified it is Raid 5 (Left-Synchronous). I've compared a file it recovers to the real complete file and there seems to be chunks of structured data that's been written into the data. It hasn't overwritten any data, it's been inserted in between the data. For example the very first block of a picture shows this data towards the end of the block and it looks like this (.a+..a+..) and takes up 8 sectors (4kb) of data. The a is an a with a ~ on top and the + has a line underneath it the a and the + repeats throughout the chunk, but a different character may appear in front of it like it's displaying all symbols and characters found in the ascii table. It appears about 10 times throughout the 20 mb file and seems to be what is causing the file to load in the wrong order. What would this be? Thanks for any and all help.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover Synology Raid

Post by Alt » Sun Dec 20, 2015 9:16 am

What is the block size of the RAID? 4 KB?

rawiblev

Re: Recover Synology Raid

Post by rawiblev » Sun Dec 20, 2015 3:45 pm

It is 64kb. And the unrecognized data has been inserted at 48kb for the first block of data read for every file and then consistently at other points in the file if it's big enough. The unrecognized data seems to be different for every place it occurs. What could this be? Thanks for all your help.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover Synology Raid

Post by Alt » Mon Dec 21, 2015 12:53 pm

Looks like this is a synology hybrid RAID rather than a common RAID5.

Post Reply