RAID Data Recovery: Its easy… run a utility
RAID Data Recovery: Its easy… run a utility!
Recently I received a RAID for data-recovery. Should be easy, the tech said… its just a ‘lost configuration’ situation. He said the RAID had an error so he rebuilt and swapped the bad drive – but when he rebooted – the RAID was gone…. uh-oh. So should easy, right… just a lost-RAID-configuration.
Whats this configuration you ask? A RAID is composed of multiple drives, that are setup up in 1 of many optional configurations. If that config information is lost then you can’t access the array. In reality a lost-RAID-configuration can be very complicated to fix. There can be many permutations of possible answers:
- Are there hot spares?
- Is it RAID-0? RAID-1? RAID-5? RAID-50?
- Which drives are current and which may be stale?
- Are the data clues from the current OS or ghosts from a previous life?
- Did they rebuild the array? Reset parity? or rebuild a spare?
This was 5 x 320 gb hard drives, possibly from a Buffalo NAS box, ( it doesn’t matter to me because I always analyze the bare drives and then figure out the truth…) Lucky for them they stopped playing when it didn’t work – many techs will just keep swapping drives and start rebuilding and cause more damage.
I wrote my RAID recovery utilities years ago. The scans told me that there should be a 960 gb volume. Three drives were in their own metal cage. So it could be a 3×320= 960gb RAID-0 stripe set. However, when I tried to assemble it that way I found that it wouldn’t line up. Hmmm…could it be that its really a 4 x 320gb RAID-5 ? You see a 4-drive RAID-5 and 3-drive RAID-0 are the same size. Yep – thats what it turned out to be – a 4 x 320 RAID-5.
But the RAID wasn’t done with me yet….
- One drive had a broken board that needed fixing.
- Then there were bad sectors on another drive.
- …and it was out-of-sync – which meant that only 3 drives out of the 5 drive set would give the best result.
The take-aways from this are:
- Easy lost configuration problems can be anything but..
- If you or your techs have a problem STOP – you are in real serious danger of making it unrecoverable.
- Utilities are helpful – but tools but have their limits.
- Experience and a complete understanding of RAID levels and layouts are required (can you look at hex dump and tell parity from data?).
- Understanding low-level on-disk file-system structures are required (can you interpret a MFT or XFS superblock – in hex?).
The customer got his data back 100% – but only because his tech stopped while he was ahead, and sent it to a professional.
