Hi everyone!
I'm posting about a weird RAID case that was recently brought in by a client. He brought the whole server so I can answer any further HW questions. First I'll give you the specs I know:
- Model: NetApp NAF-1201
- Nº Drives: 12
- Drive models: ST2000NM0033
- RAID Level: 6 (We know this because the client told us, and the volume size reported by the client matches up with this)
According to the client, this RAID was erased, not just formatted, but completely re-initialized.
We connected all the drives and had a look with different programs (R-TT, UFS, DE). When we tried recovering some RAW data from individual drives, at first it looked like the stripe size was 8 sectors. We found MFT chunks 4 entries long, some text segments of 4kB, etc. So we tried to build it with those settings and in a few different configs (left, right, synchronous, asynchronous...) but no dice. After some closer examination of the RAW results we came upon the bug surprise.
Every data chunk of 8 sectors was followed by a single sector of unidentified data. This means that the MFT is contiguous for a while, but with extra sectors mixed in. Since I don't really know how to explain it I'll give a visual example here. The actual values of LBA and index are made up, but the same principle applies
- Code:
LBA SIGNATURE MFT INDEX
...D000 FILE0 B0 40
...D001 <cont>
...D002 FILE0 B0 41
...D003 <cont>
...D004 FILE0 B0 42
...D005 <cont>
...D006 FILE0 B0 43
...D007 0x00 0x01 0x00 0x00
...D008 <cont>
...D009 FILE0 B0 44
...D00A <cont>
...D00B FILE0 B0 45
...D00C <cont>
...D00D FILE0 B0 46
...D00E
...D00F FILE0 B0 47
...D010 0x00 0x01 0x00 0x00
...D011 <cont>
This pattern seems to hold even inside parity blocks, which leaves me to believe there are two possibilities.
- The extra sectors are inserted by the server HW every 9 sectors to hold some kind of metadata about the RAID (seems unlikely)
- It's a SW RAID, that for some reason does the same thing
After some calculating and racking my brain I've concluded that the real stripe size is 64 sectors, but right now I don't know how to continue. If anyone of you guys has seen this type of configuration before, I would be incredibely greatful if you could share some knowlede.
Once I get the go-ahead from my boss, I'll upload an extract of the MFT from different disks should you like to have a go at it.
Anyway, thanks in advance to all of you,
-- Az-Reth