All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 3 posts ] 
Author Message
 Post subject: Werid RAID case with interleaved sectors
PostPosted: October 11th, 2019, 7:48 
Offline

Joined: September 11th, 2019, 6:12
Posts: 18
Location: Spain
Hi everyone!

I'm posting about a weird RAID case that was recently brought in by a client. He brought the whole server so I can answer any further HW questions. First I'll give you the specs I know:
  • Model: NetApp NAF-1201
  • NÂș Drives: 12
  • Drive models: ST2000NM0033
  • RAID Level: 6 (We know this because the client told us, and the volume size reported by the client matches up with this)
According to the client, this RAID was erased, not just formatted, but completely re-initialized.
We connected all the drives and had a look with different programs (R-TT, UFS, DE). When we tried recovering some RAW data from individual drives, at first it looked like the stripe size was 8 sectors. We found MFT chunks 4 entries long, some text segments of 4kB, etc. So we tried to build it with those settings and in a few different configs (left, right, synchronous, asynchronous...) but no dice. After some closer examination of the RAW results we came upon the bug surprise.
Every data chunk of 8 sectors was followed by a single sector of unidentified data. This means that the MFT is contiguous for a while, but with extra sectors mixed in. Since I don't really know how to explain it I'll give a visual example here. The actual values of LBA and index are made up, but the same principle applies
Code:
LBA        SIGNATURE               MFT INDEX

...D000    FILE0                   B0 40
...D001    <cont>         
...D002    FILE0                   B0 41
...D003    <cont>         
...D004    FILE0                   B0 42
...D005    <cont>         
...D006    FILE0                   B0 43
...D007    0x00 0x01 0x00 0x00
...D008    <cont>         
...D009    FILE0                   B0 44
...D00A    <cont>         
...D00B    FILE0                   B0 45
...D00C    <cont>         
...D00D    FILE0                   B0 46       
...D00E   
...D00F    FILE0                   B0 47
...D010    0x00 0x01 0x00 0x00
...D011    <cont>



This pattern seems to hold even inside parity blocks, which leaves me to believe there are two possibilities.
  • The extra sectors are inserted by the server HW every 9 sectors to hold some kind of metadata about the RAID (seems unlikely)
  • It's a SW RAID, that for some reason does the same thing

After some calculating and racking my brain I've concluded that the real stripe size is 64 sectors, but right now I don't know how to continue. If anyone of you guys has seen this type of configuration before, I would be incredibely greatful if you could share some knowlede.

Once I get the go-ahead from my boss, I'll upload an extract of the MFT from different disks should you like to have a go at it.

Anyway, thanks in advance to all of you,

-- Az-Reth

_________________
Will recover data for food


Top
 Profile  
 
 Post subject: Re: Werid RAID case with interleaved sectors
PostPosted: October 13th, 2019, 10:47 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1080
Location: Angel Data Recovery
az-reth wrote:
If anyone of you guys has seen this type of configuration before, I would be incredibely greatful if you could share some knowlede.


-- Az-Reth

Check your PM

_________________
Angel Data Recovery


Top
 Profile  
 
 Post subject: Re: Werid RAID case with interleaved sectors
PostPosted: October 14th, 2019, 11:28 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
az-reth wrote:
[*]Model: NetApp NAF-1201


It's a SAN, forget everything you know about normal RAID data recovery. It's a different animal.

I got a guy who does NetApp, but you won't like the prices.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 3 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 45 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group