Today I recieved a easyRAID Deskforce 8 disk RAID5 with HFS+ filesystem. The unit itself is physically damaged and cannot be used, but all the drives inside are all healthy. I try to reconstruct the RAID in winhex, but all combinations I try result in not being able to access any data. I think there may be problems with the partition making it very hard for me to determine the right settings, even though the partition information seems OK in almost every order and direction when using a 64KB stripe size.

Does anyone know if there is a default setting for this RAID configuration, or is there a more effective way of finding the correct order and stripe size? I have tried Winhex and UFS Explorer.

Thanks

HI hddguy,

to reconstruct RAID system sometime really need times just to search the correct RAID configuration.

hem.. just my thought. cause this is using RAID 5 (parity), you can try ask the customer for one big text ( like 100kb text ) and than try to search it on winhex for the continues text on different drives. And don't forget about some magic thing ( XOR ). if you know what I mean

The first thing to do is to determine the stripe size with a hex editor. This is done by manually looking at the data until you see an abrupt change in the data at the sector mark. This is most easily visible where the data is ASCII. Then jump ahead 16, 32, 64, 128, 256 sectors, until you find the next abrupt transition. You may have to try several times to verify the stripe size.

Next you must determine the relative order of the drives. This can be done by finding a large text file. By comparing the beginnings and ends of stripe segments and looking for contiguous strings you can determine the relative order of the drives.

You must then determine which drive is first in the array. If you look at the following pattern you will notice that only with the transition between D4 to D1 does the data move to the next strip segment, IE from stripe 04 to stripe 05.

D1 D2 D3 D4
01 02 03 04
05 06 07 08

Next you must determine if there is a header at the beginning of the drive. Some controllers will embed meta-data at the front of the drive concerning the array configuration. For example, with Windows software arrays there is a 63 sector header before the striping begins. This can be determined by finding the mathematical modulus of the stripe transition sectors. The modulus is the remainder after a number has been divided by another number. For example if I find a transition at sector 191 and I know the stripe size is 128 sectors, then the modulus is 63 and this corresponds to the header size. The same will be true of transition sector 1087 and so on.

191 % 128 = 63
1087 % 128 = 63

Last, with RAID 5 you must determine the rotational pattern of the parity data. Unfortunately not all vendors use the same pattern. HP for example only rotates the parity every 5 stripes (I think). Fortunately Winhex supports most parity rotational patterns. To determine this pattern you find a large text file and locate the stripe in the stripe set that is gobbledy gook. Do this for a number of stripe sets in succession and you will find how the parity rotates.

You can keep track of the patterns you find and do calculations in a spread sheet.

Hope this helps, Ben

Hello UTDR,
Thanks For The wonderful posting you did.It will help in case of RAID DR Jobs i hope .Definitely We Should Experiment With This And Try Out Ourself .

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com

Wow...so cool.... ..I thought when dealing with RAID error (especially RAID 5), we should do it within the imaged drives...not the the damaged ones....

_________________
My Forum

"all the drives inside are all healthy", but yes it is ideal to image.