NAS Box Recovery

[hddbug]

Hi Friends
I need your help in recovering data from Iomega Store center Pro 150D NAS server. It is 2TB box with 4 hard drives 500 GB each. Disks are perfectly working & user was unable to access volume.
We have created byte by byte images of all 4 disks & in r-studio we could create virtual raid5 volume , but scanning does not gibe MBR & file system.
Does anyone know how the embedded linux keeps data & how can i recover it?
Thanks & Regards
hddbug

[HDD Spaz]

Try UFS Explorer. I suggest you concentrate on finding block size, starting sector and order first.

[Steve]

Is it 2TB or 1.5TB?
if it is 2TB, then that rules out raid 5

[hddbug]

Hi Steve
Thanks a lot for quick help. yes , it is 2TB ( 4 disks of 500Gb each). So they could be in Jbod?
What should i do? Indivisual disk image shows 2 partitions 3.9GB & 461.8 GB , but R-studio yields nothing. I am trying Ufs explorer as suggested by Hdd Spaz.
Thank you .
Hddbug

[hddbug]

I tried UFS explorer it shows
disk 1- SGI XFS file system 3.92 GB / SGI XFS file system 461.83 GB
disk 2 - SGI XFS file ssytem 3.92 gb / unknown file system 461.83 GB
disk 3 - SGI XFS file ssytem 3.92 gb / unknown file system 461.83 GB
disk 4 - SGI XFS file ssytem 3.92 gb / unknown file system 461.83 GB

This may not be configured in raid 5 mode , any suggestion how can i tackle this case?
Thanks
Hddbug

[wiseleo]

You can read the config file from the Linux system partition to figure out how it mounts the file systems. That would be my starting point. The configuration files are in /etc. At least one partition is the root partition, unless the device boots from a flash storage medium.

The root partition should be relatively easy to find and mount. Once there, you have a ton of ways to store data in Linux. The automount scripts are usually in /etc/rc.d directories. /etc/fstab may have useful information also.

If the root partition is damaged beyond repair, index Disk 1 and search for string :0:0:

That will be probably the root:x:0:0: line in /etc/passwd file so you can search the disk nearby for other config files.

[drc]

I'm not sure how he would do that if he can't get the filesystem pieced together.

Hddbug, if the capacity of the total box is the same as the capacity of all drives added together, then you know it's not RAID 5. I'd be curious to see the scan results of each drive in r-studio.

[dobrevjetser]

Could be two raid-0's added as jbod. Found this in some lacie's.

Dobre

[hddbug]

Hi Dobre
Thanks , it seems you are right I tried all ways & means but in vain. Since volume size is 2TB , its sure that this is not in Raid5 configuration. Now how to identify which 2 disks are in Raid 0 & bring all images together to make single volume? In R-studio i tried to make stripped volume but failed to get NTFS MBR & file system.
Is there any way that i can try?
Thanks
hddbug

[dobrevjetser]

A good trick is to ask the customer some files (pictures for example) that he is sure are on the drive and from which he has an idential copy (from an old backup for example). Take care these files are big enough (a few MB at least) and then search on the drives for the starting bytes from such a picture. Once you have found that you follow till the point the data on the drive differs from the original. Then you look for the next bytes at another drive till you find it and so on.
That will give you the corresponding raid0 drive and the stripe size.

Best regards,

Dobre

[hddbug]

Hi Dobre , i will give try to it & report.
Thanks
Hddbug

[cgallery]

I was unable to recover a Lacie Ethernet Big Disk (two 500GB in JBOD w/ XFS) with UFS Explorer. I ended-up having to source a replacement enclosure, and mount the imaged drives back in the enclosure for a successful recovey.

[Samo]

The NAS I've worked with usually were set like this:
First partition is for the linux file system and is mirrored to all the drives in the NAS, in the place where were SWAP partition it was also mirrored. The space where the user data is stored - LVM as type of array.
For recovery I used "systemrescuecd" since it have build in LVM support. To be sure about the type of the raid you must check the /etc/fstab. It could look like this:

Code:

/dev/md0 / ext3 defaults 1 1
none                    /proc                   proc    defaults        0 0
none                    /sys                    sysfs   defaults        0 0
/dev/sda2               swap                    swap    defaults        0 0


Also if you check the drives especially the place where 461.83 GB partition start, probably you will find something alike to :

Code:

<DynamicDiskSegment guid="13e6d7f8-8660-6d0b-e886-0000476b7c82" firstSector="16128" lastSector="22271" owner="DIMASTYLE-NAS" dataset="1198226562" seqNo="0" isLastSegment="true" sectorSize="512" type="Umap" lunType="0" timestamp="1198226562" umapTimestamp="0" deviceName="NASDisk-00002" fileSystem="XFS"/>
<DynamicDiskSegment guid="13e6d7f8-8660-6d0b-e886-0000476b7c82" firstSector="22272" lastSector="3417620223" owner="DIMASTYLE-NAS" dataset="1198226562" seqNo="1" isLastSegment="true" sectorSize="512" type="NAS" lunType="0" timestamp="1198226562" umapTimestamp="0" deviceName="NASDisk-00002"/>

Some of those things will be very useful to you, to rebuild the LVM.

P.S. Ask Google, there are several interesting places where the LVM is described, as and the way it can be recovered (commands and etc.)
P.S.2 You may be a lucky one because LVM (as I checked it for one NAS) use successive way to store the data. I.e. start to write form the first drive (XFS partition) when it is full, go to second one and etc. So you may use even by signature.

Hope I was in help with this.

[hddbug]

The NAS I've worked with usually were set like this:
First partition is for the linux file system and is mirrored to all the drives in the NAS, in the place where were SWAP partition it was also mirrored. The space where the user data is stored - LVM as type of array.
For recovery I used "systemrescuecd" since it have build in LVM support. To be sure about the type of the raid you must check the /etc/fstab. It could look like this:

Code:

/dev/md0 / ext3 defaults 1 1
none                    /proc                   proc    defaults        0 0
none                    /sys                    sysfs   defaults        0 0
/dev/sda2               swap                    swap    defaults        0 0


Also if you check the drives especially the place where 461.83 GB partition start, probably you will find something alike to :

Code:

<DynamicDiskSegment guid="13e6d7f8-8660-6d0b-e886-0000476b7c82" firstSector="16128" lastSector="22271" owner="DIMASTYLE-NAS" dataset="1198226562" seqNo="0" isLastSegment="true" sectorSize="512" type="Umap" lunType="0" timestamp="1198226562" umapTimestamp="0" deviceName="NASDisk-00002" fileSystem="XFS"/>
<DynamicDiskSegment guid="13e6d7f8-8660-6d0b-e886-0000476b7c82" firstSector="22272" lastSector="3417620223" owner="DIMASTYLE-NAS" dataset="1198226562" seqNo="1" isLastSegment="true" sectorSize="512" type="NAS" lunType="0" timestamp="1198226562" umapTimestamp="0" deviceName="NASDisk-00002"/>

Some of those things will be very useful to you, to rebuild the LVM.

P.S. Ask Google, there are several interesting places where the LVM is described, as and the way it can be recovered (commands and etc.)
P.S.2 You may be a lucky one because LVM (as I checked it for one NAS) use successive way to store the data. I.e. start to write form the first drive (XFS partition) when it is full, go to second one and etc. So you may use even by signature.

Hope I was in help with this.

Hi Samo
Thank you so much , You have given a comprehensive solution to my problem. Thanks a Lot for your kind help.
Best Regards
Kiran Joshi

[hddbug]

Hello Everybody
no progress so far. disks are in raid 0 (stripped volumes) & not in LVM. I have disk images but i am unable to mount these images in fedora 10. Can someone please guide how i should proceed further.
Thanks
Hddbug

[pallanur]

Hello!!

Have you get some progress, hddbug?

Now I have got several Lacie Ethernet Raid Nas boxes and I'm going to work with them. I'm going to post here my steps, mu issues and my sucess (I hope).

The next one, after explore with UFS Explorer shows this partitions (the three same partitions) for the four disks:

Code:

Partition 1  Ext3Fs Start at 512B                   Size 128 Mb
Partition 2  Unknow FS Start at 128.5 Mb       Size 128.5 Mb
Partition 3  Unknow FS Start at 256.9 Mb      Size 232,63 Gb


Now i'm scanning the disks for los FS.

The Ext3fs partition in each disk have the system files, and the fstab is Okb (I think that it's one of the problems) and the unas.conf also is 0k (I think that this file is important at the configuration start).

The file ipstor.con have the next data, are these de data os a LVM volume disk?

Code:

<PhysicalDev name="DISKSAFE01" wwid="FALCON  LVMDISK-M09N01  v1.0-0-0-00" type="Direct-Access" isNew="false" owner="AREVA" devName="" category="Virtual Device" guid="3f67366c-97c6-ee26-ea0c-000045e7f3f3" fsid="fa1cfe00-0000-0000-0001-000000010000" fsidRelianceEnabled="true" queueDepth="4" connectionType="block" lunType="0">
−
<IPStorPartition checksum="">
<DynamicDiskSegment guid="529b3cb0-71cd-3608-52b6-000045e7f400"
firstSector="16128" lastSector="22271" owner="CUSTOMER_NAME" dataset="1172829184" seqNo="0" isLastSegment="true" sectorSize="512" type="Umap" lunType="0" timestamp="1172829184" umapTimestamp="1227026473" deviceName="NASDisk-00002" fileSystem="XFS"/>

<DynamicDiskSegment guid="529b3cb0-71cd-3608-52b6-000045e7f400" firstSector="22272" lastSector="975740671" owner="CUSTOMER_NAME" dataset="1172829184" seqNo="1" isLastSegment="true" sectorSize="512" type="NAS" lunType="0" timestamp="1172829184" umapTimestamp="0" deviceName="NASDisk-00002"/>

When I get more info I'll post it here.

Regards

[pallanur]

I have found one file named .disk_info that is placed in usr/ipstor/etc taht contains info about the disks and the RAID status, I think taht this last parameter is RAID level:

Code:

slot, model,serial,size,raid_status
0,SAMSUNG HD501LJ,S0MUJ1PP301763,476940,RAID 10
1,SAMSUNG HD501LJ,S0MUJ1PP301776,476940,RAID 10
2,SAMSUNG HD501LJ,S0MUJ1PP301761,476940,RAID 10
3,SAMSUNG HD501LJ,S0MUJ1PP301759,476940,RAID 10


[pallanur]

Hi !!

finally I get recover this NAS.

With the .disk_info information I build with UFS Explorer one RAID 0 with Disks 1 and 3 (After read the Lacie Nas Box specifications) with block size 64k and play Advanced Scan with File System reconstruction option.

And that's all!!

[DRNJ]

I have the exact same drive as HDDBUG:
Iomega Store center Pro 150D NAS server. It is 2TB box with 4 hard drives 500 GB each.

Mine appears to be set up as a RAID 5.
(I could be wrong but it is the only config that gives me good file names. But nothing opens except very small files)

I called iOmega up to try to find out the RAID parameters but they refused to give it to me.
They just say to send it to them and they will recover the data for $2,500 to $5,000.
(What a racket!!!!)

Am using UFS Explorer and tried many combinations with no luck
My first guess was:
RAID 5
Stripe size: 64K
Parity: Left-Symmetric
Parity Length:4
With every combo of drive order.
But that did not work.

I also tried RAID 0 with 2 drives (I used all drive combo)

UFS explorer it shows
disk 1- SGI XFS file system 3.92 GB / SGI XFS file system 461.83 GB
disk 2 - SGI XFS file ssytem 3.92 gb / unknown file system 461.83 GB
disk 3 - SGI XFS file ssytem 3.92 gb / unknown file system 461.83 GB
disk 4 - SGI XFS file ssytem 3.92 gb / unknown file system 461.83 GB

The 3.92 GB Partition on disk one had no problems and I can get a full Linux directory listing.
I looked for the etx/fstab and etc/rc.d file but could not find it.

The “\etc” directory listing is below:
03/17/2009 10:34 AM <DIR> .
03/17/2009 10:34 AM <DIR> ..
03/16/2009 12:52 AM 128 AppleVolumes.default
08/27/2007 12:17 PM 128 AppleVolumes.default_default
08/27/2007 12:17 PM 25,124 AppleVolumes.system
03/17/2009 10:33 AM <DIR> bkjobs
08/11/2007 06:29 AM 0 crontabs
01/12/2009 04:43 PM 33 domain_info.txt
03/16/2009 12:52 AM 2 domain_join_result.txt
03/17/2009 10:34 AM <DIR> fs
08/27/2007 12:17 PM 73 inetd.conf
03/17/2009 10:34 AM <DIR> init.d
10/26/2007 11:49 AM 11 mediaserver.conf
03/17/2009 10:34 AM <DIR> openldap
03/17/2009 10:34 AM <DIR> print
03/17/2009 10:34 AM <DIR> samba
03/17/2009 10:34 AM <DIR> util_scripts
10/29/2007 10:21 AM 546 vsftpd.conf
08/27/2007 12:17 PM 13 vsftp_deny
10 File(s) 26,058 bytes

Any Suggestions?

[Pupok]

could be:
- stripe size is wrong
- drive order is wrong
- scheme is wrong

two options - analysis or trying combinations one by one.
My guess it's up to 5x16x3=240 combinations. good luck

so $2500-$5000 is not a wild price for 1.5TB raid with XFS