RAID recovery - can see folder structure but files corrupted

[jag17]

Hi

The win 2003 server got power trip and after that unable to start. It has three SCSI hard disks each 36.4GB.

I checked the disks are all physically ok. I managed to image all three hard disks using R-Studio

The user not sure about RAID level, Block Size and order. He remembers that the total capacity of the server was 67.8GB. So it may be either RAID 5 or RAID 0 with one spare hard disk.

I am currently trying to recover data from the image. Without the block size and order parameters, I tried few possible combinations

I tried RAID 0 on R-studio, it did not return any data.

If I create RAID 5 volume with 64 bytes block size and Right Synchronous order I am able to see th folder structure, but when I open the xls, doc, jpeg files it is all corrupted.

When I just scan single DISK 0 image I can also see the folder structure but again all files are corrupted.

What is best way to recover files from these three disk images ?

Any help will be valuable

Cheers
-Jag

[BlackST]

Get the SERVER and do a ... ehm.... "reverse engineering of the array" (you know what I mean). Then you'll know where to start from and maybe what you need.

[jag17]

Get the SERVER and do a ... ehm.... "reverse engineering of the array" (you know what I mean). Then you'll know where to start from and maybe what you need.

The server is not able to power on and no more available. Is there anyway to recover without the original server

Cheers
-Jag

[BlackST]

Ouch...

Then you have only these options :

1) trial and error with different combinations
2) if you are lucky enough and you can determine the original configuration on an identical server, hoping they didn't change it (default) try that parameters
3) manually determine by analysing the file system (need a lot of comparison) and known good file (i.e. one known OS file) what you want.

RAID reconstruction is rarely simple - this is why it is expensive....

[DR-Kiev]

Please check your PM

[msurgeon]

Try RAID Reconstructor from www.runtime.org This may help find the proper parameters for the RAID (most likely RAID 5, not RAID 0 with spare).

[lcoughey]

Is the RAID a software RAID using Windows dynamic disks or is it a hardware RAID using a SCSI RAID controller? If it is a hardware RAID, what brand and model is the RAID controller?

Outside of trial and error, the best way to figure out a RAID configuration on three drive array is to us WinHex and simply compare the three drives. You should be able to determine the parity order and the block size from what you see.

[jag17]

Try RAID Reconstructor from www.runtime.org This may help find the proper parameters for the RAID (most likely RAID 5, not RAID 0 with spare).

I tried RAID reconstructor, but the search result was insignificant

[jag17]

Is the RAID a software RAID using Windows dynamic disks or is it a hardware RAID using a SCSI RAID controller? If it is a hardware RAID, what brand and model is the RAID controller?

Outside of trial and error, the best way to figure out a RAID configuration on three drive array is to us WinHex and simply compare the three drives. You should be able to determine the parity order and the block size from what you see.

Using hardware raid card, HP Smartarray 64X controller. (attached picture). It is a SCSI RAID card.

I will check with Winhex. Do you have any indication on what to look for when I open in Winhex?

Thanks for your help

Cheers
-Jag

Attachments

[Zero Alpha]

Do you have any indication on what to look for when I open in Winhex?

-Jag

Drive order, block size, parity order.

Exactly what blackst said.

[swersig]

you do have the controller and all three disks are ok. why not use it to check configuration? you could also image the array and check for partition/file system problems. is 64bit pci a problem?

[jag17]

Do you have any indication on what to look for when I open in Winhex?

-Jag

Drive order, block size, parity order.

Exactly what blackst said.

I have opened using Winhex and copied few lines from each hard disk. I know the drive order. I am not sure how to look for block size and parity order. Please help

Cheers
-Jag

Attachments

1_WINHEX-RAID.zip

(5.62 KiB) Downloaded 458 times

[jag17]

you do have the controller and all three disks are ok. why not use it to check configuration? you could also image the array and check for partition/file system problems. is 64bit pci a problem?

I have the working controller and working hard disks, but the server is not working due to power supply failure. The server is not starting and gives a blank screen on display. I don't have spare server or spare power supply.

I have also imaged the hard disks successfully using R-Studio.

I have the following information

HP Proliant ML350 G3 Server
HP SmartArray 64x Controller
3x SCSI HDD each 36.4 GB
Suspected RAID 5 array
I know driver order
Not sure about block size and parity order
Successfully imaged hard disk using R-Studio


Cheers
-Jag

[jag17]

[Update]
The SCSI card is HP SmartArray 641 Controller. It is 64bit/100Mhz PCI-X type card. Does anyone know default block size and block order for this card?

QuickSpecs here
http://h18000.www1.hp.com/products/quic ... 67_div.pdf

Cheers
-Jag

[DR-Kiev]

[Update]
The SCSI card is HP SmartArray 641 Controller. It is 64bit/100Mhz PCI-X type card. Does anyone know default block size and block order for this card?

QuickSpecs here
http://h18000.www1.hp.com/products/quic ... 67_div.pdf

Cheers
-Jag

Block order: Backward Delay parity
Block size : 128 s
Number of delays : 4 or 8

[jag17]

[Update]
The SCSI card is HP SmartArray 641 Controller. It is 64bit/100Mhz PCI-X type card. Does anyone know default block size and block order for this card?

QuickSpecs here
http://h18000.www1.hp.com/products/quic ... 67_div.pdf

Cheers
-Jag

Block order: Backward Delay parity
Block size : 128 s
Number of delays : 4 or 8

I tried the above settings on WinHex and tried to rebuild the raid, but not successful. In fact I tried all possible combinations in UFS explorer no chance also. Any help?

[jag17]

Finally solved and recovered data.

My thanks to all those who helped in this forum. My special thanks to microsoftengineer and DR-Kiev who took time to troubleshoot it remotely.

The initial problem was due to R-Studio image. The image was compressed and that created some problems in identifying parts of the image using winhex. DR-Kiev did a wonderful job. He immediately spotted issues and we did a re-image using winhex. Then opened the image using winhex and found out block size, order and delays (this where DR-Kiev experience comes into play, he is really a RAID expert) and used it to build RAID volume on winhex

The server was using HP smartarray 641 and the settings as found out are
Block Size: 32Kb
Block Order: 0,1,2
Delays: 16
Start of sector: 1088

Putting these values RAID array was build in winhex and then cloned to a physical hard disk and read out using R-studio from the physical disk.

All looked very easy when doing with DR-Kiev, but it is his experience that made it possible.

Thanks again for DR-Kiev great help and critical time.

Cheers
-Jag

[drc]

Wow, I hope you sent him some $$$

[xsoliman]

What does it mean by "Delays" in this context ?

Block size, Block Order and Starting sector are self explanitory
(athough may need to experiment to confirm the correct settings)

For this 3 drive Raid-5 system, would expect the data and parity blocks to be in the order

B0 B1 P01
B2 P23 B3
P34 B4 B5
B6 B7 P67
etc
or similar

all in block sized chunks

sounds like something to do with overriding the 'delay' / position of the parity block

Update: Presumably controls the placing of the parity block and what drive it is on and how it moves on subsequent stripes, especially for RAID5 units with more physical drives where there is more possibilitys of where to put it


Start sector of 1088 also sounds strange

Thanks for any enlightenment

[DR-Kiev]

jag17,

Thanks for the nice feedback

xsoliman,

Do you ever work with HP servers?

Attachments

delayd.JPG (24.49 KiB) Viewed 13437 times