Need help with RAID-5 SAS 3x146Gb

[spatecc]

Hi everyone. I am starting to post the most challenging cases we have, with the intent to get help to resolve the issues and let history record in the board for upcoming generations. i will post the case with all the details, and document all the steps taken until conclusion. Sorry about my english, I am not a native speaker.

Case: RAID 5 3x146Gb SATA SAS disks from HP server, presumibly with Win 2003 server. No further information about disk order, stripe sizes, parity, rotation, etc. The client refers the array was working at least a month with only two disks (doesnt know what disks), and after the failure of the second disk he brings all to us.

Actions taken:

- We image all 3 disks encountering minor problems (bad sectors) in two of them.
- Try RAID Reconstructor with no success. (Results non significant)
- Try ZAR to make automatic discovery of the settings but only get less than 30% of the files. We try many combinations (0-1-2, 0-1, 1-2, 2-3) with same results.
- Try R-Studio with manual parameters (0-1-2, backwards simmetric, 64k, seems to be the closest one), but only on certain order we can see 2 partitions, with no success on data retrieval.
- Try File Scavenger with manual parameters (0-1-2, backwards simmetric, 64k, seems to be the closest one), but only on certain order we can see 2 partitions, with little success on data retrieval.

Partial conclusions:

- I think we cant rebuild the array using 3 disks to reconstruct because maybe at least one have different information (due the first failure).
- We dontk know what "pair" was the good ones, so we are probing 0-1, 1-2, 0-3, etc, but until today we have no better results.
- I want to ask you everyone about ideas or procedures to solve this problem before we give it up.


Francisco Maya
http://equipoelectronico.com

[Cleanroom]

A lot of the Hp servers i have seen have used a forwards parity. But you really need to find out the order and which one was the first to die. Since that drive will have different data on it then the 2 other ones.

You can also try Winhex. That is a great program for rebuilding raids

also it is most likely a 128 sector count for the parity size. That is the most common, but not to say that it could be something else.

edit - Also you should really find out from your client what they have done to the server before you got it. Sometimes they do not tell you everything upfront.

[cheadledatarecovery]

HP RAID controllers have a slightly unusual config. Having just the order/block size/parity direction is not going to be enough. PM me for help. I can offer remote support.

[DR-Kiev]

2 spatecc

Most of all HP raid system i saw, use parity delays.
In R-studio you could buit it only manual .
Somthing like this:

Attachments

[Hee]

Use X-ways WinHex.
it support hp parity delay.

Attachments

[spatecc]

UPDATE

I am trying hard on this, barely sleeping to find the correct parameters.

I am working with this guide: http://www.r-tt.com/Articles/Finding_RA ... ndex.shtml

I think I made some progress here. In R-Studio I was able to mount a RAID configuration who allows me to mount the second partition (200 Gb): 2-1-0, 64k, left asyncronous (continuous). I am working right now finding the offset.

I think my problems here are narrowed to find the offset, to find if the RAID has some kind of delay and maybe if one combination of disks can work better than other.

[spatecc]

Hi everyone. Sorry for the wait.

This case was succesfully recovered with the kind help of one member of this forum.

The data was recovered (at 75% roughly, mainly because the disks was modified by the user after the failure), using at first WinHex to examine the data structures in each disk, and then making a custom xml in RStudio.

I am really grateful to all. I understand a little better now the dynamics of the forum. I think it maybe seems tough at first but also I think this happens when you gather people from around the world and with different leves of experience.

I want to learn always, and I want to invite everyone to follow the advices from the most experimented forum users. I think if they say something to you (and that sounds rude or weird, or is not what you want to ear), always is in the best interest to all users.

Thank you all.