RAID 5 2drives Failed

[GIKUYU]

Hi Team,

i have a Hp server HP DL380G5 Server running on RAID 5 on 4 drives.

Drive 01 failed about 2 moths ago
Drive 02 Failed Yesterday

Only that when the drives were both plugged out and reinserted back on the server they both came alive, on restarting the array collapsed and showed data loss.

now we rebuild the Array with the 4 Drives back together only that on running R-Studio cant seem to get any data.

was it a mistake to rebuild the array with the drive 01 that had failed 2 months ago?

if i image the drives 00,02,03. without drive 01 and rebuild a virtual array can i get the data?

The partition is and EXT3 partition on REDHUT Linux 5

kindly let me have your thoughts on this.

regards.

[lcoughey]

- start by getting a sector by sector clone of each drive
- then use R-Studio to rebuild the array via the clones

[GIKUYU]

the array partition has rebuild i can see the partition size 410gb but cant seem to see the data

so do i rebuild less of the disk that had failed earlier or i include it.

what about parity as i have already rebuild the array and included the disk that had failed 2 months ago

[Vulcan]

i have a Hp server HP DL380G5 Server running on RAID 5 on 4 drives.

Drive 01 failed about 2 moths ago
Drive 02 Failed Yesterday

Only that when the drives were both plugged out and reinserted back on the server they both came alive, on restarting the array collapsed and showed data loss.

Unfortunately, the procedure that you used was wrong.

It is also very unfortunate that the customer did not notice (and perform the necessary investigation and/or corrective action) when drive 01 "failed" 2 months ago (although, as with all RAID arrays, the drive may not have actually "failed" at all). Poor sys admin procedures.

was it a mistake to rebuild the array with the drive 01 that had failed 2 months ago?

It is unclear exactly what you mean by the word "rebuild" in this specific context, and it is unclear exactly how you used each of the 4 disks in that "rebuild". However, if you used any data from drive 01 (which "failed" 2 months ago) then that was a mistake - a big one.

As lcoughey said, you should have started by cloning the disks, before doing anything else.

kindly let me have your thoughts on this.

Depending on what you did exactly, those mistakes have probably led to major corruption of what was originally recoverable data.

[laptokowiec]

I think it's not as bad as Vulcan said.
Probably the system worked with spare drive and when drive01 failed, drive03 started to work.
The question is which drive is what number.
And you have to recover only from 00 and 03.
I you can image 02, then you can use it as well.
If you identify it correctly it should work.
If it doesn't, you should change the params of raid.

[Vulcan]

@laptokowiec: Actually, I agree that my previous comment might be unnecessarily pessimistic.

The OP mentioned "rebuild" (using drive 01) and then mentioned "R-Studio". I had interpreted that they had done some kind of RAID rebuild and later, that they were attempting to use R-Studio. Of course if they mean that all "rebuilds" were just in R-Studio, then hopefully they have not changed any data, and recovery should still be possible.

As I said before, it all depended on exactly what they meant by "rebuild"!

[GIKUYUU]

th

@laptokowiec: Actually, I agree that my previous comment might be unnecessarily pessimistic.

The OP mentioned "rebuild" (using drive 01) and then mentioned "R-Studio". I had interpreted that they had done some kind of RAID rebuild and later, that they were attempting to use R-Studio. Of course if they mean that all "rebuilds" were just in R-Studio, then hopefully they have not changed any data, and recovery should still be possible.

As I said before, it all depended on exactly what they meant by "rebuild"!

i want to make myself believe the situation is not a grievous as is.

the drives were put back all online and that array i would rightfully presume reconstituted itself or rebuild if i may say for it to come online and optimal.

this is what i meant by rebuild.

My biggest concern is the data is seemingly not coming off this volume, on running R-Studio the results for the partition are not in the proximity of being OK as the details including the volume name, file type EXT3 and size is looking OK but no data

on running the drives individually whit Raid re-constructor we are not able to get a significant result

what next?

can winternals Raid do it

or what can i use to determine order of the drive and hopefully build a virtual array for the data

[GIKUYUU]

i have read an intresting article here http://www.experts-exchange.com/Storage ... 62736.html

One person clerly bring out the situation i am in that the faliour of the raid what not the physical faliour of the drives but a technicality

i quote him

HP use an unusual type of parity, not the typical forward or reverse distributed. They use delayed parity, so instead of alternating the drive the parity block is written to each time it stays on a single drive for a certain number of operations. (See this for a description of delayed parity http://www.techsec.com/pdf/Wednesday/RA ... kerman.pdf). Now RAID Reconstructor doesn't actually have an option for this type of parity, so I can only assume it will not restore from HP/Compaq RAID5 sets, though this would need to be confirmed by them"

am not very conversant with winhex to solve this, is there an alternative to reconstruction a raid with Delayed Parity: assuming thats the case for my HP DL380G5

[laptokowiec]

You can "decrypt" HP raid in R-studio.
WinHex can do it as well (in R-studio it's not so easy).

[Vulcan]

@GIKUYUU:

the drives were put back all online and that array i would rightfully presume reconstituted itself or rebuild if i may say for it to come online and optimal.

this is what i meant by rebuild.

That is a lot of words, but IMHO it still does not clearly explain exactly what did happen. You said "rightfully presume", so in other words, you're guessing.

Also, your comment now is the exact opposite to what you said in your first post - now you said that the RAID volume became "optimal" after you inserted the 2 "failed" disks. However in your first post, you said that the volume "collapsed and showed data loss" after you inserted the 2 "failed" disks. That contradiction between your two statements, makes it impossible to understand what really happened.

Since laptokowiec is kindly helping you with logical recovery suggestions, I won't spend any more time on this. I will just finish by stating, as I did at the beginning, that using any of the 2 month-old data from drive 01 (e.g. by plugging-in that drive) was a mistake - the consequences of that mistake will depend on exactly what was done after that.

[GIKUYUU]

i just got winhex specialist for this purpose

the challange now is
1.WinHex the default delay for HP/Compaq is 4, so I've not been able workout for my array
2.stripe size in sectors
3.RAID offset

how do i work them out yet the Array Diagnostics Utility report is not found as we don't have an array

[GIKUYUU]

Finally it has worked. i did download a tool http://www.freeraidrecovery.com/ that is able to determine the drive order of an array with delayed parity.

on showing the right order i used R-Studio to build a virtual array and it gave a positive result on the lost partition including the volume name.

the server was running REDHUT 5 linux the volume is about 410gb EXT3 partiton. the only troulble i am having is the partition doesnt seem to have any data yet according to R-Studio its the right order. can it be the Start sectors or block size am not sure which is which i am using 64kb

what is the size of blocks in RAID 5 in HP ML380. On a SMART ARRAY P400 array controller, with SAS Drives?

[DR-Kiev]

Finally it has worked. i did download a tool http://www.freeraidrecovery.com/ that is able to determine the drive order of an array with delayed parity.

on showing the right order i used R-Studio to build a virtual array and it gave a positive result on the lost partition including the volume name.

the server was running REDHUT 5 linux the volume is about 410gb EXT3 partiton. the only troulble i am having is the partition doesnt seem to have any data yet according to R-Studio its the right order. can it be the Start sectors or block size am not sure which is which i am using 64kb

what is the size of blocks in RAID 5 in HP ML380. On a SMART ARRAY P400 array controller, with SAS Drives?

You are on wrong way.
Size of blocks in HP ML380 - 32 sectors (16Kb) by default.