G-Technology 4TB RAID

[jnorth]

I have one of these to recover for a client and I'm finding it very difficult to work through the correct settings for the RAID 0 configuration. I have contacted their tech support but they have been of absolutely no help.

Does anyone know the correct settings for recovering this product ie block size and number of rows etc?

So far I've tried both R-Studio and UFS Explorer with all combinations and no success.

Thank you in advance.

[fzabkar]

I have one of these to recover for a client and I'm finding it very difficult to work through the correct settings for the RAID 0 configuration.

Can you show us the contents of sector 0 of each drive?

[pcimage]

Could well be a single sector stripe.

[hddguy]

Could well be a single sector stripe.

Agreed

[Dmitri]

Should none of the options work and you'll be looking for the assistance with this job, please feel free to contact me.
I believe we should be able to help recovering this G-RAID remotely.

[jnorth]

I have one of these to recover for a client and I'm finding it very difficult to work through the correct settings for the RAID 0 configuration.

Can you show us the contents of sector 0 of each drive?

Happy to, what program would be best to capture that with?

[jnorth]

Could well be a single sector stripe.

Agreed

I've tried both with R-Studio and UFS Explorer to no avail. Any specific settings you can recommend for either?

[jnorth]

I have one of these to recover for a client and I'm finding it very difficult to work through the correct settings for the RAID 0 configuration.

Can you show us the contents of sector 0 of each drive?

I've captured the data using R-Studio, let me know if there's anything else you need.

Attachments

[fzabkar]

The two sectors appear identical. Each shows a partition table with a single 2TB partition beginning at sector #1.

The size is ...

0xE8E088AF x 512 = 2 000 398 933 504 bytes

The partition type is 0xEE which tells us that this is a protective MBR.

Therefore you have a 2TB RAID 1, not a RAID 0, and the RAID is partitioned in GPT mode.

See http://thestarman.pcministry.com/asm/mb ... es.htm#pte

... and http://thestarman.pcministry.com/asm/mbr/GPT.htm#GPTPT

[jnorth]

The two sectors appear identical. Each shows a partition table with a single 2TB partition beginning at sector #1.

The size is ...

0xE8E088AF x 512 = 2 000 398 933 504 bytes

The partition type is 0xEE which tells us that this is a protective MBR.

Therefore you have a 2TB RAID 1, not a RAID 0, and the RAID is partitioned in GPT mode.

See http://thestarman.pcministry.com/asm/mb ... es.htm#pte

... and http://thestarman.pcministry.com/asm/mbr/GPT.htm#GPTPT

This is the strange part, doing scans with both UFS Explorer and R-Studio both show up nothing in terms of a lost partition. A raw recovery also fails to come up with any data.

Setting it up as a RAID 0 in R-Studio and scanning the drives shows up a HFS+ 4Tb partition, opening the partition shows up the file and folder names however no data is recoverable or accessible ie it is just fragmented. That's what lead me to think it was a RAID 0 config and the owner of the drives is adamant it was not mirrored.

Having said, based on what you've indicated I've gone back and scanned again however still with no luck. This one truly has me stumped...

[DR-Kiev]

The two sectors appear identical. Each shows a partition table with a single 2TB partition beginning at sector #1.

The size is ...

0xE8E088AF x 512 = 2 000 398 933 504 bytes

The partition type is 0xEE which tells us that this is a protective MBR.

Therefore you have a 2TB RAID 1, not a RAID 0, and the RAID is partitioned in GPT mode.

See http://thestarman.pcministry.com/asm/mb ... es.htm#pte

... and http://thestarman.pcministry.com/asm/mbr/GPT.htm#GPTPT

This is the strange part, doing scans with both UFS Explorer and R-Studio both show up nothing in terms of a lost partition. A raw recovery also fails to come up with any data.

Setting it up as a RAID 0 in R-Studio and scanning the drives shows up a HFS+ 4Tb partition, opening the partition shows up the file and folder names however no data is recoverable or accessible ie it is just fragmented. That's what lead me to think it was a RAID 0 config and the owner of the drives is adamant it was not mirrored.

Having said, based on what you've indicated I've gone back and scanned again however still with no luck. This one truly has me stumped...

Show the last sector of each drive.

[jnorth]

The two sectors appear identical. Each shows a partition table with a single 2TB partition beginning at sector #1.

The size is ...

0xE8E088AF x 512 = 2 000 398 933 504 bytes

The partition type is 0xEE which tells us that this is a protective MBR.

Therefore you have a 2TB RAID 1, not a RAID 0, and the RAID is partitioned in GPT mode.

See http://thestarman.pcministry.com/asm/mb ... es.htm#pte

... and http://thestarman.pcministry.com/asm/mbr/GPT.htm#GPTPT

This is the strange part, doing scans with both UFS Explorer and R-Studio both show up nothing in terms of a lost partition. A raw recovery also fails to come up with any data.

Setting it up as a RAID 0 in R-Studio and scanning the drives shows up a HFS+ 4Tb partition, opening the partition shows up the file and folder names however no data is recoverable or accessible ie it is just fragmented. That's what lead me to think it was a RAID 0 config and the owner of the drives is adamant it was not mirrored.

Having said, based on what you've indicated I've gone back and scanned again however still with no luck. This one truly has me stumped...

Show the last sector of each drive.

Here they are - first try seems to have not loaded:

Attachments

[fzabkar]

Both sectors contain identical data, but different DiskGUIDs, so it's not a mirror.

http://thestarman.pcministry.com/asm/mbr/GPT.htm

I'm thinking that the client may have removed each drive from its enclosure, attached them to a SATA controller, and reinitialised them as 2TB GPT partitions. Sector 2 would have the current partitioning information.

[jnorth]

Both sectors contain identical data, but different DiskGUIDs, so it's not a mirror.

http://thestarman.pcministry.com/asm/mbr/GPT.htm

I'm thinking that the client may have removed each drive from its enclosure, attached them to a SATA controller, and reinitialised them as 2TB GPT partitions. Sector 2 would have the current partitioning information.

Okay, thank you again.

[jnorth]

Both sectors contain identical data, but different DiskGUIDs, so it's not a mirror.

http://thestarman.pcministry.com/asm/mbr/GPT.htm

I'm thinking that the client may have removed each drive from its enclosure, attached them to a SATA controller, and reinitialised them as 2TB GPT partitions. Sector 2 would have the current partitioning information.

I'm not sure they did remove them but they did report things going wrong with he unit which stopped them accessing the data.

Here's the first and second sectors of both drives.

Attachments

[fzabkar]

Sector 2 shows three GPT partitions. These appear to be original and were not created by an external OS. Each of the 6 partitions has its own unique GUID, but otherwise each set appears identical.

Code:

Partition #    Start LBA    End LBA      Size         Partition ID

1              0x28         0x64027      0x64000      EFI System Partition
2              0x64028      0xE8DC8887   0xE8D64860   Terminated G-RAID with Thunderbolt
3              0xE8DC8888   0xE8E08887   0x40000      Booter

http://en.wikipedia.org/wiki/GUID_Partition_Table

I suspect that the second partition contains the user data, and that sector 0x64028 may be the offset for the array. ISTM that the external OS would not see the partition structure, but would only see those sectors in the range of the second partition.

Unless someone can provide definitive information as to the RAID parameters, I would examine sectors 0x64028 (= 409640 decimal) and 0x64029 on each drive. This may help us to confirm whether the array has a stripe size of 1 sector, as suggested by others.

[mr_spokk]

Could well be a single sector stripe.

And if it is, it takes a while to recover data from it...

[fzabkar]

One way to determine the stripe size would be to take a working unit and write a file that is constructed as follows:

sector 0 contains the text string "SECTOR 0"
sector 1 contains the text string "SECTOR 1"
...
sector X contains the text string "SECTOR X"

Then disassemble the RAID and determine the relationship between the file's physical and logical sectors (assuming that fragmention will not be an issue).

[pcimage]

Could well be a single sector stripe.

And if it is, it takes a while to recover data from it...

Yep, got 3x 3Tb drives from a LaCie box here with single stripe RAID 5.

Will take SOME TIME!!!