2 RAID cases Opinions required..

[einstein9]

Dear RAID Experts... (This includes you Vlad. aka: Dr.Kiev if interested)

I have 2 cases & need the expert advice

A-16 drives
B- 8 SAS (looks someone played with it....etc)

If someone is willing to have a look & let me know "if possible" to get the requirements out of both and let me know...

replies in PM Only

Thank you

have a good day

[Iurii]

Connect all drives to one computer and check it... RAIDs are simple nowadays...
16 drives RAID may takes up to 4 hours.
8 drives RAID less than hour....

[Amarbir[CDR-Labs]]

Dear RAID Experts... (This includes you Vlad. aka: Dr.Kiev if interested)

I have 2 cases & need the expert advice

A-16 drives
B- 8 SAS (looks someone played with it....etc)

If someone is willing to have a look & let me know "if possible" to get the requirements out of both and let me know...

replies in PM Only

Thank you

have a good day

Sir ,
Lurii is one of the developers of UFS Explorer ,His knowledge in RAID is no less then anyone ,You can pm him and he can have a peek .I have taken his support 2 to 3 times for cases ,Great man with good understanding ,Regards

[khaja_345]

Dear RAID Experts... (This includes you Vlad. aka: Dr.Kiev if interested)

I have 2 cases & need the expert advice

A-16 drives
B- 8 SAS (looks someone played with it....etc)

If someone is willing to have a look & let me know "if possible" to get the requirements out of both and let me know...

replies in PM Only

Thank you

have a good day

i think he means private massage

[S.Haran]

If the client can provide you with a copy of sample file that is known to exist on the RAID pre-failure then I have an automated reverse engineering technique that attempts to reconstruct the RAID based on the sample file. A good sample file is in a compressed format (.jpg .mp3 etc.) larger than (the max chunk size * number of drives).

I find this especially useful to avoid wasting a lot of time on non-recoverable cases.

[fzabkar]

AFAIK, the $LogFile metafile in NTFS is usually large (64MB) and contiguous. The file consists of RCRD records, each of which is usually terminated in sequentially numbered words. I recently used two segments of this file to locate the two halves of a spanned volume. It's not an infallible method, but it proved ideal in my case.

[einstein9]

If the client can provide you with a copy of sample file that is known to exist on the RAID pre-failure then I have an automated reverse engineering technique that attempts to reconstruct the RAID based on the sample file. A good sample file is in a compressed format (.jpg .mp3 etc.) larger than (the max chunk size * number of drives).

I find this especially useful to avoid wasting a lot of time on non-recoverable cases.

As i said someone played with it (what they did? not 100% sure yet)

for some reason i disagree with you here about wasting time, I already Did Found few (not needed files) but am looking @the other Arrays
which am sure its there and consists of the requirements.

Its like a Puzzle to refresh your brain and wipe out the dust from it.

AFAIK, the $LogFile metafile in NTFS is usually large (64MB) and contiguous. The file consists of RCRD records, each of which is usually terminated in sequentially numbered words. I recently used two segments of this file to locate the two halves of a spanned volume. It's not an infallible method, but it proved ideal in my case.

Its really not as easy as it looks..

[fzabkar]

AFAIK, the $LogFile metafile in NTFS is usually large (64MB) and contiguous. The file consists of RCRD records, each of which is usually terminated in sequentially numbered words. I recently used two segments of this file to locate the two halves of a spanned volume. It's not an infallible method, but it proved ideal in my case.

Its really not as easy as it looks..

It seems a very plausible approach to me, although you would need to be careful.

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00004000  52 43 52 44 28 00 09 00 F9 09 80 03 00 00 00 00  RCRD(...ù.€.....
00004010  01 00 00 00 0C 00 01 00 C8 0F 00 00 00 00 00 00
00004020  EA 09 80 03 00 00 00 00 D3 0D 00 00 00 00 00 00
........                          ^^^^^
00004FF0  01 00 00 00 00 00 00 00 1B 00 01 00 28 00 D3 0D                    <-- 0xDD3
                                                    ^^^^^

00005000  52 43 52 44 28 00 09 00 F0 0B 80 03 00 00 00 00  RCRD(...ð.€.....
00005010  01 00 00 00 0C 00 02 00 D8 0F 00 00 00 00 00 00
00005020  F0 0B 80 03 00 00 00 00 D4 0D 00 00 00 00 00 00
........                          ^^^^^
00005FF0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 D4 0D                    <-- 0xDD4
                                                    ^^^^^

00006000  52 43 52 44 28 00 09 00 F6 0D 80 03 00 00 00 00  RCRD(...ö.€.....
00006010  01 00 00 00 0C 00 03 00 B0 0F 00 00 00 00 00 00
00006020  EA 0D 80 03 00 00 00 00 D5 0D 01 00 00 00 00 00
........                          ^^^^^
00006FF0  00 00 00 00 00 00 00 00 26 00 00 00 00 00 D5 0D                    <-- 0xDD5
                                                    ^^^^^

Last edited by fzabkar on August 31st, 2019, 2:53, edited 1 time in total.

[einstein9]

@ fzabkar

Would u like to try?

trust me... its not as easy as it looks.

[fzabkar]

Search for the RCRD records on each drive, collect all the segments, identify the corresponding LBAs, upload the bits and pieces and let us assemble the $LogFile. That's assuming your file system is NTFS.

[Arch Stanton]

This always strikes me as a very straight forward approach: https://youtu.be/Fw4cdQxIG84

[fzabkar]

This always strikes me as a very straight forward approach: https://youtu.be/Fw4cdQxIG84

I agree. In fact I was tempted to ask whether ReclaiMe had been tried.

https://www.reclaime.com/library/how-to-recover-raid.aspx

[lcoughey]

Entropy analysis with reclaime pro is super useful for quickly determining drive order and block size

[DR-Kiev]

Winhex much faster, if you know how. XOR/RS blocks easily recognizable even by eyes, and button F2 is for entropy made, you can check each particular block with that option in case if eyes fail.

[einstein9]

Entropy analysis with reclaime pro is super useful for quickly determining drive order and block size

You need to know that really i wasted alot of time with this case and got some results (not the requirements)
but i did my homework very well,,,,

Someone here had a look too, got almost the same results as mine with better results but again case is totally damaged
its good from time to time to get similar cases just to train your brain better to understand what really happened.


@fzabkar , Arch Stanton , again
This someone can tell you how good/bad is my skills now with Raid cases (if he wishes)

Thank you all again for the recommendation & comments...

[einstein9]

I believe something went missing from here, it doesn`t matter actually but i guess the point is clear now.