RAID5 - HP Smart Array E200, failed drive.

[d1554573r]

Hi,

Thanks to a power spike around two weeks ago two out of four hdds in my server raid5 array died, i found a guy that was able to bring one of them back to life, but array didnt recognise it properly.

So atm, im trying to recover data from 3 out of 4 drives.

Server was configured by hp and it had standart raid configuration. Serwer model: Hp AIO 400r.
So atm, im struggling with guessing correct configuration,(i tried ZAR but it appears to hang @ 100% of quick identifing of data)

I tried R-Studio but resources on hp configurations of arrays are extremly limited. Scan of the virtual raid returns viewable files.

(Yes, i know what im doing, and yes the data is extremly important)

Can anyone help me out finding out the proper configuration for r-studio? (or sharing other suggestions ofc)

[Touchclarity]

Hi,

Have you tried RAID reconstructor from runtime software.... solved many a RAID issue for me...

[dobrevjetser]

If its a hp server there is a special config for the raid that only winhex (afaik) supports without hassle.
You can use rstudio also, but its a lot of manual work.
Hp/Compaq uses delayed stripe.


Dobre

[d1554573r]

Hi,

Have you tried RAID reconstructor from runtime software.... solved many a RAID issue for me...

I did, results were inconclusive.

If its a hp server there is a special config for the raid that only winhex (afaik) supports without hassle.
You can use rstudio also, but its a lot of manual work.
Hp/Compaq uses delayed stripe.

I've saw mentions about this special config in the forums here but, since cat&mouse stuff related with reverse eng. the awnser to that other poor guys question was delivered to him via pm, and he didn't share the conclusion in the topic other then the fact of recovering 75% of data, no tech stuff.

Thanks for fast replys.

Last edited by d1554573r on November 24th, 2010, 10:51, edited 1 time in total.

[dmarques]

RAID Reconstructor will not help you in this case, as doesn't support delayed stripe.
You really have to find out the config and rebuild it using winhex for example.

[d1554573r]

Seems like i got yet another reason to dislike hp products...

[dmarques]

Don't be like that
HP has good and bad products like everyone else.
In this case you can still rebuild it.

[d1554573r]

The E200 and P400 are LSI chipsets and don't follow the delayed parity rotation of the typical SmartArrays. RAID controller metadata is on the back. Search for keywords HPSA_RIS and the first hex character of that sector will spell out the order of each drive.

First off it's a Forward parity rotation usually 128 sectors starting at sector zero and not 1088. Also, partity starts on the second component and not the first.

This is the best Intel i was able to find on google [http://www.x-ways.net/winhex/forum/messages/174/2987.html?1280356762]

But i dont know how this translates to r-studio?

[d1554573r]

First off it's a Forward parity rotation usually 128 sectors starting at sector zero and not 1088. Also, partity starts on the second component and not the first.

So far this is the best intel i found on google about e200. From what I understand its Right Asynchronous, 128 (256K). But i don't get the second component part.

Code:

The E200 and P400 are LSI chipsets and don't follow the delayed parity rotation of the typical SmartArrays. RAID controller metadata is on the back. Search for keywords HPSA_RIS and the first hex character of that sector will spell out the order of each drive.

Anyone understands a bit more out of this then I do?

[d1554573r]

Ok, I studied some literature on the subject and so far i understand that this parity would look like this:

P1-01-02-03
P2-04-05-06
P3-07-08-09
P4-10-11-12
15-P2-14-13
16-P2-17-18
19-P2-xx-xx

This how forward async delayed parity with 4 stripes delay would look like I guess?

Hmmm, now I think i understand the second component parity

01-P1-02-03
04-P1-05-06
07-P1-08-09
10-P1-11-12
13-14-P2-15
ETC...

[d1554573r]

I dunno why i can't edit my previous posts...

In the end I think the order would look like this:

HDD1-HDD2-HDD3-HDD4

01-P0-02-03
04-P1-05-06
07-P2-08-09
10-P3-12-13
14-15-P4-16
17-18-P5-19
20-21-P6-22
23-24-P7-25

Does it make any sense?

Since it starts at sector 0 instead of 1088 this would mean this raid has no header... Seems like tomorrow is a hex day :/

[dmarques]

If MBR starts on sector 0 it has no header. That's true.

[lcoughey]

If you haven't done so already, it would be wise to clone each drive and work off the clones...especially considering how valuable the data is.

Also, can you confirm that the two drives did go down at the same time? Is it possible that the drive that was "fixed" went down before the other, thus the reason why it isn't being accepted by the RAID? I'm also curious to know what was wrong with the bad drives and what was done to "repair" the one drive. It would suck for you to spend a lot of time fighting with the recovery and find out that the one drive doesn't even have useful information on it.

[d1554573r]

I tried my own preset for r-studio assuming that delay = 4:

Code:

<?xml version="1.0" encoding="UTF-8" ?>

<RAIDList>
  <RAID blockSize="131072" name="Smart Array E200" parents="4" rows="16">

    <Table>

      <Block id="A1">1</Block>

      <Block id="B1">XorOfData</Block>

      <Block id="C1">2</Block>

      <Block id="D1">3</Block>

      <Block id="A2">4</Block>

      <Block id="B2" sequence="1">XorOfData</Block>

      <Block id="C2">5</Block>

      <Block id="D2">6</Block>

      <Block id="A3">7</Block>

      <Block id="B3" sequence="2">XorOfData</Block>

      <Block id="C3">8</Block>

      <Block id="D3">9</Block>

      <Block id="A4">10</Block>

      <Block id="B4" sequence="3">XorOfData</Block>

      <Block id="C4">11</Block>

      <Block id="D4">12</Block>

      <Block id="A5">13</Block>

      <Block id="B5">14</Block>

      <Block id="C5" sequence="4">XorOfData</Block>

      <Block id="D5">15</Block>

      <Block id="A6">16</Block>

      <Block id="B6">17</Block>

      <Block id="C6" sequence="5">XorOfData</Block>

      <Block id="D6">18</Block>

      <Block id="A7">19</Block>
      <Block id="B7">20</Block>

      <Block id="C7" sequence="6">XorOfData</Block>

      <Block id="D7">21</Block>
      <Block id="A8">22</Block>

      <Block id="B8">23</Block>
      <Block id="C8" sequence="7">XorOfData</Block>

      <Block id="D8">24</Block>
      <Block id="A9">25</Block>

      <Block id="B9">26</Block>

      <Block id="C9">27</Block>

      <Block id="D9" sequence="8">XorOfData</Block>

      <Block id="A10">28</Block>

      <Block id="B10">29</Block>

      <Block id="C10">30</Block>

      <Block id="D10" sequence="9">XorOfData</Block>

      <Block id="A11">31</Block>

      <Block id="B11">32</Block>

      <Block id="C11">33</Block>

      <Block id="D11" sequence="10">XorOfData</Block>

      <Block id="A12">34</Block>

      <Block id="B12">35</Block>

      <Block id="C12">36</Block>

      <Block id="D12" sequence="11">XorOfData</Block>

      <Block id="A13" sequence="13">XorOfData</Block>

      <Block id="B13">37</Block>

      <Block id="C13">38</Block>

      <Block id="D13">39</Block>

      <Block id="A14" sequence="14">XorOfData</Block>

      <Block id="B14">40</Block>

      <Block id="C14">41</Block>

      <Block id="D14">42</Block>

      <Block id="A15" sequence="15">XorOfData</Block>

      <Block id="B15">43</Block>

      <Block id="C15">44</Block>

      <Block id="D15">45</Block>
      <Block id="A16" sequence="16">XorOfData</Block>

      <Block id="B16">46</Block>

      <Block id="C16">47</Block>

      <Block id="D16">48</Block>

    </Table>
    <Sequences>

      <Sequence id="1">B2</Sequence>

      <Sequence id="2">B3</Sequence>

      <Sequence id="3">B4</Sequence>

      <Sequence id="4">C5 C6</Sequence>

      <Sequence id="5">C6</Sequence>

      <Sequence id="6">C7 C8</Sequence>

      <Sequence id="7">C8</Sequence>

      <Sequence id="8">D9</Sequence>

      <Sequence id="9">D10</Sequence>

      <Sequence id="10">D11</Sequence>

      <Sequence id="11">D12 A13</Sequence>

      <Sequence id="12">A14</Sequence>

      <Sequence id="13">A13</Sequence>

      <Sequence id="14">A14</Sequence>

      <Sequence id="15">A15</Sequence>

      <Sequence id="16">A16</Sequence>

    </Sequences>

  </RAID>

</RAIDList>


But it didn't work now im about to try delay = 8 gahh

Im not 100% sure the other hdd died with the one recovered but due to the damage the other one recieved theres a chance that it died earlier then the revived one. I made 1:1 copies of hdd's since those hdd's are 500Gb in size and im kinda short @ capacity since the dead server was the nas around here...

[d1554573r]

Okey, imteresting things came out when I made xml for Forward parity rotation usually starting on the second component, scan looks more like a regular hdd ....

Code:

  </RAID>
<RAID blockSize="65536" name="Smartv2" parents="4" rows="4">
<Table>
  <Block id="A1">1</Block>
  <Block id="B1" sequence="1">XorOfData</Block>
  <Block id="C1">2</Block>
  <Block id="D1">3</Block>
  <Block id="A2">4</Block>
  <Block id="B2">5</Block>
  <Block id="C2" sequence="3">XorOfData</Block>
  <Block id="D2">6</Block>
  <Block id="A3">7</Block>
  <Block id="B3">8</Block>
  <Block id="C3">9</Block>
  <Block id="D3" sequence="4">XorOfData</Block>
  <Block id="A4" sequence="2">XorOfData</Block>
  <Block id="B4">10</Block>
  <Block id="C4">11</Block>
  <Block id="D4">12</Block>
  </Table>
<Sequences>
  <Sequence id="1">B1 C2 D3</Sequence>
  <Sequence id="2">A4</Sequence>
  <Sequence id="3">C2</Sequence>
  <Sequence id="4">D3</Sequence>
  </Sequences>
  </RAID>
  </RAIDList>

[d1554573r]

Ok, gurus so far i got no real progress, but i found that each 8 sectors RCRD tag appears in asci, I got a wild guess this can be some kind of stripe marker and this would mean that stripe size is 4kb, whats more this tag appears on 0 sector on 2nd hdd just like that guy on x-ray forums suggested. Can any one confim this?

[dmarques]

Don't think that has anything to do with any marker. That's most probably from NTFS file system.

[DR-Kiev]

Ok, I studied some literature on the subject and so far i understand that this parity would look like this:

P1-01-02-03
P2-04-05-06
P3-07-08-09
P4-10-11-12
15-P2-14-13
16-P2-17-18
19-P2-xx-xx

This how forward async delayed parity with 4 stripes delay would look like I guess?

Hmmm, now I think i understand the second component parity

01-P1-02-03
04-P1-05-06
07-P1-08-09
10-P1-11-12
13-14-P2-15
ETC...

You are on right way, but still a lot mistakes
For forward delayd parity it should look like this:

Attachments

[DR-Kiev]

Okey, imteresting things came out when I made xml for Forward parity rotation usually starting on the second component, scan looks more like a regular hdd ....

Code:

  </RAID>
<RAID blockSize="65536" name="Smartv2" parents="4" rows="4">
<Table>
  <Block id="A1">1</Block>
  <Block id="B1" sequence="1">XorOfData</Block>
  <Block id="C1">2</Block>
  <Block id="D1">3</Block>
  <Block id="A2">4</Block>
  <Block id="B2">5</Block>
  <Block id="C2" sequence="3">XorOfData</Block>
  <Block id="D2">6</Block>
  <Block id="A3">7</Block>
  <Block id="B3">8</Block>
  <Block id="C3">9</Block>
  <Block id="D3" sequence="4">XorOfData</Block>
  <Block id="A4" sequence="2">XorOfData</Block>
  <Block id="B4">10</Block>
  <Block id="C4">11</Block>
  <Block id="D4">12</Block>
  </Table>
<Sequences>
  <Sequence id="1">B1 C2 D3</Sequence>
  <Sequence id="2">A4</Sequence>
  <Sequence id="3">C2</Sequence>
  <Sequence id="4">D3</Sequence>
  </Sequences>
  </RAID>
  </RAIDList>

I hope it will help you, take this :
<RAIDList>
<RAID blockSize="16384" name="RAIDLayoutHP_Forward4D" parents="4" rows="64">
<Table>
<Block id="A1">XorOfData</Block>
<Block id="B1">1</Block>
<Block id="C1">2</Block>
<Block id="D1">3</Block>
<Block id="A2">XorOfData</Block>
<Block id="B2">4</Block>
<Block id="C2">5</Block>
<Block id="D2">6</Block>
<Block id="A3">XorOfData</Block>
<Block id="B3">7</Block>
<Block id="C3">8</Block>
<Block id="D3">9</Block>
<Block id="A4">XorOfData</Block>
<Block id="B4">10</Block>
<Block id="C4">11</Block>
<Block id="D4">12</Block>
<Block id="A5">XorOfData</Block>
<Block id="B5">13</Block>
<Block id="C5">14</Block>
<Block id="D5">15</Block>
<Block id="A6">XorOfData</Block>
<Block id="B6">16</Block>
<Block id="C6">17</Block>
<Block id="D6">18</Block>
<Block id="A7">XorOfData</Block>
<Block id="B7">19</Block>
<Block id="C7">20</Block>
<Block id="D7">21</Block>
<Block id="A8">XorOfData</Block>
<Block id="B8">22</Block>
<Block id="C8">23</Block>
<Block id="D8">24</Block>
<Block id="A9">XorOfData</Block>
<Block id="B9">25</Block>
<Block id="C9">26</Block>
<Block id="D9">27</Block>
<Block id="A10">XorOfData</Block>
<Block id="B10">28</Block>
<Block id="C10">29</Block>
<Block id="D10">30</Block>
<Block id="A11">XorOfData</Block>
<Block id="B11">31</Block>
<Block id="C11">32</Block>
<Block id="D11">33</Block>
<Block id="A12">XorOfData</Block>
<Block id="B12">34</Block>
<Block id="C12">35</Block>
<Block id="D12">36</Block>
<Block id="A13">XorOfData</Block>
<Block id="B13">37</Block>
<Block id="C13">38</Block>
<Block id="D13">39</Block>
<Block id="A14">XorOfData</Block>
<Block id="B14">40</Block>
<Block id="C14">41</Block>
<Block id="D14">42</Block>
<Block id="A15">XorOfData</Block>
<Block id="B15">43</Block>
<Block id="C15">44</Block>
<Block id="D15">45</Block>
<Block id="A16">XorOfData</Block>
<Block id="B16">46</Block>
<Block id="C16">47</Block>
<Block id="D16">48</Block>
<Block id="A17">49</Block>
<Block id="B17">XorOfData</Block>
<Block id="C17">50</Block>
<Block id="D17">51</Block>
<Block id="A18">52</Block>
<Block id="B18">XorOfData</Block>
<Block id="C18">53</Block>
<Block id="D18">54</Block>
<Block id="A19">55</Block>
<Block id="B19">XorOfData</Block>
<Block id="C19">56</Block>
<Block id="D19">57</Block>
<Block id="A20">58</Block>
<Block id="B20">XorOfData</Block>
<Block id="C20">59</Block>
<Block id="D20">60</Block>
<Block id="A21">61</Block>
<Block id="B21">XorOfData</Block>
<Block id="C21">62</Block>
<Block id="D21">63</Block>
<Block id="A22">64</Block>
<Block id="B22">XorOfData</Block>
<Block id="C22">65</Block>
<Block id="D22">66</Block>
<Block id="A23">67</Block>
<Block id="B23">XorOfData</Block>
<Block id="C23">68</Block>
<Block id="D23">69</Block>
<Block id="A24">70</Block>
<Block id="B24">XorOfData</Block>
<Block id="C24">71</Block>
<Block id="D24">72</Block>
<Block id="A25">73</Block>
<Block id="B25">XorOfData</Block>
<Block id="C25">74</Block>
<Block id="D25">75</Block>
<Block id="A26">76</Block>
<Block id="B26">XorOfData</Block>
<Block id="C26">77</Block>
<Block id="D26">78</Block>
<Block id="A27">79</Block>
<Block id="B27">XorOfData</Block>
<Block id="C27">80</Block>
<Block id="D27">81</Block>
<Block id="A28">82</Block>
<Block id="B28">XorOfData</Block>
<Block id="C28">83</Block>
<Block id="D28">84</Block>
<Block id="A29">85</Block>
<Block id="B29">XorOfData</Block>
<Block id="C29">86</Block>
<Block id="D29">87</Block>
<Block id="A30">88</Block>
<Block id="B30">XorOfData</Block>
<Block id="C30">89</Block>
<Block id="D30">90</Block>
<Block id="A31">91</Block>
<Block id="B31">XorOfData</Block>
<Block id="C31">92</Block>
<Block id="D31">93</Block>
<Block id="A32">94</Block>
<Block id="B32">XorOfData</Block>
<Block id="C32">95</Block>
<Block id="D32">96</Block>
<Block id="A33">97</Block>
<Block id="B33">98</Block>
<Block id="C33">XorOfData</Block>
<Block id="D33">99</Block>
<Block id="A34">100</Block>
<Block id="B34">101</Block>
<Block id="C34">XorOfData</Block>
<Block id="D34">102</Block>
<Block id="A35">103</Block>
<Block id="B35">104</Block>
<Block id="C35">XorOfData</Block>
<Block id="D35">105</Block>
<Block id="A36">106</Block>
<Block id="B36">107</Block>
<Block id="C36">XorOfData</Block>
<Block id="D36">108</Block>
<Block id="A37">109</Block>
<Block id="B37">110</Block>
<Block id="C37">XorOfData</Block>
<Block id="D37">111</Block>
<Block id="A38">112</Block>
<Block id="B38">113</Block>
<Block id="C38">XorOfData</Block>
<Block id="D38">114</Block>
<Block id="A39">115</Block>
<Block id="B39">116</Block>
<Block id="C39">XorOfData</Block>
<Block id="D39">117</Block>
<Block id="A40">118</Block>
<Block id="B40">119</Block>
<Block id="C40">XorOfData</Block>
<Block id="D40">120</Block>
<Block id="A41">121</Block>
<Block id="B41">122</Block>
<Block id="C41">XorOfData</Block>
<Block id="D41">123</Block>
<Block id="A42">124</Block>
<Block id="B42">125</Block>
<Block id="C42">XorOfData</Block>
<Block id="D42">126</Block>
<Block id="A43">127</Block>
<Block id="B43">128</Block>
<Block id="C43">XorOfData</Block>
<Block id="D43">129</Block>
<Block id="A44">130</Block>
<Block id="B44">131</Block>
<Block id="C44">XorOfData</Block>
<Block id="D44">132</Block>
<Block id="A45">133</Block>
<Block id="B45">134</Block>
<Block id="C45">XorOfData</Block>
<Block id="D45">135</Block>
<Block id="A46">136</Block>
<Block id="B46">137</Block>
<Block id="C46">XorOfData</Block>
<Block id="D46">138</Block>
<Block id="A47">139</Block>
<Block id="B47">140</Block>
<Block id="C47">XorOfData</Block>
<Block id="D47">141</Block>
<Block id="A48">142</Block>
<Block id="B48">143</Block>
<Block id="C48">XorOfData</Block>
<Block id="D48">144</Block>
<Block id="A49">145</Block>
<Block id="B49">146</Block>
<Block id="C49">147</Block>
<Block id="D49">XorOfData</Block>
<Block id="A50">148</Block>
<Block id="B50">149</Block>
<Block id="C50">150</Block>
<Block id="D50">XorOfData</Block>
<Block id="A51">151</Block>
<Block id="B51">152</Block>
<Block id="C51">153</Block>
<Block id="D51">XorOfData</Block>
<Block id="A52">154</Block>
<Block id="B52">155</Block>
<Block id="C52">156</Block>
<Block id="D52">XorOfData</Block>
<Block id="A53">157</Block>
<Block id="B53">158</Block>
<Block id="C53">159</Block>
<Block id="D53">XorOfData</Block>
<Block id="A54">160</Block>
<Block id="B54">161</Block>
<Block id="C54">162</Block>
<Block id="D54">XorOfData</Block>
<Block id="A55">163</Block>
<Block id="B55">164</Block>
<Block id="C55">165</Block>
<Block id="D55">XorOfData</Block>
<Block id="A56">166</Block>
<Block id="B56">167</Block>
<Block id="C56">168</Block>
<Block id="D56">XorOfData</Block>
<Block id="A57">169</Block>
<Block id="B57">170</Block>
<Block id="C57">171</Block>
<Block id="D57">XorOfData</Block>
<Block id="A58">172</Block>
<Block id="B58">173</Block>
<Block id="C58">174</Block>
<Block id="D58">XorOfData</Block>
<Block id="A59">175</Block>
<Block id="B59">176</Block>
<Block id="C59">177</Block>
<Block id="D59">XorOfData</Block>
<Block id="A60">178</Block>
<Block id="B60">179</Block>
<Block id="C60">180</Block>
<Block id="D60">XorOfData</Block>
<Block id="A61">181</Block>
<Block id="B61">182</Block>
<Block id="C61">183</Block>
<Block id="D61">XorOfData</Block>
<Block id="A62">184</Block>
<Block id="B62">185</Block>
<Block id="C62">186</Block>
<Block id="D62">XorOfData</Block>
<Block id="A63">187</Block>
<Block id="B63">188</Block>
<Block id="C63">189</Block>
<Block id="D63">XorOfData</Block>
<Block id="A64">190</Block>
<Block id="B64">191</Block>
<Block id="C64">192</Block>
<Block id="D64">XorOfData</Block>
</Table>
</RAID>
</RAIDList>

Last edited by DR-Kiev on November 25th, 2010, 16:38, edited 1 time in total.

[DR-Kiev]

Ok, gurus so far i got no real progress, but i found that each 8 sectors RCRD tag appears in asci, I got a wild guess this can be some kind of stripe marker and this would mean that stripe size is 4kb, whats more this tag appears on 0 sector on 2nd hdd just like that guy on x-ray forums suggested. Can any one confim this?

David Marques right, it is MFT records ( RCRD = Record). Step must = 1 cluster , so in your NTFS it is = 8 sectors