Intel RAID 10 Offline

[donkeyass]

Hello all!

So I was upgrading my computer with some new hard disks and ran into a big problem at the end. As of this afternoon I had a 500GB drive with Win 7 and Fedora 14 with basically just system files, no personal data or storage really. I also had a RAID 10 formatted to NTFS running off of an Intel software RAID on my motherboard with 2x2TB drives and 2x1.5TB drives with all my personal data on it.

I was having problems with my system disk (the one with the OS') so I tried to fix some stuff with Win 7 through the command prompt from the install disk, I ran 'chkdsk' to try and fix any problems that might be present on my system disk but ended up running it on one of the member disks on the RAID as well. I also tried to rewrite the Windows boot loader with 'bootrec.exe/fixmbr' and 'bootrec.exe/fixboot' and may have done so to one of the member disks on the RAID as well. Ended up having to reinstall both the OS' which was no big deal just kinda a pain in the ass, my terrible awful problem however was when I booted into Windows my RAID wasn't there. So opened up Intel's rapid storage program to see what was going on and it showed no sign of the RAID, just the four disks being 'offline' and only with the option to 'clear and reset' the disk.

So now I'm stuck with these four disks with all of my stuff on them but I can't access anything on them. I'm assuming I just messed something up with the structure of the RAID and that I can hopefully rebuild it but I'm not sure.

Any help at all on ideas to get my data back would be greatly appreciated, thank you very much!

[DR-Kiev]

You need reconstruct your Raid virtually , and scan this array for lost data.

[dmarques]

If you don't have any experience it's not easy, but you can start to check Master Boot Record, Boot Sector and MFT Records, to check if they are still valid and where they are.

[donkeyass]

You need reconstruct your Raid virtually , and scan this array for lost data.

Would there be any Windows or Linux utilities that you could suggest to do this?

If you don't have any experience it's not easy, but you can start to check Master Boot Record, Boot Sector and MFT Records, to check if they are still valid and where they are.

I was afraid it wouldn't be very easy lol. Any Windows or Linux tools you could suggest?

Thank you!

[dmarques]

Hi,

I suggest winhex, as you can use it as hex viewer to check the drive contents, as well as allows to rebuild the array.

[donkeyass]

I suggest winhex, as you can use it as hex viewer to check the drive contents, as well as a rebuild the array.

Sweet I'll give that a shot thanks!

The drives aren't seen under Windows device manager or the disk management either, only under Intel's rapid storage program. So I assume that its up to the RAID controller to let the OS see the drives and in this case its not showing them because they're messed up? If that is the case, do I have to reset the disks through Intel's software before I can recover anything? Or does that totally screw the array?

[dmarques]

If your data is valuabe, do not initialize or reset the drives under Intel software, as it will probably delete some sectors that might be of use for the rebuild.
If you connect the drives to a regular SATA port, they are not seen under Windows? That's odd... they should be if the drives are fully working.
Have you tried it on another PC?

[donkeyass]

If your data is valuabe, do not initialize or reset the drives under Intel software, as it will probably delete some sectors that might be of use for the rebuild.
If you connect the drives to a regular SATA port, they are not seen under Windows? That's odd... they should be if the drives are fully working.
Have you tried it on another PC?

Yes the data is valuable so thats a no go then haha.

Well its one of those software RAIDs on the motherboard and the motherboard is set to handle RAIDs in the BIOS, I guess I could set the BIOS to just handle SATA and then let tools such as Winhex (hopefully) rebuild the RAID. So maybe thats why Windows isn't seeing the drives?

[einstein9]

If your data is valuabe, do not initialize or reset the drives under Intel software, as it will probably delete some sectors that might be of use for the rebuild.
If you connect the drives to a regular SATA port, they are not seen under Windows? That's odd... they should be if the drives are fully working.
Have you tried it on another PC?

Yes the data is valuable so thats a no go then haha.

Well its one of those software RAIDs on the motherboard and the motherboard is set to handle RAIDs in the BIOS, I guess I could set the BIOS to just handle SATA and then let tools such as Winhex (hopefully) rebuild the RAID. So maybe thats why Windows isn't seeing the drives?

I suggest Dr.Kiev here, he is the RAID Master on the forum

[dmarques]

You could try that and let us know what happens.
Your first step is to get the drives to be usable in Windows and see them with winhex.
All this without writing anything to the drives

[nightduke]

First of all touch the things very carefull.

You can see if that raid has partitions on it with a linux live version called knoppix.

It's easy, burn that dvd or cd, boot the pc.

Run knoppix using enter

A few minutes later, appears the xwindows.
There will appear the raid drive, don't touch that.
Now open a linux terminal

Then use fdisk /dev/sd or device you see at the main screen at xwindow.
Then press l, to see how many partitions are there.
Then press q to quit fdisk.
If there's any partition like /dev/sda1 or /dev/sdb1 then you have available all the partitions.

If there are partition data is there, just mount them and try to move somewhere but keep in mind you must move 2x1,5tb and 2x2tb.

I hope this help you.

Pardon me for my poor english, i prefer spanish.

Good luck.

[donkeyass]

Ya I changed the drive settings from RAID to IDE (AHCI wouldn't let Windows boot for some reason) and now the drives are visible. Right now I'm trying to rebuild the RAID with a program called Zar, seems to being working so far. Hopefully this works, if not I'll give Winhex a shot.

Ya I've used Knoppix a little bit, if these programs don't work a live distro of Linux will be my next plan of action.

If there are partition data is there, just mount them and try to move somewhere but keep in mind you must move 2x1,5tb and 2x2tb.

Thats the thing, it was a RAID 10 so it mirrored the 1.5TB and the the 2TB then striped the mirrors, so I can't just mount the drive because its a striped member.

Thank you all for your suggestions!! I'll report back with any progress.

[dmarques]

I've heard of ZAR, but never used it.

Well, let us know the end of it.

[nightduke]

Uff you have something like this?

http://upload.wikimedia.org/wikipedia/commons/thumb/6/61/Raid10.png/220px-Raid10.png

This is too dangerous, probably it the disks are working with a live knoppix you can check if the raid it's working at the different kind of array are available.
why you want to rebuild, your disk are working, why rebuilding? why you force rebuilding?
You just want to get data back.
Winhex is for people with a lot of knowledge of what are they doing, keep in mind you are touching 4 disks at the same time, 2x1,5tb and 2x 2tb disks.

3,5tb of information think about it? you want to lost that data?

Keep doing things safety.
Be carefull.
As i told you with knoppix and fdisk you can see if the partitions or the arrays are available and if they are untouched, keep in mind do carefully.It's like your girlfriend...

Hope you understand my opinion, please don't hate me.

I don't know what does zar.

Ya I changed the drive settings from RAID to IDE (AHCI wouldn't let Windows boot for some reason) and now the drives are visible. Right now I'm trying to rebuild the RAID with a program called Zar, seems to being working so far. Hopefully this works, if not I'll give Winhex a shot.

Ya I've used Knoppix a little bit, if these programs don't work a live distro of Linux will be my next plan of action.

If there are partition data is there, just mount them and try to move somewhere but keep in mind you must move 2x1,5tb and 2x2tb.

Thats the thing, it was a RAID 10 so it mirrored the 1.5TB and the the 2TB then striped the mirrors, so I can't just mount the drive because its a striped member.

Thank you all for your suggestions!! I'll report back with any progress.

[donkeyass]

Ya thats exactly my setup, and all I want is my data back correct. As far as I know you can't just read data from a disk that is a part of a RAID 0 without it functioning properly unlike a RAID 1 which you can read either disk apart from each other. So the only reason I'm trying to rebuild the array is so that I can access the data on it.

I wish I could just boot a live Linux distro and grab the data I really do! lol

Let me know if I might be misunderstanding you.

[drc]

You should image all of the drives first, so that you have a backup copy in case something unpleasant happens

[donkeyass]

You should image all of the drives first, so that you have a backup copy in case something unpleasant happens

I'm only trying to rebuild two of the drives so I have the other two untouched, so I have a back up of a broken RAID lol.

[donkeyass]

Alright, after letting ZAR attempt to rebuild the array for three days it encountered an error and force closed. Awesome.

I'm looking at the drives with Winhex but that seems a little overkill and a bit over my head. From what I understand Winhex to be, its a tool that lets you get right down the blocks of a hard disk and manipulate them, all I want to do is try to rebuild the array which shouldn't be too hard I think because I didn't shred the whole RAID I just wrote over a very small part of the disk and/or moved things around in the array structure a little bit.

So now I'm looking at hopefully rebuilding the array with something like mdadm under Linux. This is what is given to me so far...

Code:

[root@localhost dev]# mdadm /dev/md127 -E
/dev/md127:
         Magic : Intel Raid ISM Cfg Sig.
       Version : 1.3.00
   Orig Family : 0b3fb48d
        Family : 0b3fb48d
    Generation : 000006fe
          UUID : aec63f1d:a803a77f:fcee644f:77177065
      Checksum : 8483928e correct
   MPB Sectors : 2
         Disks : 4
  RAID Devices : 1

Disk02 Serial : 9WM2LLSW
         State : active
            Id : 00040000
   Usable Size : 3907024654 (1863.01 GiB 2000.40 GB)

[Archive]:
          UUID : c2278381:505198b6:82d930cb:ff8786ff
    RAID Level : 10
       Members : 4
         Slots : [U_U_]
     This Slot : 2
    Array Size : 5860544512 (2794.53 GiB 3000.60 GB)
  Per Dev Size : 2930272520 (1397.26 GiB 1500.30 GB)
Sector Offset : 0
   Num Stripes : 11446376
    Chunk Size : 64 KiB
      Reserved : 0
Migrate State : idle
     Map State : degraded
   Dirty State : clean

Disk00 Serial : 9WM2JP5T
         State : active
            Id : 00030000
   Usable Size : 3907024654 (1863.01 GiB 2000.40 GB)

Disk01 Serial : 9VS0D1LR:0
         State : failed
            Id : ffffffff
   Usable Size : 2930272654 (1397.26 GiB 1500.30 GB)

Disk03 Serial : VS0K7VX
         State : failed
            Id : ffffffff
   Usable Size : 2930272654 (1397.26 GiB 1500.30 GB)
[root@localhost dev]# cat /proc/mdstat
Personalities :
md127 : inactive sdd[1](S) sdb[0](S)
     4514 blocks super external:imsm

So it sees that theres a RAID 10 there and that its messed up, now just fix the damn thing!!! Does this look good, bad, or useless?

[dmarques]

Don't forget that with time passing you raise your chances of doing sonething wrong.
there's a direct relationship between number of unsucessful tries and recovery rates.

[donkeyass]

Ok so this is where I'm at. I found another program called R-Studio to rebuild my RAID but it keeps telling me:

Code:

Unexpected MFT record 9600 at 3366322176. If you are scanning RAID and this message will reappear constantly, check RAID for consistence.

With different numbers for the MFT record. So I guess I'll have to fix the consistency of the RAID, I tried looking up how to do so but only found information on what RAID consistency is which really doesn't do me much good right now.