Hardware RAID-5 on three 500GB WD-drives

[bos]

A friend of mine brought us three drives used for a failing RAID-5 set (built using a Silicon Image 3114-card). One of the drives was mirrored without any problems (and failed completely afterwards), the second drive was dead as a doornail and the third drive was mirrored after a 10 day session with ddrescue. We therefore have the prerequisites to be able to recreating the set. I have not yet tried to use the PCI-card to rebuild the set, as I lack two working 500GB drives, so at this moment I've only been trying to rebuild it using DMDE with not-so-great results.

According to the Silicon Image-manual, the standard values for creating a RAID5 set is by using 64k blocks (see page 14 in attached pdf).

Running DMDE v4 on Windows and try to auto-guess the setup, the best match it could find was 4k-blocks, while DMDE v3.6 on Linux it claimed it to be 128k-blocks. Investigating both results, we clearly see NTFS-headers and a lot of MFT-blocks are found, meaning we can extract the full directory information.

2023-05-18_120937.png (6.44 KiB) Viewed 2378 times

This somehow seems to be a false positive, making me thinking the analyze went great, because when trying to actually extract the files we receive skewed data and can see 1% of jpg-images at best. Very small jpg-files, such as 20 year old photos in 640*480, are extracted in full but the homemade videos etc are completely botched. This makes me think that DMDE had a hard time figuring out how the Silicon Image-chip produced the parity blocks, and thus it's not useful.

That leaves me the second option by using the actual PCI-card in a machine and try to rebuild the set in its BIOS. However, this is something I've never done before and I'm not sure how to proceed, so I have some questions:

1. Can we use any kind of 500GB-drives and restore the cloned images to them before rebuilding, or do I need the exact same kind of drives?
2. Do we need three drives, or will two drives be sufficient to a) activate the set, b) back it up immediately?
3. Based on the information in the manual (see attached file), is it possible to use that in DMDE to be able to recreate the set without the hardware?

Attachments

tech_silicon_image_3114(r5)_e_002.pdf

(8.72 MiB) Downloaded 115 times

[Arch Stanton]

Did you add a NULL device in DMDE (I suppose you did or DMDE did)?

Did ddrescue clone result include bad sectors?

Did you look at MFT blocks from the separate disks (select drive > Tools > Search for Special Sectors > MFT entry , this alone should allow you to determine block size. Assume each MFT entry 1KB, see where it 'breaks' and picks up again, do the math.

Did you try ReclaiMe's RAID parameter detection tool?

If you don't give all details we have to ask for basics.

[bos]

Thanks for asking these questions, because RAID recovery is unchartered territory here. Up to this point we have only worked with DR on single drives, and never RAID or JBOD.

As for your questions: Yes, I added a NULL drive but forgot to mention it. Sorry about that. For the two clones, there where no bad blocks at all so the clones are perfectly clean.

As for looking at the MFT-blocks I did not know about that feature, so no; but I will test. We do not have a licence for ReclaiMe at this point so we have not used it (yet).

[Arch Stanton]

We do not have a licence for ReclaiMe at this point so we have not used it (yet).

I meant ReclaiMe Free RAID Recovery, all it does is figure out RAID parameters and show you these (and export for a few file recovery tools). If it looks good you could even export the array in de-striped form to another drive (for free). So assume 3 x 500 GB drives RAID 5, IF the tool figures out RAID parameters correctly you can have it de-stripe to 1500 GB or larger drive. It unraid's it so to speak.

Yes, this:

Did you look at MFT blocks from the separate disks (select drive > Tools > Search for Special Sectors > MFT entry

Will get you this for example:

Usually the MFT may be fragmented but in large consecutive chunks. Assume 64KB stripe size, you should see MFT break after you scrolled down 64 entries for example. Since MFT entries are numbered it should even allow you to work out the disk order. A gap between first few entries and the rest is expected, but say you locate entry 100, from there on you'd expect a consecutive chunk of MFT entries.

This may be nice to watch just as some general reference, https://youtu.be/TmO173zxT6E

[bos]

It turns out that ReclaiMe Free RAID Recovery was able to figure out the structure and, even better, show how to setup the parameters for UFS Explorer (which we own already) for recovery. With the help from ReclaiMe, UFS was able to restore every single file from the two-out-of-three RAID5-drives. That was a real lifesaver, and that experience will definately come in handy for future recoveries.

Thank you for the help.

[Arch Stanton]

That's nice!

[mr44er]

This is good news!

Additional for future references and completeness:

1. Can we use any kind of 500GB-drives and restore the cloned images to them before rebuilding, or do I need the exact same kind of drives?

Same size of the smallest disk or bigger in terms of available blocks and matching (native) sector size I would choose for an optimal start.

2. Do we need three drives, or will two drives be sufficient to a) activate the set, b) back it up immediately?

Two should be sufficient, but I would try to get all three copied/dumped. This gives a higher chance of a working pair and success.

3. Based on the information in the manual (see attached file), is it possible to use that in DMDE to be able to recreate the set without the hardware?

I know these cards, they do fake-raid aka software raid in it's cheapest form. The 3114 and the 3112 had in early revisions some firmware bug, that triggered misleading SMART-errors on the disks (I had Samsungs at that time). I believe it should also be possible to import that raidset on Linux as dmraid with the default stripeset it shows (64K) and just connected to the mainboard with AHCI and without the card at all.