Linux RAID

[dev117]

I'm working with a linux RAID 0, but I haven't been able to view the files in the FS. I know the RAID is reconstructed properly and I can see an Ext3 partition in R-Studio and WinHex, but I can't view the files inside it (only shows inodes in R-Studio). I've tried scanning with R-Studio and UFS and have tried using linux to recover as well, all with no luck. I need the file names and organization of the file system or it will be pretty much useless. Any ideas on other DR software I can try to view the files?

[drc]

I know the RAID is reconstructed properly

If this was the case you should not be having any other problems, unless the array is out of sync

[hddguy]

My guess is the offset is wrong, but is difficult to guess without seeing it.

[dev117]

Well I repaired the damaged drive in the RAID and put the drives back into the original machine. I couldn't boot from the RAID, but it recognized in linux as a linux RAID and allowed me to mount it (with errors). I imaged the device showing as the RAID and that's what I'm working with now. That's why I'm pretty sure the RAID is properly reconstructed - I just used the original hardware with images of the original drives.

[drc]

I repaired the damaged drive in the RAID

Ok, what was your original problem?

[dev117]

The damaged drive was a typical Seagate FW issue; the drive was repaired with no complications and imaged using DDI (0 unread sectors).

[N.C.]

Are you sure it is EXT3 FS, no any other?
Linux can work with a lot of FSes...

Janos

[dev117]

Are you sure it is EXT3 FS, no any other?
Linux can work with a lot of FSes...

I'm pretty sure it's Ext3; that's what the customer reported it as and it is recognized as Ext3 in everything I've tried.

[DR-Kiev]

I'm working with a linux RAID 0, but I haven't been able to view the files in the FS. I know the RAID is reconstructed properly and I can see an Ext3 partition in R-Studio and WinHex, but I can't view the files inside it (only shows inodes in R-Studio). I've tried scanning with R-Studio and UFS and have tried using linux to recover as well, all with no luck. I need the file names and organization of the file system or it will be pretty much useless. Any ideas on other DR software I can try to view the files?

I think you just not correct reconstructed this Raid0. Some controllers has mutual offset between the disks, for example for Adaptec1200A it is only 10 sectors .

[N.C.]

I'm working with a linux RAID 0, but I haven't been able to view the files in the FS. I know the RAID is reconstructed properly and I can see an Ext3 partition in R-Studio and WinHex, but I can't view the files inside it (only shows inodes in R-Studio). I've tried scanning with R-Studio and UFS and have tried using linux to recover as well, all with no luck. I need the file names and organization of the file system or it will be pretty much useless. Any ideas on other DR software I can try to view the files?

I think you just not correct reconstructed this Raid0. Some controllers has mutual offset between the disks, for example for Adaptec1200A it is only 10 sectors .

This is software raid, and should be correct.

[N.C.]

Are you sure it is EXT3 FS, no any other?
Linux can work with a lot of FSes...

I'm pretty sure it's Ext3; that's what the customer reported it as and it is recognized as Ext3 in everything I've tried.

Can you please post the result of this command:

mdadm --detail /dev/md.... ?

Janos

[dev117]

Are you sure it is EXT3 FS, no any other?
Linux can work with a lot of FSes...

I'm pretty sure it's Ext3; that's what the customer reported it as and it is recognized as Ext3 in everything I've tried.

Can you please post the result of this command:

mdadm --detail /dev/md.... ?

Janos

Since I've copied the RAID to a separate drive, it shows as "sd...". I no longer have the original machine either. I ran mdadm on sda to see the output, which was:
"dev/sda is not an md array"
"dev/sda: No md superblock found, not an md component."

Any ideas on which direction to take from here? Thanks for the input guys.

[N.C.]

Are you sure it is EXT3 FS, no any other?
Linux can work with a lot of FSes...

I'm pretty sure it's Ext3; that's what the customer reported it as and it is recognized as Ext3 in everything I've tried.

Can you please post the result of this command:

mdadm --detail /dev/md.... ?

Janos

Since I've copied the RAID to a separate drive, it shows as "sd...". I no longer have the original machine either. I ran mdadm on sda to see the output, which was:
"dev/sda is not an md array"
"dev/sda: No md superblock found, not an md component."

Any ideas on which direction to take from here? Thanks for the input guys.

You have copied the raid (/dev/md?) to only one drive? (sda)
if yes, your array is processed allready and nothing to do more.
If you have copied the array drives to more individual drives, you should find the end of the partition.
MD superblock is on the end of the block device.
If mdadm can't find it, then it is not on the end of the device, but can be somewhere else.
(Note: there is more linux soft raid superblock version, some are in the beginning)
Another option is to copy again to drives wich matches with the original drives.

Janos

[dev117]

Yes, I copied the entire raid to a single drive (500 GB RAID, 500 GB Drive). As mentioned, it recognizes as an Ext3 partition but I cannot view the files within the FS. Since the file names are critical, I cannot carve. I was just wondering if anyone had any other suggestions for tools to use to try and repair the Ext3 partition so I can view/recover the files contained.

[N.C.]

Yes, I copied the entire raid to a single drive (500 GB RAID, 500 GB Drive). As mentioned, it recognizes as an Ext3 partition but I cannot view the files within the FS. Since the file names are critical, I cannot carve. I was just wondering if anyone had any other suggestions for tools to use to try and repair the Ext3 partition so I can view/recover the files contained.

wait a minute!

If the original array was 2x250GB RAID0, the result will be slightly bigger than one 500GB drive!
Are you sure, your image are fit on the destination drive?

Janos

[dev117]

Yes, I copied the entire raid to a single drive (500 GB RAID, 500 GB Drive). As mentioned, it recognizes as an Ext3 partition but I cannot view the files within the FS. Since the file names are critical, I cannot carve. I was just wondering if anyone had any other suggestions for tools to use to try and repair the Ext3 partition so I can view/recover the files contained.

wait a minute!

If the original array was 2x250GB RAID0, the result will be slightly bigger than one 500GB drive!
Are you sure, your image are fit on the destination drive?

Janos

Actually, the original array was 4 drives: 3x500GB and 1x250GB. It was partitioned into a 250 GB boot partition and a 500 GB data partition. It was basically just some drives that the customer had sitting around that he decided to make a RAID out of, so there's not necessarily a lot of rhyme or reason as to the partition sizes or anything... I saw both partitions in linux after reconnecting the images in the original machine; they recognized as sda (boot) and mda (data). The only device I imaged was mda. It sounds like it may be useful connect all 4 drives to a Windows machine and scan the entire area for Ext3 partitions...

[drc]

the original array was 4 drives: 3x500GB and 1x250GB. It was partitioned into a 250 GB boot partition and a 500 GB data partition.

Are you sure? This doesn't make any sense.

250GB boot (not in RAID) and 1000GB data (RAID5) makes a lot more sense to me

[dev117]

the original array was 4 drives: 3x500GB and 1x250GB. It was partitioned into a 250 GB boot partition and a 500 GB data partition.

Are you sure? This doesn't make any sense.

250GB boot (not in RAID) and 1000GB data (RAID5) makes a lot more sense to me

According to the customer, this is correct. But I'm with you, a 1 TB RAID 5 would make a lot more sense in this situation. I'll go back and investigate a little more to see if I can shed any light on this.