MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 32 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Recovering a lost HFS+ partition fr a two drive raid 0 array
PostPosted: February 15th, 2016, 17:22 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
I am attempting to recover data from a raid 0 two drive array. These two drives were part of an caldigit VR 4000GB enclosure. The controller has since failed so I am attempting to do the recover on another USB enclosure.

The drive specifics are below:

Quote:
*-disk:0
description: SCSI Disk
physical id: 0.0.0
bus info: scsi@8:0.0.0
logical name: /dev/sdg
size: 1863GiB (2TB)
capabilities: partitioned partitioned:dos
configuration: sectorsize=512
*-disk:1
description: SCSI Disk
physical id: 0.0.1
bus info: scsi@8:0.0.1
logical name: /dev/sdh
size: 1863GiB (2TB)
configuration: sectorsize=512
root@bench:/home/trinsic#
root@bench:/home/trinsic# mdadm --misc --examine /dev/sdh
mdadm: No md superblock detected on /dev/sdh.
root@bench:/home/trinsic# mdadm --misc --examine /dev/sdg
/dev/sdg:
MBR Magic : aa55
Partition[0] : 4294967295 sectors at 1 (type ee)


I talked to the person using this drive, he said the drive booted but hanged during a on device system check of the array VIA LCD display. He power cycled it the enclosure and it went though its check successfully this time, but the OS failed to read the partition when it was connected to his mackbook pro. The drive was partition as HFS+

I booted the two drives up in my linux box and checked for a partition using SFdisk, but it was missing as far as I could tell.

During a scan for lost partitions using testdisk I got a raid failure on the LCD display and testdisk stopped responding. I attempted to power cycle the enclosure but one of the drives wouldn't finish its check and the test failed to complete successfully. I attempted to reseat the drives but the enclosure would not reaching a passing state in the test of the drives. So i pull the drives out of the enclosure and put it into my two drive enclosure.

I did a smart scan on both the drives and the both are healthy.

Since i dont know how to build a virtual raid in linux I used UFS Explorer to create the virtual raid making sure drive 0 was the first drive in the list and ran a partition recovery on it. It found 6 partitions with different characteristics and wondered what would be the best way to find out which one was the right one. attached is a picture of HFS Explorer's recovered partition information.
I want to make sure I recover the right partition and wondered if anyone has experience with this particular kind of recovery that could help, thank you.


Attachments:
File comment: UFS explorer list of partitions recovered from the virual raid 0
ufs-explrer-screen-shot-raid-partition-information.png
ufs-explrer-screen-shot-raid-partition-information.png [ 222.83 KiB | Viewed 16958 times ]
Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 15th, 2016, 19:19 
Offline

Joined: March 19th, 2015, 15:01
Posts: 1388
Location: isreal
first things first, clone the drives and don't mess around with the original


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 15th, 2016, 19:25 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
jermy wrote:
first things first, clone the drives and don't mess around with the original

Ok I purchased a 4tb drive, but I dont have enough free space to hold both images. Do you have any recommendations? I cant afford a bigger drive right now.

The two drives together equal 3.910.92tb and the available free space on the 4tb drive is 3.7tb


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 15th, 2016, 19:33 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
trinsic wrote:
jermy wrote:
first things first, clone the drives and don't mess around with the original

Ok I purchased a 4tb drive, but I dont have enough free space to hold both images. Do you have any recommendations? I cant afford a bigger drive right now.

The two drives together equal 3.910.92tb and the available free space on the 4tb drive is 3.7tb


If you can't even afford a drive to put the target data onto, then perhaps you shouldn't be offering data recovery services. Seems that you're ill-equipped both materially and knowledge wise. Get the clones of the drives first using ddrescue, then ask about the logical side of the recovery or you won't get much help here. None of us want to be responsible for helping you to permanently lose someone's data (which you're on the course toward that).

No point in scanning with testdisk or any other software against a single member of a RAID. Do you even know how a RAID functions? You'll have to build a virtual array and determine the correct settings before you can attempt any of that. Also since it's HFS you may end up having to manually define the starting sector of the partition (seems to happen alot).

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 15th, 2016, 19:41 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
data-medics wrote:
trinsic wrote:
jermy wrote:
first things first, clone the drives and don't mess around with the original

Ok I purchased a 4tb drive, but I dont have enough free space to hold both images. Do you have any recommendations? I cant afford a bigger drive right now.

The two drives together equal 3.910.92tb and the available free space on the 4tb drive is 3.7tb


If you can't even afford a drive to put the target data onto, then perhaps you shouldn't be offering data recovery services. Seems that you're ill-equipped both materially and knowledge wise. Get the clones of the drives first using ddrescue, then ask about the logical side of the recovery or you won't get much help here. None of us want to be responsible for helping you to permanently lose someone's data (which you're on the course toward that).

No point in scanning with testdisk or any other software against a single member of a RAID. Do you even know how a RAID functions? You'll have to build a virtual array and determine the correct settings before you can attempt any of that. Also since it's HFS you may end up having to manually define the starting sector of the partition (seems to happen alot).


I have a basic idea how raid functions. I dont know if you understood my orginal statement, but I scanned the drives while they were in the enclosure, (before the enclosure died) so the operating system read both drives as one drive in a raid 0 configuration. Please correct me if I am wrong.

I have found another external 2tb drive that I'm currently cleaning it of data and I'm going to split the two images. one on the 2tb and one on the 4tb.

Ill post back when its done, sometime tomorrow.

Thank you for the response.


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 15th, 2016, 19:46 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
You can't write a 2Tb image file to a 2Tb HDD, just FYI. Otherwise they would both fit on the 4Tb one. The file system takes up some space, so you'll always need a bigger drive. However you can directly image the whole drive to it with ddrescue instead.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 15th, 2016, 19:56 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
data-medics wrote:
You can't write a 2Tb image file to a 2Tb HDD, just FYI. Otherwise they would both fit on the 4Tb one. The file system takes up some space, so you'll always need a bigger drive. However you can directly image the whole drive to it with ddrescue instead.

Yeah I just realized that. Im going to do a sector by sector copy of that one drive and image the other one to the 4tb.


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 18th, 2016, 15:42 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
Ok, Backups are made of both drives as outlined and stored in a safe place away from the recovery environment.


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 20th, 2016, 14:29 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1091
Location: Angel Data Recovery
Configuration of Caldigit's RAID0 is a bit tricky. Set 1 sector stripe size.


Attachments:
CallDigitsRaid0.jpg
CallDigitsRaid0.jpg [ 82.37 KiB | Viewed 16759 times ]

_________________
Angel Data Recovery
Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 20th, 2016, 21:18 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
DR-Kiev wrote:
Configuration of Caldigit's RAID0 is a bit tricky. Set 1 sector stripe size.


Done.
FYI, I made sure the drive configuration is in the correct order by refreshing the storage devices one for each drive detection.


Attachments:
ufs-explrer-screen-shot-raid-partition-stripe-size.png
ufs-explrer-screen-shot-raid-partition-stripe-size.png [ 102.76 KiB | Viewed 16729 times ]
Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 20th, 2016, 23:57 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1091
Location: Angel Data Recovery
Now , start seaching for the Hfs+ partition , it usualy starts from 409640 offset

_________________
Angel Data Recovery


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 21st, 2016, 2:07 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
DR-Kiev wrote:
Now , start seaching for the Hfs+ partition , it usualy starts from 409640 offset

I started it, but it looks like its going to take 380 hours? is that right?


Attachments:
ufs-explrer-screen-shot-raid-partition-scan.png
ufs-explrer-screen-shot-raid-partition-scan.png [ 105.72 KiB | Viewed 16704 times ]
Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 21st, 2016, 2:37 
Offline

Joined: February 8th, 2014, 8:08
Posts: 456
Location: Eastern Europe /recovering worldwide/
trinsic wrote:
it looks like its going to take 380 hours?

The most obvious thing to check is how the drives you're working with are connected to the system.
The "USB" you're using, isn't it something like USB 2.0? Maybe even with both drives on the same port through a hub?

Remember about small stripe size. You will also need time to copy recovered data at a similar speed.

_________________
• Remote RAID, NAS, SAN, VMware, DVR (CCTV), flash and tape recovery. Data recovery support.


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 21st, 2016, 20:41 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
Dmitri wrote:
trinsic wrote:
it looks like its going to take 380 hours?

The most obvious thing to check is how the drives you're working with are connected to the system.
The "USB" you're using, isn't it something like USB 2.0? Maybe even with both drives on the same port through a hub?

Remember about small stripe size. You will also need time to copy recovered data at a similar speed.


I now have in my possession a new replacement caldigit enclosure of the same type of the original enclosure these two drives are in when it died. Here is the new screen shot with the enclosure connected via sata. The scan time has decreased to 6 hours. Ill let you know when its done.


Attachments:
ufs-explrer-screen-shot-caldigit-scan.png
ufs-explrer-screen-shot-caldigit-scan.png [ 97.64 KiB | Viewed 16646 times ]
Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 22nd, 2016, 3:00 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
The scan is complete.


Attachments:
ufs-explrer-screen-shot-caldigit-scan-complete.png
ufs-explrer-screen-shot-caldigit-scan-complete.png [ 100.19 KiB | Viewed 16620 times ]
Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 22nd, 2016, 10:49 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
I don't think I've ever seen an HFS+ partition start at offset 2048 before. Seems fishy to me.... Perhaps the start of the partition was wiped somehow. If you're not able to open any files by using that layout, try manually defining a HFS+ partition at sector 409640 instead.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 22nd, 2016, 18:34 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
OK, I adding the partition at that range, but it comes up as unknown, or raw.


Attachments:
ufs-explrer-screen-shot-caldigit-unknown-409640.png
ufs-explrer-screen-shot-caldigit-unknown-409640.png [ 89.46 KiB | Viewed 16553 times ]
Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 22nd, 2016, 18:53 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
It doesnt look like there is any data until position 0x1127C000


Attachments:
ufs-explrer-screen-shot-caldigit-unknown-0x1127C000.png
ufs-explrer-screen-shot-caldigit-unknown-0x1127C000.png [ 97.02 KiB | Viewed 16551 times ]
Top
 Profile  
 
 Post subject: Re: Recovering a lost HFS+ partition fr a two drive raid 0 a
PostPosted: February 22nd, 2016, 19:40 
Offline

Joined: September 16th, 2010, 15:27
Posts: 28
Location: California
Also the HFS+ file system only has one directory HFS+ PRivate Data but the folder is empty.


Attachments:
ufs-explrer-screen-shot-caldigit-hfsplus-filesystem1.png
ufs-explrer-screen-shot-caldigit-hfsplus-filesystem1.png [ 99.84 KiB | Viewed 16546 times ]
Top
 Profile  
 
 Post subject: Re: Recovering HFS+ partition from a two drive raid 0 array
PostPosted: February 23rd, 2016, 2:22 
Offline

Joined: February 8th, 2014, 8:08
Posts: 456
Location: Eastern Europe /recovering worldwide/
data-medics wrote:
I don't think I've ever seen an HFS+ partition start at offset 2048 before.

OP has connected the storage as DAS instead of a set of drives.

_________________
• Remote RAID, NAS, SAN, VMware, DVR (CCTV), flash and tape recovery. Data recovery support.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 32 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: ccc and 132 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group