Hi guys

I need a little help from someone who has came across something like this.
So, I have 4 disks that were part of a software linux raid 10. More exactly they are four 3TB seagate DM001 disks and someone decided to make a software Raid 10 array with them on a linux system.
Now only 2 disks are alive , more precisely disk 1 and 4 (sda and sdd). The other 2 disks are dead (no surprise here) with disk 3 (sdc) full of rings on platters and disk 2 (sdb) with some chance of recovery (i didn't look in detail about it until now).

So, the raid was created using mdadm with the following parameters: raid10 ,f2, chunk =512k(stripe size). On a standard raid 10 configuration the 2 disks that are alive will be sufficient for data recovery (at least in theory).

Now what about this software raid configuration? Are these 2 disks enough for recovering data or , being a non-standard configuration, I need more disks to complete the recovery?

I've mounted the 2 disks in a windows machine and fired up R-studio. It is seeing a virtual mdadm raid with correct capacity (6TB) but of course says that 2 disk (2 and 3) are missing. It doesn't see any partition without scanning and if I scan for partitions it says in log "Not enough RAID disks to perform I/O" while is scanning ,which is normal I think ( I did not scanned all 6TB space, just 100GB in the begining).

I've also tried with UFS, DMDE, Reclaime , etc , none of them find any raid type.

So, what you think guys, is it possible to reconstruct the raid with only these 2 disks I have or I need more disks?

Thanks
Rgds

_________________
www.datasave.ro

right, but the definition of it will become RAID0 and not REAID10

You can recover with the 2 disks if:

1. They are a striped set and not a mirrored set
2. They were both active right up to the point of failure

_________________
Luke
Recovery Force Data Recovery

@Luke

Unfortunately both condition are met but any attempt to assemble them even in a raid 0 does not give expected results. No partition found .

I think the big problem is the f2 parameter when the raid was created.

_________________
www.datasave.ro

Did you try a stupid way of making two disk images, attaching them to a Linux virtual machine and having MD-RAID itself try to work it out?

Yes, of course...
Mdadm can identify those disks as being part of a Raid10 array. But when I try to assemble (even with --force) the raid it complains that not enough disks, can not start array.

_________________
www.datasave.ro

Do you have R-Studio? If so I can probably do it remotely in 5 min.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

Yes, I have. But because of the time zone I think it will be a difficult timing for a TV session. I will try to PM you in the evening or night.
Thanks

_________________
www.datasave.ro

It is, most probably, not a raid10.

_________________
Angel Data Recovery

Can you provide the output for;

> mdadm --detail /dev/sd[a3]

Where [a3] is the correct drive and partition for both drives you were able to image?

_________________
Luke
Recovery Force Data Recovery

DR-Kiev,

I guess it is RAID10 "far", which looks like

1 2 3
4 5 6
...
3 1 2
6 4 5

which is effectively a RAID 0 (occupying first half of each disk) followed by another copy of the same RAID0 rotated by one column forward (occupying second half of each disk).

To clarify please show us the mdadm metadata from each RAID member...

_________________
On-Line Data Recovery Consultant. RAID / NAS / Linux Specialist.
Serving clients worldwide since 2011
FreeDataRecovery.us

Hi

These is the requested info:

/dev/sdb:
Magic : a92b4efc
Version : 1.2
Feature Map : 0x1
Array UUID : 3cca33a6:2a0ce8a9:d0ef1780:1912996f
Name : application1.asynet.ro:127
Creation Time : Mon May 14 07:29:52 2018
Raid Level : raid10
Raid Devices : 4

Avail Dev Size : 5860271024 (2794.40 GiB 3000.46 GB)
Array Size : 5860270080 (5588.79 GiB 6000.92 GB)
Used Dev Size : 5860270080 (2794.39 GiB 3000.46 GB)
Data Offset : 262144 sectors
Super Offset : 8 sectors
Unused Space : before=262056 sectors, after=944 sectors
State : clean
Device UUID : 500d41ca:fc6968c3:e9cb7e99:6550c8ea

Internal Bitmap : 8 sectors from superblock
Update Time : Mon May 14 07:29:52 2018
Bad Block Log : 512 entries available at offset 72 sectors
Checksum : 56e79c61 - correct
Events : 0

Layout : far=2
Chunk Size : 512K

Device Role : Active device 3
Array State : AAAA ('A' == active, '.' == missing, 'R' == replacing)


And the other drive:


/dev/sda:
Magic : a92b4efc
Version : 1.2
Feature Map : 0x1
Array UUID : 3cca33a6:2a0ce8a9:d0ef1780:1912996f
Name : application1.asynet.ro:127
Creation Time : Mon May 14 07:29:52 2018
Raid Level : raid10
Raid Devices : 4

Avail Dev Size : 5860271024 (2794.40 GiB 3000.46 GB)
Array Size : 5860270080 (5588.79 GiB 6000.92 GB)
Used Dev Size : 5860270080 (2794.39 GiB 3000.46 GB)
Data Offset : 262144 sectors
Super Offset : 8 sectors
Unused Space : before=262056 sectors, after=944 sectors
State : clean
Device UUID : e925b4d1:57b59d3a:d30144c0:748f3091

Internal Bitmap : 8 sectors from superblock
Update Time : Mon May 14 07:29:52 2018
Bad Block Log : 512 entries available at offset 72 sectors
Checksum : a2bd754a - correct
Events : 0

Layout : far=2
Chunk Size : 512K

Device Role : Active device 0
Array State : AAAA ('A' == active, '.' == missing, 'R' == replacing)

_________________
www.datasave.ro

Now, If I looked closely , it seems that someone has recreate the array on 14 May 2018.
I received the disks on 15 May so I think someone has played with them before me.
I think it's a real mess.

_________________
www.datasave.ro

Yes, I think you're right about it...The question is can such a non-standard raid be reconstructed/recovered with only these 2 disks?

Thanks

_________________
www.datasave.ro

And the details about array when assembled with mdadm:

/dev/md127:
Version : 1.2
Creation Time : Mon May 14 07:29:52 2018
Raid Level : raid10
Used Dev Size : -1
Raid Devices : 4
Total Devices : 2
Persistence : Superblock is persistent

Update Time : Mon May 14 07:29:52 2018
State : active, FAILED, Not Started
Active Devices : 2
Working Devices : 2
Failed Devices : 0
Spare Devices : 0

Layout : far=2
Chunk Size : 512K

Name : application1.asynet.ro:127
UUID : 3cca33a6:2a0ce8a9:d0ef1780:1912996f
Events : 0

Number Major Minor RaidDevice State
0 8 0 0 active sync /dev/sda
2 0 0 2 removed
4 0 0 4 removed
3 8 16 3 active sync /dev/sdb


Don't know if it's relevant now that the array was recreated ......

_________________
www.datasave.ro

Due to the May 14 recreation there are now many unknowns. Perhaps talk to the client to explain the events of May14th.

Note if the initial RAID was created with mdadm then it must be in a "standard" format.

If you can get the client to send you a sample file known to exist on the RAID before it failed then you can hex search sda and sdb for the contents of the sample file. Depending on the search results you can determine if recovery is possible using only the two drives.

If you would like help I am happy to assist remotely. I wrote a tool that automates sample file hex searching across multiple drives that is useful for complex RAID recovery cases.

_________________
On-Line Data Recovery Consultant. RAID / NAS / Linux Specialist.
Serving clients worldwide since 2011
FreeDataRecovery.us

Hi

After a lot of testing and retesting many combinations it looks like the raid was really really messed up by the idiot before me....

So, the initial raid was made with an old mdadm version (3.1.2 maybe) that set a 2048 sectors offset from the begining of the drive for the data partition.The first 2048 sectors are reserved for metadata and bitmap.
The guy before me has modified the array with a newer version of mdadm ,of course, that set a 262144 sectors(128Mb) offset from the begining of the drive for data partition. You can imagine what happends when you do that.

The metadata was overwrited of course but the 2048-2050 sectors were ok. After I modified the metadata with correct values , R-studio was seeing the old raid, complaining about 2 missing disks of course, but there was a 5.46 GB EXT4 partition that appeared there and I can enter in it with some missing folder structure.

After some more tests it looks like there is more damage that I believed first time. From what I see , I have 2 disks that were part of one mirror and not 1 disk from each mirror like I was told by customer( from his notation on disks). So they are not disks 1 and 4 but disks 1 and 2. I'm missing disks 3 and 4.

It looks like the guy before me has moved the disk 2 on position 4 and modified the array.It's a real mess .....

And BTW it is an Raid10 with f2, 512K stripe as Alexey said.

The story go on.......

_________________
www.datasave.ro