Hi, I'm hoping you guys can help me out.



I've got a Lacie 5big that was the backup for multiple mac machines via time machine. There's some data on it that didn't have a copy anywhere else that I'm trying to get off. It is a 5 disk raid5 array, that I have 4 disks currently pluged into my windows 7 machine (as it's the only computer I have access to with available internal sata ports and I'm going to need to pick up a pci card to get that last drive attached) where I hoped to use raid reconstructor and captain nemo to get to the important files



My first problem was that win7 listed the disks in disk manager with each disk having 7 healthy partitions (125mb, 8mb, 173mb, 659mb, 8mb, then 1396.30gb), but wouldn't show them as active under my computer. Likewise, it would appear that Raid Reconstructor couldn't see them as well.



I then moved on to r-studio, which could see them. I added the first 4 disks in the correct order in a virtual block array with an added 'missing disk' in the 5th spot. I then tried a few different block sizes and block orders to see if I could get the virtual raid's 'partition 1' to come up as working. It always came up saying that there was no file hierarchy found, so I tried scanning it and searching for jpgs. I've tried a variety of block sizes and orders, but I only ever get working jpgs that are around 9kb or less in size, all of the other 'found' pictures tend to be broken and won't open.



I'm now begining to wonder if perhaps there is a sector offset that I need to find and I'm looking for advice.



If there's a solution to getting the disks to appear to Raid Reconstructor, that could be helpful with its supposed ability to figure out the raid5 parameters. Otherwise, any other advice on the situation would be appreaciated, especially if you've had to deal with a lacie 5big before.

HI
Try winhex or UFS explorer.

What is the value of the data? Might it be worth getting a data recovery pro to recover the data? With a large RAID 5, the cost will likely be at least $2000, but it would be guaranteed.

What is the problem with the original LaCie unit? Why are you trying to recover the drives outside the unit?

Did you make a backup clone of each drive first? There is a chance that windows might have altered a sector or two, making the recovery more difficult. If you didn't make a backup and sectors are altered, there is a good chance that a pro might have to charge more.

What is your Linux RAID knowledge? You'll need to have a pretty good grasp of this, then connect the drives to a Linux system. Assuming that you have healthy, unaltered drives, you should be able to quickly gain access to the data.

_________________
Luke
Recovery Force Data Recovery

...PM me if you want to more details.

_________________
Luke
Recovery Force Data Recovery

@microsoft engineer Thanks for the advice, I'll go do a search for winhex and ufs explorer and look into them.

@ lcoughey The lacie unit was no longer allowing access to the raided volume. At which point it seemed a safe bet that either multiple drives had failed or the unit itself had a hardware failure. A recommended factory reset (lacie's tech support advice) resulted in it saying that drives were connected, but that they provided no available space. A backup clone was not made due to the fact that the 5 x 1.5tb of space in this system was more than all of the rest of the harddrive capacity available. After confirmation that the drives appeared viable by connecting them to a windows desktop, I then attempted to recreate the raid in r-studio and that brings us up to now.

A scan via R-studio has generated some working small jpg pictures, however most of the large ones appear broken.

Alright, I have some progress. I know I spent awhile looking around the internet for what sort of raid setup the Lacie 5big would have, but couldn't find any reported details, so in case there are other people doing the same thing that stuble upon this I'll record my findings.



Most importantly, it appears that the numbered 1-5 bays on the Lacie 5big actually did not house the drives in their 'correct' order. The raid drive 1 was the Lacie drive 5, raid drive 2 was Lacie disk 4, 3 was 1, 4 was 3 and 5 was 2. This one surprised me, but it appears that in the order listed above, the assembled raid is providing viable recovered files.



Block size was 128 sectors

Parity was left symmetric

The raid start was sector 2008125

And the file system was xfs



Hope this helps someone else out there.

Max40watt,

Were you able to recover the data yet? I'm sure pros would gladly take a look at it for you, but if you're deadset on recovering it yourself might I suggest checking R-Studio's site for how to recover RAIDs? They have a tutorial for how to find the specs for the drives, as well as find out what order they are in. Check it out here: http://www.r-tt.com/Articles/Finding_RA ... ndex.shtml

Regards,

Dizi

If you still have the issue with you RAID 5 and if you are in Europe, you can send me a Private Message, I think I can help you.

Kind regards

Corsari

I have a "Lacie 5big Network" (original version or v1) 5TB NAS with 5 X 1 TB hard drives in it at home for personal use. It is on v2.2.3 of the Lacie firmware for the 5big. The Ethernet Port is inoperable so I cannot get to the data using the Lacie unit, but otherwise I believe the drives and data is good.

SEEKING ADVICE / QUESTIONS
1) I have attached the 5 SATA hard drives to a Windows 7 computer and see the SATA drive model number and serial numbers. There appear to be several partitions on each of the drives, several small LINUX ones, and one big one about 950GB (I presume XFS file system) on each of the five 1 TB drives.
2) Does anyone know if I should try to use some software to rebuild the RAID 6 or 5 array to get to the files on the XFS file system?
3) If I try that does anyone know all the RAID parameter for this Lacie 5big v1 with 5TB?
4) Should I try to somehow disconnect the PC's Windows hard drive, BOOT up the temporary PC from the LINUX files on the hard drives, let the system "run the software" already on it, and see if I can access the XFS file system data via the Ethernet connection? I'm afraid of ruining the file system and corrupting my data, but tend to think it would just "mount the file system" and try to work as a NAS...

More detailed background info is below. Any help would be greatly appreciated, so I can SAVE my personal family pictures, movies, documents, etc restored! And not pay exhorbitant clean room fees!
Thanks,
Jim

ALL THE BACKGROUND INFO
I am pretty sure it was setup to use RAID 5 or 6 with either one or two drive(s) setup as a spare / hot swap drive(s). I do believe it was setup so 2 drives could fail and it still rebuild, so that lends me to RAID 6 probably. It had about 2.4 TB of 5 TB usable space. I believe this is a software RAID scheme on the 5big, because there are regular LINUX EXT type partitions with typical Linux folders and files, but the user data files are on other XFS type partitions spread over the RAID array drives. I do not know RAID parameters such as: Raid type: RAID 5 (Striped + Parity), RAID 6 (Standard P+Q), or RAID 6 (ARECA Compact) [mine is probably 6 or 5], Stripe Size [I saw 128 KB??? suggested in this thread], Type (Adaptec/DDF, Intel, nVidia, Via, Linux, etc), Parity Distribution: Left-Symmetric (backward-dynamic) [suggested in this thread], Left-Asymmetric (backward), Right-Symmetric (forward-dynamic), or Right-Asymmetric (forward). Parity length (number of stripes).

The ethernet port has failed, and this is the only way to communicate with the device from a computer. The raid array seems intact fine, because the indicator lights on the front of the device say ok, and nightly I am getting a backup of one particular music folder via its USB port hooked to an external HD. (When I rename or delete files from the external HD, the backup brings over the missing files each night.) Lacie has agreed to replace the unit (probably 5big Network v2), under warranty, but will automatically erase all of my data.

I am seeking any help / guidance with getting all of the data off of the RAID 5 or 6 array. This is what I have done so far trying out some software recovery programs: "USF Explorer", "Get Raid Recovery", "Disk Internals Raid Recovery" and Paragon Software's "Partition Manager", "Drive Backup" and "Hard Disk Manager":

THE CONFIG XML FILE INFO IN THE LINUX FILE SYSTEM

<?xml version="1.0" encoding="UTF-8"?>
<lacie_conf type="ethernet_disk" version="1.0">
<productInfo>
<name>5big Network</name>
<version>2.2.3</version>
<originalversion>2.2.3</originalversion>
</productInfo>
<machine>
<hostname>LaCie</hostname>
<description>5big Network</description>
<workgroup>Workgroup</workgroup>
<atzone/>
<frontled>enabled</frontled>
<clock>
<timezone GMT="+2" abbreviation="CEST">US/Eastern</timezone>
<timeserver type=""/>
</clock>
</machine>
<domain>
<name/>
<status>disabled</status>
<previousWorkgroup/>
</domain>
<interfacesList>
<interface name="egiga0">
<bootproto>static</bootproto>
<mtu>4004</mtu>
<wins>192.168.89.1</wins>
<mac>00:D0:4B:86:A9:24</mac>
<ipv4_address>0.0.0.0</ipv4_address>
<subnetmask/>
<broadcast/>
<gateway/>
<primary_dns/>
<secondary_dns/>
<speed>0</speed>
<dhcp/>
<domain/>
</interface>
</interfacesList>
<usersList>
<user login="admin" id="500" firstname="" lastname="" email="xxx@yyy.com" status="enabled">
<homedir/>
<password crypto="md5">zzz</password>
<password crypto="des">aaa</password>
<password crypto="nthash">bbb</password>
<password crypto="lmhash">ccc</password>
</user>
<user login="user1" id="501" firstname="xxx M" lastname="yyy" email="xxx@zzz.com" status="enabled">
<homedir/>
<password crypto="md5">zzz</password>
<password crypto="des">aaa</password>
<password crypto="nthash">bbb</password>
<password crypto="lmhash">eee</password>
</user>
</usersList>
<groupsList>
<group name="Office" id="500" status="enabled">
<comment>Office Users</comment>
<member login="user1"/>
</group>
</groupsList>
<sharesList>
<share name="usb" status="disabled" external="yes" download="no" timemachine="no">
<path>usb_WDCWD30_USBTOIDE_1cf03f6b495743e4b5c9b13a5f9fb651</path>
<protocols http="yes" netatalk="yes" proftpd="no" samba="yes" upnp="no"/>
<comment>External Disk</comment>
<aclsList>
<acl auth="login" type="user" name="user1" access="full"/>
<acl auth="login" type="group" name="Office" access="read-only"/>
</aclsList>
</share>
<share name="share" status="enabled" external="no" download="no" timemachine="yes">
<path>share</path>
<protocols http="yes" netatalk="yes" proftpd="yes" samba="yes" upnp="no"/>
<comment>share</comment>
<aclsList>
<acl auth="login" type="user" name="user1" access="full"/>
<acl auth="login" type="group" name="Office" access="full"/>
</aclsList>
</share>
<share name="new_office" status="enabled" external="no" download="no" timemachine="yes">
<path>new_office</path>
<protocols http="yes" netatalk="yes" proftpd="yes" samba="yes" upnp="no"/>
<comment>Office Use Only</comment>
<aclsList>
<acl auth="login" type="user" name="user1" access="full"/>
<acl auth="login" type="group" name="Office" access="full"/>
</aclsList>
</share>
<share name="new_public" status="enabled" external="no" download="no" timemachine="yes">
<path>new_public</path>
<protocols http="yes" netatalk="yes" proftpd="yes" samba="yes" upnp="no"/>
<comment>Public Internet Access</comment>
<aclsList>
<acl auth="login" type="user" name="user1" access="full"/>
<acl auth="login" type="group" name="Office" access="full"/>
<acl auth="none" type="userall" access="read-only"/>
</aclsList>
</share>
<share name="usb_1" status="disabled" external="yes" download="no" timemachine="no">
<path>usb_WDCWD30_00JB00KFA0_1cf03f6b495743e4b5c9b13a5f9fb651</path>
<protocols http="yes" netatalk="yes" proftpd="no" samba="yes" upnp="no"/>
<comment>External Disk</comment>
<aclsList>
<acl auth="login" type="user" name="user1" access="full"/>
</aclsList>
</share>
</sharesList>
<multimedia>
<active>false</active>
</multimedia>
<servicesList>
<service type="share" protocol="samba" on_boot="yes"/>
<service type="share" protocol="netatalk" on_boot="no"/>
<service type="share" protocol="proftpd" on_boot="yes"/>
<service type="presence" protocol="avahi" on_boot="yes"/>
<service type="share" protocol="http" on_boot="no"/>
<service type="presence" protocol="ipconfd" on_boot="yes"/>
<service type="share" protocol="upnp" on_boot="no"/>
<service type="presence" protocol="daapd" on_boot="no"/>
</servicesList>
<presenceList>
<presence type="avahi">
<protocol name="http" status="enabled"/>
<protocol name="ipconfd" status="enabled"/>
<protocol name="netatalk" status="disabled"/>
<protocol name="proftpd" status="disabled"/>
<protocol name="samba" status="disabled"/>
<protocol name="timemachine" status="enabled"/>
</presence>
</presenceList>
<updates rollback="none"/>
</lacie_conf>

I have a Lacie 5big Network (original version v1) on firmware v2.2.3, but the ethernet port failed. The drives and data seem intact.

I have all 5 x 1TB drives hooked up to a PC and can see all the partitions on each drive. Seems like some standard EXT type LINUX partitions with standard LINUS folders and files. Each drive also has a 950GB "unknown partition" - I assume this is the XFS file system that Lacie stores the users data files in.

Anyone know of a good way to read/copy the user data files off? With a sofware program that rebuilds raid arrays? By just booting up the LINUX?

Please any help to save my family photos, movies, and documents without paying exhorbitant clean room RAID recovery service fees! I have a lot more factual information if someone thinks they can help.
Thanks,
Jim

You need firstly software that can read XFS.

You need software that can recreate the array from the individual disks.

You need at least some basic knowledge on RAID and the File System.

The EXT partitions usually are mirrored with the actual striped RAID starting further unto each disk, at the start of the unknown partition, which you are right will (usually) be XFS.

Also, some Lacie units use non-standard configurations and can be more complicated to reconstruct, you should keep this in mind.

Try UFS Explorer to identify the XFS partition which can also reconstruct the array for you.

I tried several software tools for RAID Rebuild/Recovery: "USF Explorer", "Get Raid Recovery", "Disk Internals Raid Recovery" and Paragon Software's "Partition Manager", "Drive Backup" and "Hard Disk Manager".

USF definately was able to see all the EXT partitions with lots of LINUX files and folders. All the drives seem to have a 950GB XFS partition, but it only recognized / labelled one of them (the last HD) as XFS. Here is a screen shot:

https://docs.google.com/document/d/1SHpYBRIzGowaz9GdQgm5GnoHCdj13Q_mPp2VCGjvO1s/edit?hl=en_US

I don't know how to go further, not knowing all the RAID parameters, other than I know the physical drive order (labelled), RAID 6 and software type of raid by Lacie.

Man I'm never buying from them again. This was supposed to be a decent home storage solution. At work, at least in a server with a controller card RAID, you get real technical support from Dell, HP, IBM, included until you get your data back. This Lacie is hard to deal with.

@MillerJamesD

I'm Assuming that you've changed the Network Cable and Port on your hub. If so, does the port or any port on the hub light up
at all? Does it blink?

The ethernet port may not be working but what have you tried to troubleshoot it?

Does it get a light on it?
Is the port loose at all from where it connects to the PCB?
Have you inspected the connection inside with a nice flashlight and or microscope to verify that the port is actually bad?
Have you inspected the PCB for failures on the chips and or diodes etc?

You may be able to get the unit working again and not have to worry about removing the drives to perform a much more difficult recovery.

@MillerJamesD

Any data recovery pro would likely have fully recovered your data within a few days. If your time and the data on the RAID is of no value, keep playing and you may get lucky and figure it out or completely destroy your data.

I don't suggest you blame LaCie for the problems you are having, it isn't their fault you didn't backup your data.

_________________
Luke
Recovery Force Data Recovery

This is exactly the difference between professionals and the rest : they bring solutions. But everything has a cost.



In fact it IS a decent HOME storage solution but you should backup your data ALWAYS.
And as far as I know if you don't have a PAID (oh... and what a price....) service agreement/contract NOBODY will spend even a nanosecond on the phone teching you / helping you on your RAID problems, even buying the most expensive (?) controllers / servers ...



It depends on who deals with it...

I am hoping that Max40watt is still alive and kicking out there somewhere.
We have a 2TB 5BIG that has died and we need to get the data off of the 5 HDDs.
You imply success so I am hoping you can offer more specifics regarding your path to success.

Max40watt ... are you out there ??

If your data is important to you, I strongly suggest you send it to a pro for an assessment first. As I tell all my clients, there are two reasons we can not recover a RAID. The first is because the damage is too severe to recover from and the second is because of the damage caused by prior attempts of someone who does not know what they are doing.

_________________
Luke
Recovery Force Data Recovery

Usually this one

_________________
You don't have to backup all of your files, just the ones you want to keep.

Agree.

We've had A LOT of failed RAID jobs because some "IT tech guy" decided to give it a shot (so, perhaps he could be named "hero" of the company if successful).

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

A few months ago I had a client with a 4 disk RAID5 in a Netgear unit. 1 disk failed so they replaced it, but at 80% the rebuild failed and they realised they had replaced wrong disk! They returned the disk wrongly taken, replaced the right disk and tried a second rebuild which also failed. After speaking with netgear support along with his own 'expertise' further disks were replaced.

I actually recieved a unit with 4 disks and an additional 4 disks - nobody knows what disk was what!

I could not rebuild filesystem, but from 4 of the 8 disks I could recreate the RAID and RAW data only was good.

This would have been a quicker simpler and relatively cheaper job with a much improved end result had it been analysed professionally first.

As experienced and knowledgeable your IT guy is, unless he has masses of experience specifically within data recovery he probably is a danger to your data in cases like these.