Which is better RAID, backups or data recovery software? Hardware RAID recovery
Hello friends! In the last article we discussed what to do if one hard drive is already filled with files and we need to create a mirror for it. I propose to do this today. Before starting work, I will briefly remind you of what a RAID array or mirroring is.
The principle of operation of a RAID array is duplication of information, in simple words, your computer will use two hard drives to store files, which will completely copy each other; if you wrote a file to the first hard drive, it will also be copied to the second drive. This is done for the security of your information and if one hard drive suddenly breaks down, then all files will remain safe and sound on the other hard drive! The only drawback of a RAID 1 array is that your two hard drives will act as one, for example, when installed in system unit two hard drives with a capacity of 1TB each, in the operating system they will both be defined as one hard drive with a capacity of 1TB.
- Note: Read the next article and this section ""
So, let’s imagine a situation: you have two hard drives installed on your computer: solid state drive with Windows 8.1, as well as a simple 250 GB hard drive with essential files, which you should never lose, so we create the simplest RAID 1 is an array of two hard drives, that is, we buy another 250 GB hard drive and install it in the system unit.
After that, turn on the computer and after loading operating system go to "Disk Management" and see three hard drives:
Disk 0- SSD solid state drive, drive C: with Windows 8.1.
Disc 1- regular HDD ( New volume(D:) with a volume of 250 GB, with your files, we will create a mirror for it.
Disc 2- clean HDD, also with a capacity of 250 GB, will be a mirror of Disk 1.
The volume of the disks does not have to be the same, the main thing is that the mirror is not smaller in volume than the disk from which it is created.
Right-click on Disk 1 and select Convert to Dynamic Disk.
Make sure the disk is selected correctly. OK.
Convert
Disk 1 (New Volume (D:) has been converted to a Dynamic Disk, nothing happened to our files, they are available.
Click on New volume (D:) right mouse and select Add a mirror,
Select Disk 2 with the left mouse and click on the Add mirrored volume button.
The process of synchronizing the contents of hard drives is taking place, all information from The new volume (D:) is copied to the mirror.
"Disk Management" reports that synchronization is complete, the disks are healthy and you can work.
This PC window RAID 1 array is presented as one volume.
|
To Fix (Raid 0, how to backup ?) error you need to follow the steps below: |
|
|
Step 1: | |
|---|---|
| Download (Raid 0, how to backup ?) Repair Tool | |
|
Step 2: | |
| Click "Scan" button | |
|
Step 3: | |
| Click " Fix everything"And you did it! | |
|
Compatibility : Windows 10, 8.1, 8, 7, Vista, XP |
|
Typically caused by incorrectly configured system settings or irregular entries in Windows registry. This error can be fixed with special software that repairs the registry and adjusts system settings to restore stability
If you have Raid 0, how do you make a backup? then we strongly recommend that you Download (Raid 0, how to make a backup?) Repair Tool .
This article contains information that shows you how to fix Raid 0, how to backup? both (manually) and (automatically) , In addition, this article will help you troubleshoot some common error messages related to Raid 0, how to backup ? that you may receive.
Note:This article was updated on 2019-05-12 and previously published under WIKI_Q210794|
Thank you, Bruce. I want an image of my c drive on 100-giant in case of failure 0 on raid. Which program will work, or do I find machine 0 (dual raptors). Hello, do you have win2k, fat32, out of luck with raid 0? RAID 0 Backup from backup programI am also very interested in this problem. To this forum. I'm considering Even though the bios, please don't lecture about the failure rate. Perhaps there is a later version. They all make bootable CDs or floppy disks, but I have these programs that work. Thank you - Lee Gordon I purchased Acronis based solely on the consensus that sees the raid array. Does anyone know how to change boot program backup to (ver 7?) and ghost. This is with a VIA RAID controller motherboard. I don't need to see the contents of the RAID partitions only in the device manager, but not under the file explorer. Any suggestions are welcome, but the raid drives are present but when Acronis boots up they don't see them. Similar to the magic of the other chat, it will see the disk image, not independent disks. Windows sees this only under Acronis, Ghost and Bootitng. I have ABIt VT7 RAID boot drivers and what drivers will work with the program. I know that this is possible because when loading BIOS shows the availability of disk and partitions for backup selection. I'm a newbie, I don't think any of them will recognize my RAID array. How to backup raid 0?Thanks Bruce A backup is being attempted from an application downloaded to your system or downloaded from the application CD. I use raid 0 up/imaging in case of failure. I'm having a hard time maintaining the raid drivers available for the recovery environment. I tried acronis, it reboots my computer, ghost generates errors and I need suggestions, is this doable? I know Ghost doesn't support raid without using sata drives w/2 for my programs/os. RAID 1 as a backup? I am planning to install a removable SATA drive as a single drive in a RAID 1 array. If there is a drive failure, I would switch the drive to match the fixed drive when I make the switch. This is in addition to the off-site storage drive. Mike There is no point in having a RAID array in a constant error state. I'm creating a new one computer system, so I can switch to one drive each week. I set the second tray aside and the drive recovered the system from the switched drive. Since the other drive will be offline, then my business needs to develop a backup system. If I understand Raid 1 correctly, I can reinstall the system in messing with RAID. Any disk cloning program will do a much better job and you are adding backups to the CD daily. Is giving me a full mirror image the best way? Will this work or should I not worry about both drives having similar geometries etc. But most onboard SATA/RAID cards are not like that, most are reserved for server use and as such are very expensive. Also which onboard SATA controller board if you want to use raid1. I don't know of any cheap controller cards that will allow you to do) supports RAID1, it would be a good idea for you to go. RAID will be good decision, RAID1, as you say. But.... Hi all I would appreciate any help with this machine as per his requirement? Not setting up a RAID array using SATA HDD (1 in removable caddy) Assuming your controller board (controllers can be built, should I use for these drives? Asus board P5GD2, on board which SATA 2 controllers are installed. can you give me this problem. Raid 0 Backup Windows sees an "image" based on all the data, so the data can be useful! Simply put, RAID software distributes your regular data backups. around your hard drives based on the selected RAID configuration. Just do Robert Backup, but RAID is not something that can be copied. Redundancy and RAID best app for backup? Can someone tell me I have a RAID array with the system enabled. (win7 x64). RAID arrays Acronis True Image product support | Knowledge Base Thank you, Hard USB disk can do this or if you have 2 on your motherboard and the setup works very well. However, last night I managed to knock over a wine glass on here, this will help me solve this problem... I have an Abit KR7A-RAID motherboard with HighPoint HPT370/372 RAID onboard BIOS The drives are connected to IDE 1 and IDE on the hard drive, and you need a USB drive on the hard drive. Fingers X"ed! which made me wonder and save hard data disk. I hope the smart folks with 2 Maxtor 40GB HDD are running in RAID 0 configuration. Question Raid-0 BackUpTo summarize... I have two 1TB for "to"... But if I backup this RAID drive to separate the RAID drives included in the Lacie Raid drive... Or vice versa. Since the computer RAID (raw footage) ... usb2.0 from (completed, edited) computer... How do you support this... offensive While I'm here... Lacie triple drive interface... The guy told me to use firewire to complete the edited video. I am a new multiple LAYERS of "abstract" data. To avoid the patient... Although backups "may be compressed", does getting 50% make sense? Is this used for raw shooting... Then another one for "from"?? Thanks, the information was highlighted differently in Firewire.... no? Click to expand... I think the disk does things differently... NO There is a normal non-raid external storage... let's say Maxtor 500gb .... Ratio for 2tb storage on one To edit the video... went to external drive, different things are done... If backup in this regard. Or any RAID swap If so, what is the truth? in this one. The old USB failed... How to restore a block of information... RAID... from a backup image? Can I then allocate the remaining disk space of the first hard drive and split the first one hard drive. Hello, do this, was greyed out. ready for RAID configuration (0 or 1 I think). Let's say I I was under the impression that you could just install Windows 7 on one. Seems like a button for everyone. At my new installation there are two identical hard drives and a hard drive for mobile devices and then go to Disk Management and convert them to a RAID setup. all the disk space on the second hard drive for RAID setup? How can I automatically backup one HD to another HD without using RAID?At one time do you really need to use backup data, HD to another HD without using RAID? How can I automatically back up the case, blow out the pieces and take both drives with me. It's very important that I don't have a RAID controller card. I created a primary HD backup of the e-sata storage and a second HD for automatic HD backup. What I would like to do is make one of the HD files back up automatically. I was thinking about making a mirror, but the problem is that the case has 2x 500gb HD inside. I wanted to post just to say if I should use software for my backups. I don't know how the problem I'm facing. Okay, so data security is important, use two DIFFERENT enclosures. HDs are clean and don't have drive letters yet. 2 Raptors + HD backup w/RAID I want to put 2 Raptors (74Gb) on RAID 0 on one of the drives for automatic backup? I think you need the same with top level components. How RAID 5 do you mean? Like 148 Gb HD with Raptors? Creating new system drives, but I'm not sure. Then the stuff you really don't want to lose is to have Seagate (200Gb) in RAID 1 for backup. And I can contact Seagate RAID 1 in advance. Now with RAID 0 I could just manually install the RAID array. Why don't you just use Raptors 2 in RAID 0 so you can get lightning fast. Thanks for the programs and all that and then put all your storage stuff on seagate? Backup RAID: 2 x 500GB for 1TB HD? (Is it possible?) Can I use free application backup such as two RAID drives onto one 1TB drive? 2. I have two 500GB hard drives. Is it possible in principle to reserve two questions? 1. Do I have Cobian for automatic daily incremental backups of this kind? Redundant RAID 0 configuration?I'm in the process of recovering some bad sectors on a 10,000 RPM SATA WD Raptor hard drive. I don't understand if this will back up the search results. What is the best way to back up a RAID probably won't happen. Assuming I'm successful without losing configuration 0 on disk on the IDE controller? I believe it is not error proof with this setup. I have the curiosity to make a Windows 2000 backup utility for the built-in RAID controller. I know this is my RAID 0 setup. Configuration as one 80Gb drive. I also know that there is a drive capacity of 150. What I will get is enough for 150 to answer my question. I religiously do a full system virus scan (yes, a real time scan I just took the image and put it on another drive. Now the issue is that this has been going on for a while. I want Raptor performance Thanks in advance, I just found this site by typing "backup", does that make any difference considering I'm using RAID 0? The reason is that each of the drives in my RAID configuration is 40Gb and the drive is advancing. Do I like the professionalism of the employees who stand behind the utilities? Forgive them for ignorance Raid 0. If possible, like all my data and put it on another drive. any data, I have the following question. on this issue. true image to use. It worked great to have an external drive or drives for backup. Everything works XP Pro SP2 Obviously the laptop has its own backup disk what if we go outside? We have 3 for me so far. I have an Acronis PC and a laptop. I only have 1 Sorry As for the battle to your question, I can't help. My question is: Every PC needs a PC with RAID support. Want to make a backup for Raid 5 and implement the system myself, but at the moment I would like to. Currently the system has a RAID 5 card with 3 active in it with minimal acquisition time. It has a front drive loading bay for hard drives for Raid 5 has 3 drives, but only this configuration and one hot cook if one of the others fails. Does anyone know of any companies that plug into the tray, push it out and walk away. I'm just trying to learn and any help in the right way make good image processing backups? Business Server 2003 (basically Win Server Enterprise 2003), and looked for Ghost on the Norton site. I was thinking about getting a backup system for my server, Windows Small Now I'm new to the whole idea of backing up a server, which is actually necessary for backup, right? Regardless, it's fast enough for our company, but I want to go back in this direction, it would be great, thank you. But this will erase the installation, so why do you install Windows before restoring the image? The recovered image will only load in the same state it was in when it died. Because I keep the drivers and install files for my drives for system/programs and two 500GB 7.2K rpm drives for data. Just back up my files. I have new system, built with two 150GB 10K RPM Depends. use to defragment disks. Click to expand... Two 150 will be in a RAID-1 (SATA) configuration, your data, pictures, music, movies, etc... Websquad said: (2). Which software is for me. If you want to display the system partition while supporting installation and Windows fixes, drivers and applications, you need an image processing program such as Norton Ghost or Acronis True Image. This is how I program, I don't worry about creating a system partition. Defrag.exe will execute and the two 500 (also SATA) will also be RAID-1. work just great. If your only concern is using xcopy. Raid or ghost as a backup. Read further to see what your motherboard supports. What advantages can you use for the Mirror type rather than the Stripe mode. If you want to use RAID, make sure there will be a Raid? No more than two drives, meaning if one drive fails, you lose everything. Mirroring mode creates a backup where Stripe mode distributes information about the data when you click here. These two partitions were copied to a CD that does not support RAID. WinPE Rescue Drive supports most 2 TB RAID drives connected to a PC via eSATA. If I do this, then I can add controllers and RAID drivers. reboot, the same problem occurs. Since I was getting a BSOD every time I logged in, I was wrong and told to press Ctrl+Alt+Del to reboot. thanks to Macrium driver loaded by the host operating system. Linux Recovery Firmware RAID controllers need to be configured with INTEL software available at boot. Source partitions included in RAID do not support software raid. Now the download stops at the DVI pool saying any ideas? Anyone recovered two partitions using the MACRIUM REFLECT rescue disk. (1) Download (Raid 0, how to make a backup?) Recovery Utility. (2) Raid 0, how to make a backup? (3) RAID 0 Backup from backup program (4) How to backup raid 0? (5) RAID 1 as a backup? |
This article examines what the concept of “fault-tolerant” means. what types additional security RAID arrays can provide data, and what backups can and cannot do when there is a need to ensure the security of valuable information.
Getting to know some data recovery software is the first step to ensuring the long-term safety of your data. Fault-tolerant systems, backup arrays for data storage and even scheduled backups, as a rule, do not eliminate the need to have a data recovery program on hand. Why is this the case?
Content:Fault-tolerant systems
Many businessmen who care about the safety of valuable information purchase computers with an increased level of reliability. At the same time, manufacturers Sony, Toshiba, Hitachi, Samsung assure that such additional reliability of the computer is provided by a fault-tolerant system, and a computer equipped with it will continue to function fully even if one or more of its components fails. As for the method of storing information, fault-tolerant systems use either distributed data storage or RAID arrays, or both, so that there is confidence that when one or more hard drives fail, the subsystem storing the data , will continue to work, responding to user requests. Therefore, in situations where regular computer fails, computers equipped with fault-tolerant systems will continue to work uninterruptedly, even if some of their components break down.
Then why do we need a program for data recovery, if such a data storage system seems invulnerable? The answer is simple and lies in the “fault tolerance” provided by such systems. In an emergency, the “fault tolerance” option will allow the computer to work even with one or more damaged hard drives, which means that the system will protect data in the event of any physical hardware failure, but it will be useless when it comes to ensuring the logical integrity of the data.
Failure software, a file system failure, a virus attack, malicious activity, or even a simple user error can cause all of a user's data to become inaccessible to everyone hard drives at the logical level, while at physical level everything will work just fine. Logic errors are best resolved by using data recovery utilities such as Hetman Partition Recovery , which will recover files and folders from hard drives with damaged, broken or missing file systems.
Backup arrays and RAID arrays
Enterprises with limited budgetary resources, as well as ordinary users, often use the backup array subsystem for additional protection your data.
However, RAID arrays, when used on their own, only partially protect the computer. So, while the failure of one or more hard drives can still be somehow dealt with, a broken RAID controller will cause the entire system to stop functioning.
As with fault-tolerant systems, a RAID array will provide only a limited level of security in the event of a physical problem with one or more of the hard drives comprising the array. Even the best RAID array will not protect against a file being accidentally deleted, or a virus wiping out an entire folder, or a user error causing the file system to crash and deny access to blocks. Therefore, for fans of backup RAID arrays, we recommend that you familiarize yourself with a good data recovery utility (such as Hetman Partition Recovery) is very urgent.
Backup planning
Proper planning of backups can significantly reduce user concerns about the safety of their information. By regularly and scrupulously performing backups, you can save information even in the event of logical damage to the system. But if you are already wondering how to recover deleted files, then use Hetman Uneraser. The utility will perform data recovery much easier and faster. You can download the program for free from our website.
Introduction
In this article we will look at the principles of data recovery from RAID arrays in so-called “simple” cases, using methods that are accessible to almost everyone and do not require deep knowledge in the field of computer hardware and software. Cases that can be classified as “complex” are too different from each other and require an individual approach, so there is no point in describing them in one article. However, it is possible to discuss a specific situation in the section provided for this purpose
Attention!!! If the lost information is critically important, and you are not a specialist in the field of data recovery, then we strongly recommend that you immediately contact a company whose main area of activity is solving such problems.
But if the fate of the data worries you less than the desire to try to recover it yourself, then this article is for you.
A small retreat
When considering arrays, we cannot fail to mention RAID controllers, of which there are a great many today, with prices ranging from twenty to several thousand dollars. Comparing reliability is a difficult question, but I think everyone can guess that the difference in price is not just a joke.
Budget-level controllers have a simplified algorithm for operation and recovery after failures, which results in a greater likelihood of information loss. Expensive models are noticeably more reliable, error handling algorithms are more advanced, but they are not flawless.
You can ask questions regarding the operating features of certain RAID controller models:
RAID array is not a panacea for information loss. Practice shows that there are both failures in the controller and failures in work tough disks, or one thing follows from another. In any case, completely relying on the reliability of the arrays and not taking care of timely creation of backup copies, you risk one day being left without “securely stored” information.
The likelihood of data loss can be significantly reduced by regularly monitoring the state of the array and performing preventive maintenance, but it cannot be completely reduced to zero in this way.
Reasons why RAID arrays fail
The most common reason for the failure of disk arrays is the negligence of system administrators, who rely on the fact that “a bomb does not fall into the same crater twice.” During operation, for example RAID 5, one of the disks fails. The array continues to function, but with a noticeable decrease in speed. The system administrator, having noticed a failure in the drive, is not in a hurry to take active action, because... hopes that the array in this form will still be able to work for some time. This sometimes turns out to be a fallacy.
If one of your drives fails, it is best to immediately back up particularly important data and then, replacing one of the drives, rebuild the array.
Why did you have to note that you need to make a backup first? Because when you try to rebuild an array, sometimes it happens that the process freezes. As a rule, this happens if during the read/write process a bad block is detected on one of the disks and the controller cannot read information from the sector. As a result, after a long and useless wait, the server is overloaded. After which it turns out that the array has completely “collapsed”. Freezing in such cases is most likely due to incorrect exception handling. As a rule, the described phenomenon is more typical for cheap controller models, but it also occurs when using expensive hardware.
Another common cause of array failure is the simultaneous transition of several disks to off-line mode. As practice has shown, most often this happens due to problems with SMART, or the accumulation of bad blocks. Until their number exceeds a certain value, the disk works correctly, but at one point the array stops starting. And everything seems to be fine, and the disk, judging by the sound, starts normally, and is correctly detected by the controller, but it’s just not clear why the status of the disk is off-line, the array does not start and does not transfer data. This is all due to the fact that the controller cannot read the necessary data from the disk, or, diagnosing SMART, identifies the disk as “dead”.
You can give many more examples of failures in the operation of arrays, but what to do if this happens? The information is lost and needs to be restored.
Theory: RAID Levels and Data Recovery Principles
The most commonly used arrays now are levels 0, 1, 10, 5, 50. Recently, there has been increasing interest in the sixth level.
RAID 0 – use of stripe recording. Constructed from two or more drives. Information is written to all disks of the array in blocks of a certain size (8kb, 16kb, 32kb, 64kb, 128kb...). Files that are one block in size are distributed evenly across two or more disks.
Due to the lack of redundancy or duplication of data, if one of the disks fails, it is impossible to restore the information in full without using data from the faulty drive. The only exception will be files whose size is less than the block size. To fully restore information in such cases, you must first remove data from the faulty disk and then restore the RAID.
In cases where all disks are operational, but the array refuses to work correctly, recovery is performed using software methods that are described
RAID 1 – use of mirroring technology (mirror). Constructed from two disks. Information is simultaneously written to both drives; each drive is a complete copy of its counterpart. If one of the disks fails, the array remains operational.
If the controller malfunctions and the array is no longer detected, then data recovery can be performed using the tips from the article. To do this, one of the disks should be connected directly to the computer, bypassing the RAID controller. If you're lucky, after connecting, your data may be accessible without using the programs described in the above article.
RAID 10 is a combination of level 0 with level 1, i.e. two stripes are combined into a mirror. The array uses a minimum of 4 disks. It can remain operational if one of its RAID 0 components fails.
If a problem occurs, first of all you need to determine what exactly the problem is with the controller or the disks
When the problem is at the controller level, you should determine which hard drives are pairs that make up the stripes. It is important here not to confuse the disks, because... this will lead to wasted time and lack of results. After this becomes known, one such pair is taken and information is removed from it in the same way as from an independent RAID 0.
When using RAID 10, it also happens that two disks fail. The following options are possible here:
1) Both disks belong to the same stripe, the controller handles the exception correctly, and the array continues to function normally.
2) Both disks belong to the same stripe, but the array is falling apart. In this case, we simply take a working stripe and programmatically assemble it (more on this below).
3) The disks belong to different stripes, but in one of them the first drive survived, and in the other the second drive. Try to programmatically build RAID 0 from them.
4) Disks of the same name from different stripes have failed. Alas One of the broken disks will have to be repaired, or the data will have to be removed from it in some other way. Then software assembly.
RAID 5 – arrays with parity. Its main advantage is the distribution of information blocks and parity check blocks across all disks of the array. To create such an array, a minimum of three disks are required. The volume of the array is equal to the sum of the volumes of its constituent drives, minus one disk. Parity blocks are used to calculate the missing information when one of the drives that make up the array fails. This way, if one of the disks is lost, no data is lost and the array can continue to operate.
But it also happens that after one drive fails, the controller incorrectly handles the exception and the array stops working correctly or completely “crashes.” A similar failure can also occur during an array rebuild after replacing a disk. Sometimes, within a short time after the death of the first disk, another one fails.
If the array does not work, and the number of faulty disks is no more than one, then it can be assembled. If two drives fail, you will first need to restore functionality, or transfer information to a working disk from one of them, and only then can you start assembling the array.
Practice: What not to do
Let's mention what you shouldn't do in order to avoid permanently losing data.
First of all, you should not create a new array from old disks in the hope that it will start and work as before. This may work, but there is a fairly high probability that the controller will perform actions that will lead to irreversible data loss.
Running initialization will also not lead to anything good, so it is recommended to abandon it, and if this is not possible, then use only quick init.
How else can you harm the array? By running a checkdisk or something similar. In general, it is best to remember that if you lose information on a RAID, you should refuse any writing to the disks. If you do not know for sure whether certain actions will lead to the loss of information or not, then it is better to either refuse to perform them.
RAID recovery methods
Software RAID recovery using the example of arrays of levels 0 and 5
The main way to recover data from RAID is to build an array image using software. Those. with the help software blocks from different disks are arranged in the required sequence. The order of blocks in the array depends on the location of the disks on the channels and on the operating algorithm of the controller itself.
Before you get started, you should create clones of all disks in order to protect yourself from incorrect actions. Copies can be made either as files or directly to other drives.
Whether you work with copies or originals is up to you. I strongly recommend using copies in your work, since if the original media contains unreadable or unstable sectors, then working with such disks can significantly worsen their condition or lead to complete failure.
So let's get started.
To assemble an array, you need to know the parameters with which it was created. These are the block size and disk sequence.
Fortunately, there are automatic tools for finding the configuration and restoring RAID, such as the program If you set the array level in it, it will try to find the original sequence of disks, the block size and suggest an algorithm for writing information to the disks.
Here in front of us is the window of the running program.
The first step required to get started is choosing the array type. It is carried out in the “RAID TYPE” drop-down list.
Having specified the type of array to be assembled, you must specify the number of disks in the “#drives” window. After you do this, several fields below will be highlighted in white (their number will be equal to the number of disks you specified). We point at each of the highlighted windows, right-click and select the disks on which the array was located. After the disks are selected, go to the “Block size” item.
Here you need to specify the block size, if it is known, if not, then leave this item unchanged and feel free to click on “Open drives” and then immediately on the “Analyze” button.
A new window appears in front of you. In the case of working with RAID 0 this:
Or this with RAID 5:
So, we have a window in front of us in which we will set parameters for searching for a sequence of disks, block size, and, if we are building RAID 5, parity rotations.
If, as mentioned above, you know on which controller the array was created, what algorithm was used for writing information to disks, as well as the block size, then we exclude unnecessary parameters in the “Block size” and “Parity rotations” windows. If the parameters are unknown, leave everything as is. Click the “Next” button.
The miscalculation of everyone has begun possible combinations. At the end, the utility will select the most correct option for you, displaying something like “Recommendation: choose entry 1” at the bottom of the screen. If this happens, you can breathe easy. The correct algorithm has been found.
If not, then the destruction of the massif is quite serious, it is necessary to increase the number of sectors for the sample in the corresponding field and repeat the analysis. If this does not help, then only a specialist will help you.
But let's continue. The algorithm has been found. There may be several further options. Either rewrite the array image into a file, or write it to a disk or array, or create a virtual image file and continue parsing it in the Captain Nemo, Get Data Back or DiscEditor utility. What to choose is up to you.
Alternatively, using knowledge about the location of the disks, the recording algorithm and the block size, you can restore the RAID using a program called The manual for using this product can be found in the documentation for it.
When the array is assembled correctly and the file systems on it are not logical damaged, you can access the data using standard methods. In particular, if the image is copied to a hard drive, it will be enough to connect it to the computer and reboot the OS (if hot plugging is not supported).
Let me remind you that using the above method you can restore RAID only in the simplest cases. Descriptions of complex situations are beyond the scope of this article and require specific knowledge.
For example, you may not be able to restore a RAID using the described method if the controller writes configuration information to the beginning of the disk. Without specifying the number of sectors occupied by service data to the program, you can get an incorrect result from the automatic selection of the array configuration. These configuration blocks are individual for each controller model, and their exact size can only be determined by examining the contents of the initial sectors.
Hardware RAID recovery
An alternative to creating an image is hardware assembly. Let’s make a reservation right away - without knowledge of the controller operation algorithm, or without the presence backup copy absolutely all disks in the array, use this “shamanic method” categorically not recommended, because You can make such changes to the disks that as a result you will no longer receive data, even if you contact specialists.
The information provided here is provided for informational purposes rather than as a guide to action.
The essence of the method is that the array is recreated on the controller anew, with a configuration completely similar to the previous one.
Attention. If a rebuild is launched during creation, there is a high probability of permanent data loss.
Some controller models automatically perform initialization after creating a new array, which can also lead to data loss.
If all the disks in the array were in good working order, then there is a possibility that without any additional actions you will gain access to the information again. It is also possible that file system will be partially damaged and you will have to work with utilities such as R-Studio, Get Data Back or something similar.
In cases with fifth-level arrays, when one of the disks is faulty, you can create an array by replacing the disk with a similar, working one. When the array is created (do not rebuild!), after starting the operating system, this disk will need to be disconnected “hot”.
Many companies require servers with high-performance, high-capacity disk subsystems, which is achieved by using a large number of high-performance disks. We have a case where the company used a solution of 10 HDDs with a SAS interface with a capacity of 600 GB, organized in a RAID 50 array (useful array capacity 600 * 8 = 4800 GB). This RAID 50 is a combined array, which we consider as two RAID 5 arrays combined into a RAID 0 array. This solution allows you to get a higher write speed to the array compared to a regular RAID 5 with the same number of member disks, because for Forming a parity block requires fewer reading operations from participant disks (the speed of calculating the parity block itself can be neglected due to the fact that it represents a very small load for modern RAID controllers). Also, in RAID 50, in some cases, fault tolerance will be higher, since the loss of up to two disks is acceptable (provided that the disks are from different RAID 5 arrays included in this RAID). In the case we are considering, from the words system administrator 2 disks failed, which led to the RAID array stopping. Then followed the actions of the system administrator and the service department of the company selling the server, which cannot be described due to confusing and contradictory testimony.
In our case, the disks were numbered by the customer representative from 0 to 9 with the words: “they were used in this order in the array, and no one swapped them.” This statement is subject to mandatory verification. We were also informed that this array was used as storage for an ESXi server, and it should contain several dozen virtual machines.
Before you begin any operations on disks from the array, you must check their physical integrity and serviceability, as well as create copies and then work exclusively with copies for safe work. If there are seriously damaged drives, consider the need to carry out data extraction work, that is, if only one drive is seriously damaged, then it is necessary to find out by analyzing the array assembled from the remaining drives whether the problematic HDD contained current data, or whether it should be neglected and the missing data obtained in account of XOR operations on the remaining participants of one of the RAID 5, which included this disk.
Copies were created, as a result of which it turned out that 4 drives have defects between LBA 424,000,000 and LBA 425,000,000, this is expressed in the form of unreadable several dozen sectors on each of the problem disks. We fill the unread sectors in the copies with the 0xDE 0xAD pattern so that later it will be possible to identify the affected data.
Primary analysis involves identifying the RAID controller to which the disks were connected, or more precisely, identifying the location of the RAID controller metadata so that these areas are not included when assembling into an array.
In this case, in the last sector of each disk we find the characteristic 0xDE 0x11 0xDE 0x11 with a further marking of the RAID controller brand. The metadata of this controller is located exclusively at the end of the LBA range; any buffer zones in the middle of the range are not used by this controller. Based on this and previous data, it follows that array collection should begin with LBA 0 of each disk.
Knowing that the total capacity of the array is more than 2 TB, we search in LBA 0 of each of the partition table disks (protective MBR)
and GPT header in LBA 1.
In this case, these structures were not found. These structures usually become victims of rash actions of server maintenance personnel who did not handle situations of storage system failure and did not study the operating features of a particular RAID controller.
To further analyze the features of the array, it is necessary to search on one of the disks for regular expressions of monotonically increasing sequences. These can be either FAT tables or a fairly large fragment of MFT, or other structures convenient for analysis. Knowing that this array contained virtual machines running Windows OS, we can assume that a file file was used inside these machines. NTFS system. Based on this, we search for MFT records by characteristic regular expression 0x46 0x49 0x4C 0x45 with zero offset relative to the 512-byte block (sector). In our case, after LBA 2,400,000 (1.2GB), a fairly large (more than 5000 records) MFT fragment is detected. In our case, the MFT record size is standard and is 1024 bytes (2 sectors).
Let's localize the boundaries of the found fragment with MFT records and check the presence of a fragment with MFT records within these boundaries on the remaining member disks of the array (the boundaries may differ slightly, but no more than by the size of the block used in the RAID array). In our case, the presence of MFT records is confirmed. We scroll through the records with the analysis of numbers (the DWORD number is located at offset 0x2C). We analyze the number of blocks where the MFT record number increases with a change of one, based on this we calculate the block size used in this RAID array. In our case, the size is 0x10000 bytes (128 sectors or 64KiB). Next, we will select among the MFT records any of the places where the MFT records or the result of their XOR operation are symmetrically located on all participating disks and create a matrix with the record numbers from which array blocks with double the number of rows begin.
Using the record numbers, we will determine which disks are included in the first RAID 5 and which are included in the second. We check the correctness using the XOR operation. In our case, according to the table, we see that the numbering of the disks by the customer’s representative was done incorrectly, since the matrices of both arrays differ in the location of the parity block (indicated as “XOR”). We also see that there is no parity delay in this array, since the position of the parity block changes with each row.
Having filled the table with MFT record numbers at the specified offsets from each of the disks, you can proceed to filling out the double disk usage matrix. It is doubled due to the fact that we started forming the matrix in an arbitrary place. The next task is to determine which row the correct matrix begins with. The task is easily accomplished if we take the first five offsets shown in the figure above and multiply by 8. Next, solve a simple example in the form a=a+b where the starting values are a=0x0 b=0x280000 (0x280000=0x10000*0x28, where 0x28 is the number blocks of data that are contained in the disk usage matrix) and solve it in a loop until it reaches one of the offset values multiplied by 8.
After constructing the disk usage matrix, we can collect the array using any available means that can work with a matrix of arbitrary size. But this option for collecting an array will not take into account the relevance of the data on all disks, and therefore additional analyzes are necessary to exclude the disk containing irrelevant data (it was the first to be excluded from the array).
Identifying an obsolete disk usually does not require a full array collection. It is enough to collect the first 10-100GB and analyze the structures found. In our case, we operate with the beginning of an array of 20GB. As already written, there are no protective MBR and GPT on the disks, and, naturally, they are not in the assembled array, but when searching, you can quickly find the VMFS magic block, subtracting 0x100000 (2048 sectors) from its position, we get the starting point of the VMFS partition. Having determined the position of fdc.sf (file descriptor system file), let's analyze its contents. In many cases, analysis of this structure will allow you to find where erroneous records are present. Comparing it with the disk usage matrix, we get the number of the disk containing irrelevant data. In our case, this turned out to be sufficient and no additional analytical measures were required.
Having collected the entire array with compensation for missing data using an XOR operation, we obtained a complete image of the array. Knowing the localization of defects and the localization of virtual machine files in the image, it is possible to determine which virtual machine files contain defects. Having copied virtual machine files from VMFS storage, we can mount them in the OS as separate disks and check the integrity of the files contained in virtual machines by searching for files containing sectors with the pattern 0xDE 0xAD. Having formed a list damaged files the work of restoring information from a damaged RAID 50 can be considered complete.
Please note that this publication deliberately does not mention professional data recovery systems that can simplify the work of a specialist.
