RAID 0 data recovery - creating a block level copy?

[Kadence]

I have a RAID 0 array (2x300GB WD Velociraptors connected via SATA) which appears to have crashed. Both disks show up in the BIOS, but the RAID volume is not listed at bootup by the RAID controller message.

When I just ran Vista installation (on a different hard drive), it only showed a single of the Velociraptors (showed 279GB space available). After I installed Vista it shows a drive d: with 0 bytes and when I click it asks if I want to format (which I have not done - I have left the drives unaltered since the crash). I don't know if this drive is just one of the drives, or represents the array.

I googled RAID 0 data recovery and found this FAQ, which says:

Q: Could data recovery software utilities be used to recover my RAID 0?

A: Perhaps, but it wouldn't be the safest approach. Most data recovery software will require the read / write heads to constantly travel over areas of the original disk that, if there is any physical damage, could render the surfaces useless and beyond recovery. The safest method of recovering data from a failed or corrupted RAID 0 volume (or with any storage device) is to create a block-level copy of every sector on each hard drive. The copied image is then used to reconstruct the original volume and rescue the required files and directories. This approach, while more time consuming, maintains and preserves the data integrity of the drive media and limits the number of times that the original drive needs to be accessed. It also protects against any writing to the original media, which could result in an inadvertent overwrite of the data that needs to be recovered.

How do I create this "block-level copy of every sector on each hard drive"? Can this mirror image be copied onto a separate single hard disk (assuming it has the space), or do I need to create a new RAID 0 array and then copy each of the disks to a new disk?

 

[Nothinman]

I believe that all of that is technically possible, however it would be a lot of work and require that both drives are still in a readable state. I don't know if any software out there that will attempt to do this for you in an automated fashion. And this is why RAID0 isn't recommended except for situations where you don't give a shit about the data on the volume.

 

[Russwinters]

There is no software that exists that will do this WELL on a drive that is failing.


There is a few hardware/software complex that exist for this purpose, but they are not cheap and are designed for data recovery professionals.

Atola Imager $1890

DeepSpar ~$2500

Data Compass - $??




You can try linux dd_rescue, but it doesn't work well for bad sectors, weak or failing heads.

 

[Kadence]

There is no software that exists that will do this WELL on a drive that is failing.


There is a few hardware/software complex that exist for this purpose, but they are not cheap and are designed for data recovery professionals.

Atola Imager $1890

DeepSpar ~$2500

Data Compass - $??




You can try linux dd_rescue, but it doesn't work well for bad sectors, weak or failing heads.

$1800+ is a lot, but sending out the drives to get recovered by a pro would probably cost just as much I think, so I might consider that (I might be able to sell the hardware to recoup some of it also, I think). When you say it is "designed for data recovery professionals", does that means these devices are too complex for data recovery newbies like me to use? Or if one can afford it and read the instructions, would they be able to use one of these successfully? If it's a reasonable option I might do that, but I don't know if I'd be in over my head or not.

Since my computer won't recognize the hard drives, could I still use dd_rescue?

And this is why RAID0 isn't recommended except for situations where you don't give a shit about the data on the volume.

Well, I guess I understand this now, but knowing that now doesn't help me Main problem is I had a backup drive, but that seems to have errors too, so I can't restore the incremental backups I had.

 

[FishAk]

I would focus more on getting the data off the backup volume. It's probably in a more readily readable state than the crashed RAID 0. Is the backup an image file, like a clone? Compressed? Encrypted? What did you use to make the backup?

You might try R-Studio on the backup. It's free to download and try, to see if it will help, but $75 or some such, to actually recover anything over 65K or so.

 

[Emulex]

$50 for 1TB external drive. makes you wonder why you'd need recovery?

 

[Nothinman]

$50 for 1TB external drive. makes you wonder why you'd need recovery?

Because 1TB drives sometimes fail too?

 

[Russwinters]

$1800+ is a lot, but sending out the drives to get recovered by a pro would probably cost just as much I think, so I might consider that (I might be able to sell the hardware to recoup some of it also, I think). When you say it is "designed for data recovery professionals", does that means these devices are too complex for data recovery newbies like me to use? Or if one can afford it and read the instructions, would they be able to use one of these successfully? If it's a reasonable option I might do that, but I don't know if I'd be in over my head or not.

Since my computer won't recognize the hard drives, could I still use dd_rescue?

Well, I guess I understand this now, but knowing that now doesn't help me Main problem is I had a backup drive, but that seems to have errors too, so I can't restore the incremental backups I had.

The Atola is fairly easy to use. You would just either image to a new working drive, or a file, and then rebuild the raid virtually using software like R-Studio or UFS explorer.


You should download www.hddscan.com

run a linear read test, and then switch to map view and see how it is reading.


if you can't even get the drives to ID in hddscan, then you are going to need pro help.


If the data is truly valuable, you can PM me for more information.

 

[Kadence]

I would focus more on getting the data off the backup volume. It's probably in a more readily readable state than the crashed RAID 0. Is the backup an image file, like a clone? Compressed? Encrypted? What did you use to make the backup?

You might try R-Studio on the backup. It's free to download and try, to see if it will help, but $75 or some such, to actually recover anything over 65K or so.

The backup was the incremental file backup found in Vista Ultimate 64. When trying to restore from the backup's catalog it restores a few files before I get the error message:

"Restore did not complete successfully. Error code:
The volume does not contain a recognized file system. Please make sure that all required file system drivers are loaded and that the volume is not corrupted.. (0xB00703ED)

I also tried manually unzipping a few of the various incremental backup sets (which are zipped and named by date), and that successfully gives me many files, but for other files I get errors like "Error 0x80030002: filename could not be found"

Don't really know what happened here. None of the tools I've used (HD Tune, HDDScan, Vista's error checking) show any errors on the backup drive. So I don't know where the "does not contain a recognized file system" issue comes from.

I downloaded R-Studio and will try it for the RAID drives. Right now I'm making images of the hard drives using the VirtualLab demo. I think R-Studio can also make images, perhaps I'll make ones using that as well.

$50 for 1TB external drive. makes you wonder why you'd need recovery?

My backup drive was an external 750GB drive. For whatever reason, that has failed.

The Atola is fairly easy to use. You would just either image to a new working drive, or a file, and then rebuild the raid virtually using software like R-Studio or UFS explorer.

You should download www.hddscan.com

run a linear read test, and then switch to map view and see how it is reading.

if you can't even get the drives to ID in hddscan, then you are going to need pro help.

If the data is truly valuable, you can PM me for more information.

Thanks. HDScan and other programs can ID the drives. I'm currently running the read test listed under Test Selection - I assume that is what you mean by linear read test? The quick SMART test gives all green for the first drive except for the following:

197 Current Pending Errors Count 200 200 0000000000-0002 000
198 Uncorrectable Errors Count 200 200 0000000000-0002 000
199 UltraDMA CRC Errors 200 200 0000000000-06E6 000

It gives all green for the second drive except for the following:

199 UltraDMA CRC Errors 200 200 0000000000-0020 000

I tried the demo for Runtime Software's RAID Reconstructor, but that gives me the message "no significant result" or something like that, which I believe means that their full software would not be able to successfully reconstruct the drive.

Between the softwares R-Studio, UFS Explorer, VirtualLab, Quick Recovery, DiskInternals RAID Recovery - are these all equally effective? Is there an industry standard, or are they basically interchangable?

 

[Kadence]

Here's the HDDScan read report for the first disk (the graph looked pretty normal)-

Executing
Bad block found, start LBA : 6144256
Block start at 6144512 time 71ms
Block start at 6144768 time 2448ms
Block start at 6145024 time 62ms
Block start at 128099328 time 324ms

And for the second disk - the graph was pretty messed up for this one:

Open Disk
Test : RD-Read


Executing
Block start at 30266624 time 84ms
Block start at 52801792 time 348ms
Block start at 95794176 time 54ms
Block start at 186484480 time 51ms
Block start at 227891712 time 55ms
Block start at 250208000 time 55ms
Block start at 256718336 time 348ms
Block start at 311909376 time 355ms

Here's the graphs:

 

[Russwinters]

The results seem to show that the drives arn't in TOO bad condition.


You should be able to make complete copies of the drives using http://www.gnu.org/software/ddrescue/ddrescue.html



once you have the copies, you can probably plug them back into the raid and they will work.


If not, you will need to rebuild the raid virtually.

For this I would recommend UFS explorer, it has a really good success rate with RAID rebuilding.

You need to figure out:

What type of Raid:

stripe size (if there is a stripe)

offset (if there is an offset)

disk order



that should be enough to build it.

 

[Kadence]

Thanks. How can I use dd_rescue on Windows? I googled but couldn't find any straight answers.

Also does one of these tools give me the stripe size and offset (I don't think there's an offset but am not sure)?

 

[RebateMonger]

Also does one of these tools give me the stripe size and offset (I don't think there's an offset but am not sure)?

I think a lot of the tools will GUESS those numbers and see if the resulting data makes any sense. If not, they guess again.

 

[Russwinters]

The only RAID tool that will guess is Raid Reconstructor which I have not had great experiences with.

Everything else it is up to the technician/user to figure out.


You will need to use linux to do ddrescue. I would make a knoppix CD and put it on there that is the easiest way.

 

[sub.mesa]

If you want to recover a RAID with data intact but you lost the RAID controller, then simply boot into Ubuntu Linux livecd to access your data.

Boot Ubuntu
Click menu Places->Home
In the window that appears, the left panel should say "... GB Filesystem" click on it to reveal your data.

This may not work if the filesystem/partition table has been damaged, but remains a good tip for lots of people who do not know about this functionality. This should detect all onboard RAIDs and even some hardware RAID metadata formats.

 

[Kadence]

The only RAID tool that will guess is Raid Reconstructor which I have not had great experiences with.

Everything else it is up to the technician/user to figure out.


You will need to use linux to do ddrescue. I would make a knoppix CD and put it on there that is the easiest way.

Thanks. I made a bootable Knoppix CD and it came with dd_rescue. However I'm not seeing either of the RAID drives in question listed. In the PCMan file manager, the two RAID hard drives aren't listed. From command prompt, in /dev, I see folders like /dev/sdd1, but they don't seem to be the RAID drives.

How can I get these drives to be listed, so I can image them using dd_rescue?

 

[sub.mesa]

Have you tried the Ubuntu tip, Kadence?

Your harddrives would be known as /dev/sd*, while your RAID array would be known as /dev/md*

 

[Kadence]

Have you tried the Ubuntu tip, Kadence?

Your harddrives would be known as /dev/sd*, while your RAID array would be known as /dev/md*

Thanks, I booted from the Ubuntu DVD and see the /dev/sd*'s, however I still don't see the md*'s.

I downloaded smartmontools, and a scan lists the following drives, none of which are one of the RAID drives:

root@ubuntu:~/Downloads/smartmontools-5.40# smartctl --scan
/dev/sda -d scsi [SCSI]
/dev/sdb -d scsi [SCSI]
/dev/sdc -d scsi [SCSI]
/dev/sdd -d scsi [SCSI]
/dev/sde -d scsi [SCSI]

 

[Kadence]

Actually I was wrong - I think /dev/sda and /dev/sdb are the two RAID drives. I'll see if I can use dd_rescue in Ubuntu.

 

[exdeath]

Data does not just disappear instantly off any drive short of catastrophic physical destruction. If it's not recognizing the array, the manufacturer specific RAID signature is missing or corrupt, and of course Windows sees it as an unformatted drive without a MBR/partition table (since it's incomplete, interleaved, and not at the right offset when not running through the RAID).

What you need are tools from Intel/nVidia/Adaptec/etc whoever your RAID adapter is created and managed by, and attempt to restore the RAID signature, with proper regard for how the underlying RAID is organized (stripe size, alignment, etc) so that the controller mounts the drives as a RAID again on POST.

Only then, can you attempt to read data off the array and possibly recover some files, but it will be hit/miss depending on the underlying media damage.

Messing with the RAID signature is kinda like messing with the partition table. If you wipe it out, it's just a few bytes, but it doesn't change the data on the drive. You can restore it, then it appears blank, then just flip a flag saying it's a formatted whatever partition and instantly your data is back, because the MFTs and what have you have been there the whole time.

You might want to test on some other drives and proceed with caution, but you can try and create a RAID0, put some data on it, delete the RAID0 in the BIOS, then recreate it with the same values and see if the partition is still recognized. I've been able to recover failed RAID arrays just by remaking the array in the BIOS to restore the signature, but this is completely dependent on the manufacturer. In other cases I've been able to download rebuild tools from Silicon Image, etc, that only restore the RAID signature and touch nothing else.

 

[Kadence]

The actual solution turned out to be more simple than anticipated - turns out that in the BIOS, the SATA setting had somehow changed to "IDE" rather than "RAID" at the same time one of the drives became damaged. This is why the RAID drives were not listed by the RAID controller during the bootup sequence. After I booted from my extra hard drive after changing the setting back to RAID, the Vista error checking dialog box automatically popped up for the RAID volume, and it fixed the errors. After this I was able to boot with the RAID drive normally.

Now I'd like to clone my array as a whole for backup purposes, rather than disk by disk (I already have images of both components using dd_restore). But in Ubuntu, it only allows me to view the disks individually. I also made a CloneZilla boot disc, but that likewise only shows the two disks individually. I installed Driveimage XML, but that's giving me errors when attempting to make the image file.

How do I clone or image the RAID array as a whole? Right now I'm using Vista backup to backup the computer (not files this time), but that seems a bit riskier than an image file.

 

[FishAk]

Macrium Reflect (home edition is free) Use default settings which gives some compression, but has always restored normally for me. Only original image files that havn't been defragmented, moved, or otherwise disturbed are reliable. I keep a dedicated partition just for image files to keep them safe.

 

[RebateMonger]

Only original image files that havn't been defragmented, moved, or otherwise disturbed are reliable. I keep a dedicated partition just for image files to keep them safe.

That seems a bit odd. Is that a known issue with Macrium Reflect?

 

[FishAk]

I discovered it from experience first, and then found others who had trouble recovering images after moving them on other forums. It didn't appear to be confined to Macrium, on other forums, but I don't have personal experience with other cloning software.

With Macrium, the only times I had trouble recovering an image was after moving the file, or allowing it to be run over by a defrag program.

 

[Kadence]

I neglected to update this earlier, but just to note, I booted from another hard disk, used Macrium Reflect to clone my RAID, then quick formatted the RAID and rewrote the image onto it. An HD Tune scan of the RAID now reveals no bad sectors. Thanks for the help

Though on bootup, my RAID controller info under "Type/Status (Vol ID)" still lists "Error (0)" like it did before. Not sure what that means or if I have to worry about it. It displayed that out of nowhere starting a few months ago, but the computer kept functioning and the Vista error checking never showed any bad sectors to my recollection, so I ignored it.

Does anyone know what this message might mean, since HD Tune isn't revealing any bad sectors?