Restore RAID metadata?

[Some1ne]

I'm currently running a RAID-5 with 4x 320 GB Seagate disks on an Asus P5B-Wifi/Deluxe (Intel P965/ICH8R chipset). A couple days ago when I restarted my system all 4 disks were reported by the controller as being "Offline". I checked the connections, and everything seemed fine, but even after several restarts the status hadn't changed. I then went to the included management program (inside of Windows), which popped up an error message stating "your disks will not be usable until you reset them to non-RAID mode". After I checked the documentation and saw that it said that resetting the disks to non-RAID would not harm any of the data that was actually on the disks, I allowed the management program to reset them.

However, now whenever I try to redefine my array, the software brings up a message saying that all the data will be lost. That's not at all what I want. Is there any way to restore the RAID metadata without having to destroy the data on the array? I've seen a handful of posts in other forums stating that despite the warning message, redefining the array won't actually kill the data on it. Does anyone know if that's true or not? I'd really rather not have to lose the data on the array...that's kind of why I set it up as RAID-5 in the first place.

 

[Laputa]

It will kill the front portion of the data on the drive. So you are likely to loose all the directory structures, file names, etc.

 

[Some1ne]

You mean, when the array is redefined it intentionally wipes out things like the file-allocation table (or whatever it is that NTFS uses to keep track of files/directories)? Or does it just overwrite whatever sectors were previously in use to store the RAID metadata?

 

[ch33zw1z]

Try recreating the array in the hardware setup. Set the drives to RAID, enter the config program during bootup, look for the option to copy config to drives...or to copy config from the drives. Or, you may just be able to mark them as online, and the config may do the rest. I don't have much exp with Intel matrix RAID, but based on my exp with other RAID controllers, you should be able to bring the array back online without data loss.

 

[Billb2]

Originally posted by: Some1ne
You mean, when the array is redefined it intentionally wipes out things like the file-allocation table (or whatever it is that NTFS uses to keep track of files/directories)? Or does it just overwrite whatever sectors were previously in use to store the RAID metadata?

You're confusing "reconfiguring" and "redefining". You want to reconfigure. Redefine will wipe your data. The array is still there, so it doesn't need to be reconfigured, but the BIOS and OS can't see it, so it has to be redefined.

 

[corkyg]

If I wanted to rebuild/redifine/reconfigure my RAID array, I would first back up the array to an external drive. After that I could rebuild the array any way I wanted and then when finished, restore the data to it - including the metadata files which are part of NTFS.

 

[Some1ne]

You're confusing "reconfiguring" and "redefining". You want to reconfigure.

Okay, so how do I "reconfigure" my array? The only options given to me in the management software are "Create RAID Volume", "Create RAID Volume from Existing HDD" (only works with a single HDD), and "Rescan for Plug and Play Devices". Inside the BIOS tool, the only available option is "Create RAID Volume".

 

[Billb2]

Originally posted by: Some1ne

You're confusing "reconfiguring" and "redefining". You want to reconfigure.

Okay, so how do I "reconfigure" my array? The only options given to me in the management software are "Create RAID Volume", "Create RAID Volume from Existing HDD" (only works with a single HDD), and "Rescan for Plug and Play Devices". Inside the BIOS tool, the only available option is "Create RAID Volume".

Sorry can't help you with specifics for yor RAID. I've only used promise raid cards and AMD/Nvidia on board RAID..never used Intel chipset RAID.

 

[RebateMonger]

Once you get it figured out, you might want to put everything on some backups and play around with your RAID controller/drives. As you are finding, it's better to play with this stuff BEFORE you have a major problem, rather than guessing about it after a problem has come up.

 

[Some1ne]

Once you get it figured out, you might want to put everything on some backups and play around with your RAID controller/drives.

Yeah, that would be a good idea. I was also thinking about just snagging a couple of cheap SATA drives and running some experiments of my own (i.e. define an array, put a few files on it, reset the disks in the array to non-RAID, recreate the array and see if I can recover the files), as the official Intel tech support has been surprisingly unhelpful with answering my questions about this issue.

 

[RebateMonger]

Originally posted by: Some1ne
Yeah, that would be a good idea. I was also thinking about just snagging a couple of cheap SATA drives and running some experiments of my own (i.e. define an array, put a few files on it, reset the disks in the array to non-RAID, recreate the array and see if I can recover the files), as the official Intel tech support has been surprisingly unhelpful with answering my questions about this issue.

It's NOT easy to find documentation on how to fix things like this. My reading of Intel, Dell, and other RAID controller documentation has been disappointing, and the LAST thing you want to do is make a mistake during an array recovery. That's why it's best to play with these things in advance and write things down. Good luck.

 

[Some1ne]

Well, according to the experiment, there's no straightforward way to get the array back by going through the configuration utility. Redefining the array causes Windows to pick it up as an "unitialized" volume, and then it won't let you use it until you reformat it. It might be possible, with quite a bit more effort, to manually stick the correct metadata onto each disk, and then everything might get picked up correctly, but I don't have the time to go that deep into it. Looks like it's professional data recovery service, or bust.

 

[Some1ne]

It would seem I spoke just a little too soon. With a little poking around I found a program called Raid Reconstructor, which did a reasonable job of detecting the proper configuration of my failed volume, and was able to output a "virtual image" file that other recovery software can read. I was then able to mount the image, and recover all the lost data.

Should anyone with a similar problem stumble across this thread in the future, what I found was that the Intel ICH8R RAID controller (and probably ICH9R, and maybe prior versions as well) uses backwards parity rotation in its RAID-5 arrays, and the correct "start sector" to use is 0. Also, if using the Raid Reconstructor program, although it seems to do fairly well about detecting the correct array settings, it may pop up a message saying "the result is not significant!" even when it correctly detects the array settings. If you get a low enough entropy score (like 0.01), then you should probably just ignore the message, and give the detected settings a try.

 

[RebateMonger]

Thanks for taking the time to summarize your efforts.