RAID 10 case

[slingshot]

Ive been working on a 4 disk RAID 10 case and trying to rebuild the RAID in UFS pro.
(using 4 bare drive DDI images)

There are supposed to be 6 partitions within the array, that contain important data, but my rebuild isn't really showing me any of these, I just seem to be getting loads of different flavours of 1 main partition :?:

What is the preferred method of being able to ID the correct disk order as Im not sure Ive got them setup properly.

Would R-Studio be a better option :?:

Thanks guys.

 

[Jared]

How are you assembling the RAID 10? You should just find your mirror sets, then take one from each set and assemble it as a RAID 0. Then once you find the settings, you'll just have to figure out if any drives are out of date through swapping in and out the other drives and re-assembling it using the same settings to see what combination has the most recent data.

 

[slingshot]

This server box has sustained a drive failure, so customer has replaced a drive and successfully rebuilt the array at which point another drive in the array died. The server doesn't boot up at all now and the case has come to us due to it being a complete mess. To me, it looks like 1 stripe had a drive die and was rebuilt successfully, but the other stripe had a drive die and the rebuild was unsuccessful. Im struggling to determine which disk has been in what order as customer has fiddled and made it worse. Ive successfully imaged all 4 original disks, nothing too bad except a few unread blocks, but it looks to me like 3 disks have got the correct partition info and signs of data but the fourth disk seems mainly empty.

Ive tried to assemble the RAID in UFS pro in the order of the disks as they came out the backplane.

If the disk order is 0,1,2,3.... then I'm assuming disk 0, 2 and 1, 3 are the stripes but I can't be sure which disks are really 0,1,2,3...

I was thinking there must be a signature in the hex code somewhere that shows what disk is what.

Maybe I should try to rebuild them in R-Studio instead ?

 

[slingshot]

Jared to the rescue

Tried to assemble the stripes 'only' (1 x RAID 0) based on what I think the 2 disks are and voila, UFS pro is now showing me 6 named partitions.

I think Im going to have to faff about though as these look messed up, will need to look at the other stripe too and also swap the 3rd disk into each stripe and see which gives the best results overall but this is moving in the right direction

 

[Jared]

Happy to help

R-Studio is usually easier to work with when it's a file system that it supports. I like how R-Studio allows you to play around with RAID settings on the fly and see the results.

Plus R-Studio has the tab to see all files listed by date. So you can try it each way with each set of different pairs and see which one has the most recent files that actually open.

 

[slingshot]

Thanks Jared, I'm going to have a play around with the R-Studio way of doing it so I can get to grips with it.

Quick question to you, if this was a 16 disk RAID 10 array, is the principle the same ? 8 disks would be 1 stripe and 8 would be the mirror, so you would just work with which set of 8 disks gave the best result ?

 

[Jared]

Yeah, I pretty much always build RAID 10 as a RAID 0. The first step (after cloning all the disks) is usually to figure out which drives likely were the offline ones. A quick check of the S.M.A.R.T. info will usually tell you which ones were the problem disks. Next, you find out which drives were the failed rebuild attempt replacement drives and just omit them completely from your efforts as they'll only have partial data at best.

Typically on a large array like 16 drives, you'll have two or three that are bad. RAID 10 pretty much is always two mirrors of each stripe. So I just pair them all up and use one from each pairing to figure out the RAID 0. Then it's just a matter of figuring out which of the drives with S.M.A.R.T. pending or reallocated sectors might be out of sync. In R-Studio this is quite easy. Just sort all files by date and look at some of the latest files. When you're finding files that won't open and are recent, use the hex editor to see what drive the sectors are on. Especially if they are zeros, that drive was most likely offline when the file was created so you can swap it for its mirror and re-check the same files.

 

[Jared]

I hope you don't mind, but I'm moving this topic to the RAID Recovery Form.

 

[slingshot]

Thats clever, I like that trick with the hex editor and offline drives, swapping for the mirror

Ive not used R-Studio to do a virtual raid build yet, so Ive got a steep learning curve on this one, but you've given me a lot to take in and to practice. I also see R-Studio auto detects the RAID array type as well, I did wonder how its possible to identify the RAID flavour if you've got no info from box / customer to work from. I guessed there must be something in a sector, that could be read from hex, enabling the solving of these types of problems and thats how drive order / raid flavour problems were ultimately solved.

 

[slingshot]

R-Studio

Very pleased, data is mostly corrupted, but I think once one of the drives is swapped with one of the other mirrors, it will yield a result.

Once again many thanks Jared, certainly learned something new today