Page 1 of 1

Semi-destroyed raid0

Posted: 29 Dec 2020, 00:13
by Pinni777
hi cgsecurity team,I'm kindly asking for your help about my situation.
silly me,i made a 2-3 distracted clicks on my hypervisor (proxmox) interface and practically unhooked a disk (/dev/sdd) from an array [raid0] clicking "initialize this disk with gpt".
This array was composed by 3 disk of 1Tb each for a total of 3 Tb space volume.Those disk were passed through to the vm,so we can act and speak as I am on a real physical machine (in fact I'm operating locally with monitor and keyboard).
Now, immediately realized my mistake, obviously the array is gone.

/proc/mdstat and various utilities always show /dev/sde and /dev/sdg (the other 2 disks) fine and ok,but missing /dev/sdd ,the array is clearly marked as inactive.
fired up testdisk,the quick search immediately found with the correct size,label,ecc my /dev/sdd partition but i can't restore it cause like testdisk says hdd is too small (3Tb vs 1Tb hdd).
at this point I'm stuck,and kindly ask for your help and experience.
side note:i can't - -assemble a new array to try the recover, cause mdadm says /dev/sdd disk hasn't a valid mbr/can't_recall_exactly_what...

Re: Semi-destroyed raid0

Posted: 29 Dec 2020, 11:47
by recuperation
As you were running a 3TB drive composed out of 3 1TB drives in a Raid configuration running Testdisk on that accidentally overwritten drive won't help you directly, Testdisk rather operates a level above hardware or software RAID despite the hint given in point 5 below.

It appears that you would need to set your missing disk back to a MBR style configuration.

I don't have experience with raid configurations!
This is what i would do:

1. Backup the dropped sdd drive
2. Backup the partition structure of sdd using Testdisk
3. Look up the configuration files how the raid management enumerates the drives in question.
4. Compare the first sectors of the two remaining drives.
4. Overwrite the GPT (zeroing) (and if necessary its backup at the end of the disk)
5. Run Testdisk on sdd in MBR mode and let Testdisk rewrite the MBR partition table including the found partition.
6. Adapt id information either in the configuration files or on the disk for reintegration of the dropped drive.

To practice that scenario safely, use a isolated machine with just one drive, connect three empty drives and configure them as Raid0. Maybe three USB sticks work as well if you don't have regular disc drives. Fill them up with some data using windows h2testw or linux f3.

Now repeat your configuration error.
Start to practice using the recipe above.
If you succeed run the recipe on your real case.
If you fail contact a professional recovery service.

I don't know if there is software around that automatically repairs this kind of dammage.

Re: Semi-destroyed raid0

Posted: 29 Dec 2020, 14:27
by Pinni777
thanks a lot, recuperation, for your answer!
now, will plan what to do next.
in the mean time,i attach some screens of the situation
after disk selection,autodetected intel partition type (please note chs and lba don't match) also note the erroneous gpt from my mistake in proxmox
after disk selection,autodetected intel partition type (please note chs and lba don't match) also note the erroneous gpt from my mistake in proxmox
testdisk post disk selection.jpg (112.01 KiB) Viewed 668 times
instantly found what i think is the correct partition (there was only this one on the disk, part 1 of 3 of the raid0 ) note the VERY CORRECT label detected and partition type [in fact it's ext4]
instantly found what i think is the correct partition (there was only this one on the disk, part 1 of 3 of the raid0 ) note the VERY CORRECT label detected and partition type [in fact it's ext4]
testdisk immediately after quick search started.jpg (121 KiB) Viewed 668 times

Re: Semi-destroyed raid0

Posted: 29 Dec 2020, 15:23
by Pinni777
Quick search finished

and this is the results...it found another 3 partitions...
i move the selector down for you to note the sparse_SB recover that in the first partition is NOT present but in the last 3 yes
i move the selector down for you to note the sparse_SB recover that in the first partition is NOT present but in the last 3 yes
after quick search finished.jpg (96.73 KiB) Viewed 657 times

i'm starting to think that, since this problematic disk is PROBABLY the first of the array , it contains the entire allocation table of all 3 disk of the array and consequently testdisk says "you can't restore 3000Gb in a 1000Gb disk"?? makes sense to me...
i'm in your hands now,cause my experience is not enugh to proceed

Re: Semi-destroyed raid0

Posted: 30 Dec 2020, 16:03
by Pinni777
so,another 3 pics for better helping others helping me:
here's the sde disk
sde_quick_scan.jpg
sde_quick_scan.jpg (94.54 KiB) Viewed 619 times
here's the sdf disk
sdf_quick _scan.jpg
sdf_quick _scan.jpg (86.94 KiB) Viewed 619 times
and here is also the same sdf disk with correct identification linux md 1.x raid and values 0 and 8 that honestly i can't understand
sdf_struct_ok_zeros_and_eights.jpg
sdf_struct_ok_zeros_and_eights.jpg (89.65 KiB) Viewed 619 times
once again please help

Re: Semi-destroyed raid0

Posted: 01 Jan 2021, 18:04
by Pinni777
any help,plese?

Re: Semi-destroyed raid0

Posted: 09 Jan 2021, 23:47
by Pinni777
anyone can help?

Re: Semi-destroyed raid0

Posted: 10 Jan 2021, 14:09
by recuperation
Although your question is not a Testdisk related question you were given some ideas how to solve the situation. I cannot repair your setup for you. You either understand the ideas given and are able to work yourself or you have to pay a professional recovery company.

As it seems that you complete ignore my hints you probably don't understand them so you will have to bite the bullet.