4 HDD RAID0 issue

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
BrokeRAID
Posts: 6
Joined: 11 Feb 2013, 06:50

4 HDD RAID0 issue

#1 Post by BrokeRAID »

I have a RAID0 set with 4 hard drives, all 1TB in size. Yesterday one of the drives fell out of the RAID set and became a non-member of the array. I found instructions online suggesting to move the remaining drives to non-members, then recreate the entire RAID array. So that is what I did followed by running TestDisk.

Steps taken:
* switch remaining 3 drives to non-members (did NOT delete RAID)
* recreated RAID0 array with all 4 drives, using same array name and stripe size (128kb)
* booted into Windows
* did NOT initialize the RAID drive or format or anything
* ran TestDisk 6.14-WIP 32bit

The RAID0 array is a non booting array that was holding non OS data.

My issue is I get the "The harddisk seems too small" problem and can't figure out how to fix it. If I increase the cylinders so that TestDisk thinks the drive is larger, then it acts like it can restore the partition but when I go to view the files "Option P" it lists nothing.

Here's a clean log:

Code: Select all

Sun Feb 10 21:34:44 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.6, Cygwin 1007.17
Compilation date: 2013-01-06T21:07:12
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000762036224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000762036224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=63887638528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=119898374144
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 Series, S/N:S14GNEACB81560J, FW:DXT06B0Q
Disk /dev/sdb - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - INTEL SSDSC2MH120A2, S/N:LNEL1202012V120CGN, FW:PPG4
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486398 255 63, sector size=512 - Intel Raid 0 Volume, S/N:MAIN, FW:1.0.
Disk /dev/sdd - 64 GB / 59 GiB - CHS 7783 255 63, sector size=512 - Kingston  SSDNow V Series, S/N:06J9A0037585, FW:B090

Partition table type default to EFI GPT
Disk /dev/sdc - 4000 GB / 3726 GiB - Intel Raid 0 Volume
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486398 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7974424575 (expected 7813988351)
hdr_lba_start=4261871650
hdr_lba_end=16141957733209346014
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Bad GPT partition, invalid header checksum.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid header checksum.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486398 255 63
NTFS at 16/121/42
filesystem size           7813814272
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264704 7814078975 7813814272 [Main]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
This partition ends after the disk limits. (start=264704, size=3518846976, end=3519111679, disk end=3519021056)
Search for partition aborted
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486398 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (4000 GB / 3726 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
     MS Data                   264704 7814078975 7813814272 [Main]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

TestDisk exited normally.
Hope someone can help.
thanks!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: 4 HDD RAID0 issue

#2 Post by Fiona »

Only for diagnose purposes and as a trick you can try to repeat your diagnose using partition table type intel.
It's a try to get the CHS values from your partition and compare it to the values of your disk.
GPT-partitions are displayed in sectors.
But it doesn't match to a disk, because it's displayed in Cylinder (CHS - Cylinder, Head, sectors).
Hopefully your partition will be found using Intel CHS.
In some cases, it was possible to increase the amount of cylinder of your disk to get access to your data.
But don't use write and don't change anything to your current array.

Fiona

BrokeRAID
Posts: 6
Joined: 11 Feb 2013, 06:50

Re: 4 HDD RAID0 issue

#3 Post by BrokeRAID »

I tried with Intel type to and that didn't find anything, but I did find part of my problem.

First a little more information for those with the same problem.
This (4) HDD RAID0 array is from my previous motherboard which was also running Intel Raid. I thought I had installed it in this motherboard with the proper HDDs to SATA ports, but no. To find out the proper order I set all drives to Non-Member (again, not deleting the RAID) and ran ReclaiMe, which is an application that will read drives in an attempt to figure out the RAID signature. The output from ReclaiMe game me the proper order for the RAID array.

So I unplugged the drives and put them in the proper order, rebooted, recreated the RAID0 array giving it the same name as before, then ran TestDisk 6.14 32bit.

Now upon doing the Analyze I'm immediately greeted with the following:
screen1.PNG
screen1.PNG (15.36 KiB) Viewed 4567 times
If I continue with Quick Search after about 14% I get my MS Data [MAIN] partition pop up. If I stop before it's finished I then get the same error "The harddisk seems too small". So some progress but still not there.

Here's the log:

Code: Select all

Mon Feb 11 20:13:42 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.6, Cygwin 1007.17
Compilation date: 2013-01-06T21:07:12
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000762036224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000762036224

Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 Series, S/N:S14GNEACB81560J, FW:DXT06B0Q
Disk /dev/sdb - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - INTEL SSDSC2MH120A2, S/N:LNEL1202012V120CGN, FW:PPG4
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486398 255 63, sector size=512 - Intel Raid 0 Volume, S/N:MAIN, FW:1.0.

Partition table type (auto): EFI GPT
Disk /dev/sdc - 4000 GB / 3726 GiB - Intel Raid 0 Volume
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486398 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 7813988351)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 2 P MS Data                   264192 7814078463 7813814272 [Basic data partition] [Main]

search_part()
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486398 255 63
NTFS at 16/113/34
filesystem size           7813814272
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 7814078463 7813814272 [Main]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
This partition ends after the disk limits. (start=264192, size=3518846976, end=3519111167, disk end=3519021056)
Search for partition aborted
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486398 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (4000 GB / 3726 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
     MS Data                   264192 7814078463 7813814272 [Main]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

TestDisk exited normally.
If I run as Intel/PC (instead of GPT) then I get the same issue as before also:
Partition sector doesn't have the endmark 0xAA55
If I hit Quick Search it then continues on it finds a HPFS - NTFS partition but also states that "The harddisk seems too small."
screen2.PNG
screen2.PNG (14.69 KiB) Viewed 4567 times
Not sure what to do at this point.

Thanks!

BrokeRAID
Posts: 6
Joined: 11 Feb 2013, 06:50

Re: 4 HDD RAID0 issue

#4 Post by BrokeRAID »

Another quick update:

The cylinders show as 486398, but if I increase them to say 500000 then it doesn't throw the "harddisk too small" issue and I can list my files (with the 'P' option).

I've only done this as a test and have not written anything to the drive as I'm not sure what will happen if I increase the cylinders randomly like that.

NOTE: I have NOT done a deep scan; I'm not sure that it would help at this point since the partition can be found. It's just the geometry that seems wrong right now.

Thoughts?

Thanks!

BrokeRAID
Posts: 6
Joined: 11 Feb 2013, 06:50

Re: 4 HDD RAID0 issue

#5 Post by BrokeRAID »

Through the process of elimination I've found that changing cylinders to 486404 will work (an increase of 6 cylinders).

When I do this I can view all directories and files, and that the size values and descriptors seem correct.

Again, I have not written this to disk yet and have only done this as a test to see if I could actually read the partition/directories/files.

Should I write the partition with the changed geometry?

Thanks!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: 4 HDD RAID0 issue

#6 Post by Fiona »

If you list your data, the first thing to do might be to copy/backup your data using TestDisk.
At the bottom of the screen you'll find all the commands.
If you mark that two dots at the upper side of your list and press enter, you'll get one directory up.
You can repeat it as often until you get to your disk selection.
You can choose another intact disk or partition/folder where you can copy your files.
Navigating into a folder, using the right arrow key on your keyboard.
Afterwards, it might be possible to write your partition structur using Write.
Since Vista / Win7-8, windows allow to resize/decrease your partition using the disk management console.
Try to decrease your partition.

BrokeRAID
Posts: 6
Joined: 11 Feb 2013, 06:50

Re: 4 HDD RAID0 issue

#7 Post by BrokeRAID »

Currently copying the data over one main folder at a time.

I'll post back when it's all done.

Thank you Fiona.

BrokeRAID
Posts: 6
Joined: 11 Feb 2013, 06:50

Re: 4 HDD RAID0 issue

#8 Post by BrokeRAID »

So, the process took awhile but that was to be expected since I had a little over 3TB on the 4TB RAID0. The copy from TestDisk worked just fine after increasing the cylinders by 6. All data copied off and has been verified working. I attempted to write the partition after copying the data off, just to see if it would work and it didn't. Didn't matter though as TestDisk copying did the trick.

:)

Thank you very much for the assistance and the wonderful application.

Tschüss

Locked