Page 2 of 4

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 13 May 2015, 07:23
by berndms
Hi Fiona,

thanks!

Apparently, if I understood correctly, before proceeding with testdisk, the RAID needs to be mounted.

Thus, I have opened a ticket at the QNAP helpline now to see if they have a solution for re-building the RAID according to your description. Just saw that you are living in my area, so I should have used the German forum instead ;-)

Bernd

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 13 May 2015, 07:58
by berndms
Fiona, just one short question for my clarification:

the log shows this entry, which also was part of the search for superblocks:

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
MS Data 1945734 17574131333 17572185600
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=1945734, size=17572185600, end=17574131333, disk end=5860533168)

Doesn't this indicate that the original RAID-5 was ext4-fs with a size of 8.996GB, but due to a corrupted superblock at the beginning the system is not able to mount it as such?

Just wondering because you said that I should NOT run fsck to restore superblock.

Is it of any help if I run testdisk - Analyze on the other 3 disks as well?

Thanks
bernd

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 13 May 2015, 08:43
by Fiona
Is it of any help if I run testdisk - Analyze on the other 3 disks as well?
Nope, it doesn't help at all.
Apparently, if I understood correctly, before proceeding with testdisk, the RAID needs to be mounted.
Yes, before you start any datarecovery using testdisk and datarecovery software also, your RAID must be mounted.
MS Data 1945734 17574131333 17572185600
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=1945734, size=17572185600, end=17574131333, disk end=5860533168)
Yes it looks like that your file system is ext4!
Doesn't this indicate that the original RAID-5 was ext4-fs with a size of 8.996GB, but due to a corrupted superblock at the beginning the system is not able to mount it as such?
Your RAID should be listetd with full size.
It means in TestDisk at the disk selection menu, you must select your RAID with full size.
The next menu would be partition table type and should be GPT.
The menu analyse displays your current partition table.
If testdisk finds your correct partition running Quick Search it will be displayed for recovery.
Each partition found by a superblok or its backup should be marked and you should press p on your keyboard to have a try to list your files.
If your files are listed, you can write this partition into your GUID partition table.
The menu Write will only write/register your found partition into your GUID partition table.
Now it's coming up the next!
If your superblock is damaged your partition would be available but appears as RAW (unformatted).
If your superblock is damaged you should run fsck.
But it's a little bit too early to judge as long as you have no RAID.
Typically message if you select only a 3TB disk is:
This partition ends after the disk limits. (start=1945734, size=17572185600, end=17574131333, disk end=5860533168)
I've seen some cases after a correct rebuilding of a degraded RAID and if the partition table, the boot sector or superblock and the file system were Ok, data were immediately available.
So datarecovery was not necessary.

Fiona

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 13 May 2015, 09:10
by berndms
Hi Fiona,

thanks for all those details. It is a little of a catch 22 that QNAP very likely needs some info hidden on the harddisks to setup a (the) RAID, and testdisk needs the RAID to proceed...

Hope that I will receive some usable info from QNAP soon.

Thanks
Bernd

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 13 May 2015, 09:28
by Fiona
I've aleady seen some cases that metadata (hidden) were copied at the beginning of a disk.
His name is ernst@at and I've not seen something from him since years.
Google, his name and RAID might help?
It's in german! ;)

Fiona

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 13 May 2015, 10:26
by berndms
Thanks again, I will give it a try then!
Bernd

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 15 May 2015, 05:52
by SHaran
I did a recovery on the same NAS, QNAP TS-439. This model uses Linux Software RAID (mdadm).

First thing I would try is an mdadm --examine on partition 3 of each drive. It should show the chunk size is 64 and the metadata version is 0.90. If so and the Event counts match on at least 3 drives then you should be able to assemble the RAID5 and get at your data.

Note the mdadm 0.90 superblock is at the end of the partition. You can see it with a hex editor.

Testdisk is great but you need to get the RAID assembled before it can help you. And with luck you won't need it if you are able to mount your data volume.

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 15 May 2015, 07:59
by berndms
Thanks for your input!
I will for sure try it: have reserved the weekend for recovery activities. I will let you know if it worked.
Note the mdadm 0.90 superblock is at the end of the partition. You can see it with a hex editor.
Is the superblock somehow marked that I can identify it using the hex editor?

Thanks
Bernd

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 15 May 2015, 15:59
by SHaran
From my notes about the case I worked on the superblock started at hex location 0x2BAA0A09000 it begins with the mdadm magic number FC4E2BA9

It's not human readable so see... https://raid.wiki.kernel.org/index.php/ ... ck_formats

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

Posted: 16 May 2015, 11:07
by berndms
Hi, apologizing for my stupidity, but I ran into a problem here:
as partition 3 of any of my drives is not marked anymore as a valid partition (testdisk output)
Current partition structure:
1 P MS Data 40 1060289 1060250 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 1060296 2120579 1060284 [primary]
2 P MS Data 1060296 2120579 1060284 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 2120584 5859515969 5857395386 [primary]
3 P MS Data 2120584 5859515969 5857395386 [primary]
4 P MS Data 5859515976 5860511999 996024 [primary]
using "mdadm --examine" refuses to work and tells me that there are no devices to examine.
I searched but I could not find a way to point mdadm to partition 3 directly.

I do not want to run too many experiments here, in fact, I will sector-copy all disks before continuing, but is there a way to get mdadm working the way you had described before?

Thanks
Bernd