RAID 10 Partition Recovery: Only A Partial File Structure Found in Partition (SOLVED)

[Darkphox]

Hi folks,

I’m hoping for help finding a lost RAID partition. This was a software RAID 10 built with 4x 3TB drives using IRST on an ICH10R (Intel X58) controller.

I don’t know how, but when I installed a new video card in our home server, the BIOS reset and I lost the configuration. It was file storage only, no OS. I disconnected the RAID drives, reinstalled windows on my C: drive, and recreated the raid via CTRL+I with the same settings it originally had. I have not written to the drive, initialized it, or formatted it. Windows shows it as “unallocated” with no drive letter in disk manager.

I ran TestDisk and it shows me the current partition structure: I’m guessing it’s showing redundant partitions because of the ‘mirror’ part of the RAID 10.


I was initially hopeful as the quick search looks like it found the old partition (Serverphox). However, when I view files, it’s a very partial list. I had about 3TB of files organized into top level folders named 01 through 13. It only found one of these folders, “04.” I view the file list, and copied them, but they are all corrupted and don’t actually open.



I ran Deep Scan, which took a touch over 48 hours to complete. This found a Linux filesystem, which seems like a fluke since I’ve never used Linux. It also lists several new partitions under “MS Data.”



Here, Serverphox is listed again, but there’s a new one before it with very close start/end blocks. When I tried to view its files, I get “can’t open filesystem. Filesystem seems damaged.”


I checked the log, but I can't really tell if anything looks wrong. My log is as follows:

Code: Select all

Sun Sep 16 21:53:11 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, June 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001180803072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001180803072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - INTEL SSDSA2CW120G3, S/N:CVPR108600X3120LGN, FW:4PC1
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729602 255 63, sector size=512 - Intel Raid 1 Volume, S/N:Volume0, FW:1.0.

Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 1 Volume
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729602 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 11721056255)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
check_part_gpt failed for partition
 2 P MS Data                   264192 5860532223 5860268032 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 2 P MS Data                   264192 5860532223 5860268032 [Basic data partition]
 2 P MS Data                   264192 5860532223 5860268032 [Basic data partition]

search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729602 255 63
NTFS at 16/115/36
filesystem size           11720790016
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=135331840, part_size=6001044488192, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/115/36
filesystem size           11720790016
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264320 11721054335 11720790016 [ServerPhox]
     NTFS, blocksize=4096, 6001 GB / 5588 GiB
file_pread(5,2,buffer,11721056384(729602/4/3)) lseek err Invalid argument

That last line, “lseek err Invalid argument” repeats for over 5000 lines! It is interspersed with the occasional
“file_pread(5,1,buffer,11721056256(729602/2/1)) ReadFile The drive cannot find the sector requested.”
Going back to the log where those 5000 lines leave off...

Code: Select all

Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729602 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (6001 GB / 5589 GiB) seems too small! (< 6365938 TB / 5789787 TiB)
The following partitions can't be recovered:
     Linux filesys. data   7200971772 12433474407516178 12433467206544406 [>
]
     btrfs blocksize=1769366884 Backup superblock, 6365935 TB / 5789784 TiB
     MS Data               11721054079 23441844094 11720790016
     NTFS, blocksize=4096, 6001 GB / 5588 GiB

Results
     MS Data                   264064 11721054079 11720790016
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
     MS Data                   264320 11721054335 11720790016 [ServerPhox]
     NTFS, blocksize=4096, 6001 GB / 5588 GiB
     MS Data               1082367060 1082369939       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     MS Data               1084261752 1084264631       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     MS Data               1084265547 1084271720       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
     MS Data               1084271720 1084277893       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
     EFI System            1090330072 1090332951       2880 [EFI System Partition] [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     EFI System            1090332696 1090335575       2880 [EFI System Partition] [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     Linux filesys. data   4296681186 4302703206    6022021 [Ł (نkᬃ􂲰=]
     cramfs, 3083 MB / 2940 MiB
     Linux filesys. data   4296681187 4302703207    6022021 [Ł (نkᬃ􂲰=]
     cramfs, 3083 MB / 2940 MiB
     Mac HFS               5526065958 5613523751   87457794 [ t@(نkᬃ􂲰=]
     HFS found using backup sector!, 44 GB / 41 GiB
     Mac HFS               5613523748 5700981541   87457794 [ t@(نkᬃ􂲰=]
     HFS blocksize=16777216, 44 GB / 41 GiB
     Linux filesys. data   7258176162 7258241697      65536
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 33 MB / 32 MiB
     Linux filesys. data   7258177234 7258242769      65536
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 33 MB / 32 MiB
     Linux filesys. data   7258177258 7258242793      65536
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 33 MB / 32 MiB
     Linux filesys. data   7258177498 7258243033      65536
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 33 MB / 32 MiB
     Mac HFS               7386725821 7868875198  482149378 [lobalMove01/joints01/bn_spA#Ɋ��     HFS found using backup sector!, 246 GB / 229 GiB
     Mac HFS               7868875195 8351024572  482149378 [lobalMove01/joints01/bn_spA#Ɋ��     HFS blocksize=33554432, 246 GB / 229 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

     MS Data                   264064 11721054079 11720790016
     NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=5
     MS Data                   264320 11721054335 11720790016 [ServerPhox]
     NTFS, blocksize=4096, 6001 GB / 5588 GiB
ntfs_readdir failed for cluster 5: Input/output error
Directory /
       5 dr-xr-xr-x     0      0         0 12-Sep-2018 21:50 .
       5 dr-xr-xr-x     0      0         0 12-Sep-2018 21:50 ..
    1186 dr-xr-xr-x     0      0         0 17-Jul-2018 16:45 04-Documents

dir_partition inode=1186
     MS Data                   264320 11721054335 11720790016 [ServerPhox]
     NTFS, blocksize=4096, 6001 GB / 5588 GiB
ntfs_readdir failed for cluster 1186: Input/output error
Directory /04-Documents
    1186 dr-xr-xr-x     0      0         0 17-Jul-2018 16:45 .
       5 dr-xr-xr-x     0      0         0 12-Sep-2018 21:50 ..
    1571 dr-xr-xr-x     0      0         0 28-Jan-2018 18:10 10 - BATFE
ntfs_readdir failed for cluster 1571: Input/output error
ntfs_readdir BUG not MFT_RECORD_IS_DIRECTORY
Can't create file /Recovery/04-Documents/10 - BATFE/20160801_Moving to VA: Is a directory
ntfs_readdir failed for cluster 5: Input/output error
Directory /
       5 dr-xr-xr-x     0      0         0 12-Sep-2018 21:50 .
       5 dr-xr-xr-x     0      0         0 12-Sep-2018 21:50 ..
    1186 dr-xr-xr-x     0      0         0 17-Jul-2018 16:45 04-Documents

interface_write()
 
No partition found or selected for recovery
simulate write!
Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 1 Volume
Partition table type: EFI GPT

TestDisk exited normally.

I ran photorec to see what it would give me, and it gives partial files. MPEG’s don’t play, and jpeg’s have weird scan-like appearance.

I’m not sure what to try at this point. I was fairly certain I reconnected the drives in the correct order, but maybe I didn’t? I thought maybe my geometry was off, but I’m not sure how to tell if it is, or by how much. I appreciate any assistance or suggestions. This had a lot of family pics that I didn’t get a chance to backup yet, so I’m trying to be optimistic. There’s a lot on this RAID that I don’t necessarily care about, but I’ll definitely send a donation if I can get the important stuff back.

Thanks,
-Phox

[cgrenier]

I think the Raid10 setup or the disk order is wrong, otherwise 99% of the files recovered by PhotoRec would be OK.

[Darkphox]

Thank you for the quick response. I'll try switching the disk order when I get home tonight. I used colored SATA cables (black on top, red on bottom), so there's only 3 other ways I could have had them plugged in. Should make it fairly easy to see if disk order is the culprit.

Two quick, and probably stupid questions:

1. Before running Testdisk again, do I need to drop the member disks and re-create the raid again via the CTRL+I interface after I switch the order of the disk- motherboard connections? Or, will Testdisk see the new order with the existing RAID configuration?

2. In the event it's NOT the disk order, and my RAID setup is wrong, I'll have to try different configuration settings. Is there any long term danger posed to the old data by repeatedly dropping the member disks and recreating the raid via CTRL+I?

I'm trying to work this slowly and deliberately so I don't make any unnecessary mistakes. Again, I really appreciate your help!

Thanks again,
Phox

[cgrenier]

A wrong order on a raid 10 is dangerous if the disks are resynchronized.
The safest method to deal with this problem is probably to create a disk image of each disk and try software reassembly of 2 disk images (raid 10 = raid 1+0, it's two raid 1). Under Linux, it's probably possible to use ddrescue, losetup, mdadm and/or dmraid to try the various combinations but these commands are not easy to use...
Maybe http://www.freeraidrecovery.com/ may help, another user has recommended it.

[Darkphox]

Thanks, CG. I've reached the point of Great Success!


My disks were connected with 2 black sata cables on the top row, and 2 red sata cables on the bottom row. I swapped the bottom row cables first, dropped the RAID10 via the bios setup interface (CTRL+I), recreated the array, and ran Testdisk again. Originally, I was only seeing one folder out of 13 in my top-level structure. After this swap, I was seeing all 13 folders! The order still wasn't right though, as I was getting a "file structure seems corrupt" message when I tried to open a folder. I'm guessing I had the top row backwards as well, but I saw the other post you referenced, and took your suggestion to try ReclaiMe. This found the correct drive order and allowed me to write the array onto another disk.

It took another 36 hours to complete, but as of this morning I have the ENTIRE ARRAY back! I appreciate your help and patience as I worked through this. I've sent a donation through paypal. Thanks again!