I’m hoping for help finding a lost RAID partition. This was a software RAID 10 built with 4x 3TB drives using IRST on an ICH10R (Intel X58) controller.
I don’t know how, but when I installed a new video card in our home server, the BIOS reset and I lost the configuration. It was file storage only, no OS. I disconnected the RAID drives, reinstalled windows on my C: drive, and recreated the raid via CTRL+I with the same settings it originally had. I have not written to the drive, initialized it, or formatted it. Windows shows it as “unallocated” with no drive letter in disk manager.
I ran TestDisk and it shows me the current partition structure: I’m guessing it’s showing redundant partitions because of the ‘mirror’ part of the RAID 10.
I was initially hopeful as the quick search looks like it found the old partition (Serverphox). However, when I view files, it’s a very partial list. I had about 3TB of files organized into top level folders named 01 through 13. It only found one of these folders, “04.” I view the file list, and copied them, but they are all corrupted and don’t actually open.
I ran Deep Scan, which took a touch over 48 hours to complete. This found a Linux filesystem, which seems like a fluke since I’ve never used Linux. It also lists several new partitions under “MS Data.”
Here, Serverphox is listed again, but there’s a new one before it with very close start/end blocks. When I tried to view its files, I get “can’t open filesystem. Filesystem seems damaged.”
I checked the log, but I can't really tell if anything looks wrong. My log is as follows:
Code: Select all
Sun Sep 16 21:53:11 2018
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, June 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001180803072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001180803072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - INTEL SSDSA2CW120G3, S/N:CVPR108600X3120LGN, FW:4PC1
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729602 255 63, sector size=512 - Intel Raid 1 Volume, S/N:Volume0, FW:1.0.
Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 1 Volume
Partition table type: EFI GPT
Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729602 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 11721056255)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729602 255 63
NTFS at 16/115/36
filesystem size 11720790016
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=135331840, part_size=6001044488192, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/115/36
filesystem size 11720790016
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264320 11721054335 11720790016 [ServerPhox]
NTFS, blocksize=4096, 6001 GB / 5588 GiB
file_pread(5,2,buffer,11721056384(729602/4/3)) lseek err Invalid argument
“file_pread(5,1,buffer,11721056256(729602/2/1)) ReadFile The drive cannot find the sector requested.”
Going back to the log where those 5000 lines leave off...
Code: Select all
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729602 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (6001 GB / 5589 GiB) seems too small! (< 6365938 TB / 5789787 TiB)
The following partitions can't be recovered:
Linux filesys. data 7200971772 12433474407516178 12433467206544406 [>
]
btrfs blocksize=1769366884 Backup superblock, 6365935 TB / 5789784 TiB
MS Data 11721054079 23441844094 11720790016
NTFS, blocksize=4096, 6001 GB / 5588 GiB
Results
MS Data 264064 11721054079 11720790016
NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
MS Data 264320 11721054335 11720790016 [ServerPhox]
NTFS, blocksize=4096, 6001 GB / 5588 GiB
MS Data 1082367060 1082369939 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
MS Data 1084261752 1084264631 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
MS Data 1084265547 1084271720 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
MS Data 1084271720 1084277893 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
EFI System 1090330072 1090332951 2880 [EFI System Partition] [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
EFI System 1090332696 1090335575 2880 [EFI System Partition] [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
Linux filesys. data 4296681186 4302703206 6022021 [Ł (نkᬃ=]
cramfs, 3083 MB / 2940 MiB
Linux filesys. data 4296681187 4302703207 6022021 [Ł (نkᬃ=]
cramfs, 3083 MB / 2940 MiB
Mac HFS 5526065958 5613523751 87457794 [ t@(نkᬃ=]
HFS found using backup sector!, 44 GB / 41 GiB
Mac HFS 5613523748 5700981541 87457794 [ t@(نkᬃ=]
HFS blocksize=16777216, 44 GB / 41 GiB
Linux filesys. data 7258176162 7258241697 65536
ext4 blocksize=4096 Large_file Sparse_SB Recover, 33 MB / 32 MiB
Linux filesys. data 7258177234 7258242769 65536
ext4 blocksize=4096 Large_file Sparse_SB Recover, 33 MB / 32 MiB
Linux filesys. data 7258177258 7258242793 65536
ext4 blocksize=4096 Large_file Sparse_SB Recover, 33 MB / 32 MiB
Linux filesys. data 7258177498 7258243033 65536
ext4 blocksize=4096 Large_file Sparse_SB Recover, 33 MB / 32 MiB
Mac HFS 7386725821 7868875198 482149378 [lobalMove01/joints01/bn_spA#Ɋ�� HFS found using backup sector!, 246 GB / 229 GiB
Mac HFS 7868875195 8351024572 482149378 [lobalMove01/joints01/bn_spA#Ɋ�� HFS blocksize=33554432, 246 GB / 229 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
MS Data 264064 11721054079 11720790016
NTFS found using backup sector, blocksize=4096, 6001 GB / 5588 GiB
Can't open filesystem. Filesystem seems damaged.
dir_partition inode=5
MS Data 264320 11721054335 11720790016 [ServerPhox]
NTFS, blocksize=4096, 6001 GB / 5588 GiB
ntfs_readdir failed for cluster 5: Input/output error
Directory /
5 dr-xr-xr-x 0 0 0 12-Sep-2018 21:50 .
5 dr-xr-xr-x 0 0 0 12-Sep-2018 21:50 ..
1186 dr-xr-xr-x 0 0 0 17-Jul-2018 16:45 04-Documents
dir_partition inode=1186
MS Data 264320 11721054335 11720790016 [ServerPhox]
NTFS, blocksize=4096, 6001 GB / 5588 GiB
ntfs_readdir failed for cluster 1186: Input/output error
Directory /04-Documents
1186 dr-xr-xr-x 0 0 0 17-Jul-2018 16:45 .
5 dr-xr-xr-x 0 0 0 12-Sep-2018 21:50 ..
1571 dr-xr-xr-x 0 0 0 28-Jan-2018 18:10 10 - BATFE
ntfs_readdir failed for cluster 1571: Input/output error
ntfs_readdir BUG not MFT_RECORD_IS_DIRECTORY
Can't create file /Recovery/04-Documents/10 - BATFE/20160801_Moving to VA: Is a directory
ntfs_readdir failed for cluster 5: Input/output error
Directory /
5 dr-xr-xr-x 0 0 0 12-Sep-2018 21:50 .
5 dr-xr-xr-x 0 0 0 12-Sep-2018 21:50 ..
1186 dr-xr-xr-x 0 0 0 17-Jul-2018 16:45 04-Documents
interface_write()
No partition found or selected for recovery
simulate write!
Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 1 Volume
Partition table type: EFI GPT
TestDisk exited normally.
I’m not sure what to try at this point. I was fairly certain I reconnected the drives in the correct order, but maybe I didn’t? I thought maybe my geometry was off, but I’m not sure how to tell if it is, or by how much. I appreciate any assistance or suggestions. This had a lot of family pics that I didn’t get a chance to backup yet, so I’m trying to be optimistic. There’s a lot on this RAID that I don’t necessarily care about, but I’ll definitely send a donation if I can get the important stuff back.
Thanks,
-Phox