QNAP TS-439 Pro II lost RAID-5-configuration / Filesystem

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
berndms
Posts: 16
Joined: 09 May 2015, 10:20
Location: Stuttgart, Germany

QNAP TS-439 Pro II lost RAID-5-configuration / Filesystem

#1 Post by berndms »

Hi all,
maybe somebody here has a good advice for me - any help appreciated, thanks!
And thanks for providing your tools and forum!

After rebooting, my NAS came up with an error LED flashing and an invitation to start the basic configurations of my "new" NAS. Nothing that you would like to see after a reboot :-(

I am running a QNAP TS-439 Pro II (intel, linux kernel) with 4x 3TB disks,
originally configured as RAID-level 5. Unfortunately I do not remember if original fs was ext3 or ext4...

All disks working, S.M.A.R.T. info ok.
QNAP so far was not able to help me, so I am looking for alternative solutions in parallel.

Linux System information gives me the following info, which is the same for any of the 4 drives
(here only the info for drive 1 is listed):

Code: Select all

HDD Information:
 
HDD1 - Model=Hitachi HDS723030ALA640                 , FwRev=MKAOA5C0, SerialNo=      MK0351YHGEKBAA
 
Model: Hitachi HDS723030ALA640 (scsi)
Disk /dev/sda: 3001GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End     Size    File system     Name     Flags
 1      20.5kB  543MB   543MB   ext3            primary
 2      543MB   1086MB  543MB   linux-swap(v1)  primary
 3      1086MB  3000GB  2999GB                  primary
 4      3000GB  3001GB  510MB   ext3            primary
To me, it looks as something has wiped out the filesystem entry for partition #3 (on each disk!), hopefully this and also the RAID-5-information can be restored. I did start testdisk on the system and it showed me the 4 drives, but there was no indication of anything pointing to a RAID-5-configuration (yet).

I am a familiar with computers, but definitely not on this level, so I would appreciate any advice on if or rather how to run testdisk find out if there is anything to save this situation. And yes, I do admit that I do not have a 100% backup of the data. Lesson learned!

Thanks a lot for your help
Bernd

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#2 Post by Fiona »

I did start testdisk on the system and it showed me the 4 drives, but there was no indication of anything pointing to a RAID-5-configuration (yet).
For datarecovery purposes, you'll need a consistent array and should be local accessible through USB etc.. and not as a network attached storage.
Can you access your NAS locally?
If you'd like to recreate your array identically:
I'm not as much experienced to copy RAID information to the startup of a disk.
Some of few RAID controller could run a safe erase if they suggest to initialize your array and will override all underlying data.
Please read your manual safely.
Don't format your array, it'll override your previous file system and makes partition recovery impossible.
Only datarecovery software can help after formatting?
Maybe with virtual RAID5 support.
Unfortunately I do not remember if original fs was ext3 or ext4...
TestDisk can search for partitions and detects the file system autmatically.
But 9 TB (the size of 1 disk will be due to parity of RAID5 not available) is a huge amount and will last ages to scan.
To speed up diagnose, if your partition would be still in your GUID partition table available, you could run testdisk / Advanced and Superblock to get Info to repair your file system using fsck.
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock
If testdisk finds your partition by a superblock or its backup, you could try to stop the scan and partitions should be listed.
Easily check them and press p to have a try to list your files.
If it isn't successful, you have to restart another scan to find more partitions using the backup of a superblock and have another try to list your files.

berndms
Posts: 16
Joined: 09 May 2015, 10:20
Location: Stuttgart, Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#3 Post by berndms »

Hi Fiona,
thanks for your suggestions!
I can access the system locally via SSH, and it runs on Linux.

Somehow the original RAID configuration was completely wiped, so the system is not able to mount the RAID-5 itself anymore. I have refused to run any initialization processes suggested by the system itself.

When I ran Quick Search on harddisk 1, it stopped at 62%, but I saw some info that it found "8.1 TB which does not fit the size of the disk", so I am a little confident that there is still something there that my help to find the old config.

I will follow your guidelines tomorrow and see if the superblocks can be found again.

Thanks so far,
Bernd

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#4 Post by Fiona »

When I ran Quick Search on harddisk 1, it stopped at 62%, but I saw some info that it found "8.1 TB which does not fit the size of the disk",
It's advisable to safe your testdisk.log file and create a screen shot in low resolution containing these data.

Fiona

berndms
Posts: 16
Joined: 09 May 2015, 10:20
Location: Stuttgart, Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#5 Post by berndms »

Fiona,

I will do this next time. The problem is that my NAS is creating a temp environment any time when it is powered up, so I am running testdisk through ssh on RAM only and all results are gone when the system is shut down again.

Just one question regarding the superblocks: are backups of those blocks only saved on harddisk #1, or may I be able to find also copies / backups on the other 3 disks that made up the original RAID-5?

Thanks
Bernd

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#6 Post by Fiona »

backup copies of the superblock are stored in block groups throughout the filesystem.
It's from my link above.
It means that you'll find backups of a superblock through your whole file system.

Fiona

berndms
Posts: 16
Joined: 09 May 2015, 10:20
Location: Stuttgart, Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#7 Post by berndms »

Dear Fiona,

following your advice, I have now looked for the superblocks which testdisk did find at position 0, 32768 and 98304 (this result was the same for searching on each of the 4 disks).

The size of the original RAID-5 was about 8.1 TB, fs ext3 or ext4. Looking at your log, ext4 seems to be the right one?
Before running fsck, do I have to re-create the original filesystem on the unnamed partitions?

I have attached the logfile, hoping you can find something that would get me one step further...

Thanks so much
Bernd

Logfile:

Code: Select all


Tue May 12 09:35:31 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.4.6 (#1 SMP Sat Nov 1 04:43:04 CST 2014) x86_64
Compiler: GCC 4.4
Compilation date: 2015-04-18T13:05:16
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.7
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       5860533168 sectors
/dev/sda: user_max   5860533168 sectors
/dev/sda: native_max 5860533168 sectors
/dev/sda: dco        5860533168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       5860533168 sectors
/dev/sdb: user_max   5860533168 sectors
/dev/sdb: native_max 5860533168 sectors
/dev/sdb: dco        5860533168 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size       5860533168 sectors
/dev/sdc: user_max   5860533168 sectors
/dev/sdc: native_max 5860533168 sectors
/dev/sdc: dco        5860533168 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       5860533168 sectors
/dev/sdd: user_max   5860533168 sectors
/dev/sdd: native_max 5860533168 sectors
/dev/sdd: dco        5860533168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/md0 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md1 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md10 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md11 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md12 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md2 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md3 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md4 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md5 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md6 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md7 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md8 - 0 B - CHS 1 2 4, sector size=512
Warning: can't get size for Disk /dev/md9 - 0 B - CHS 1 2 4, sector size=512
Hard disk list
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - Hitachi HDS723030ALA640, S/N:MK0351YHGEKBAA, FW:MKAOA5C0
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - Hitachi HDS723030ALA640, S/N:MK0331YHGLD64A, FW:MKAOA5C0
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - Hitachi HDS723030ALA640, S/N:MK0351YHGEKEGA, FW:MKAOA5C0
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - Hitachi HDS723030ALA640, S/N:MK0331YHGLSBHA, FW:MKAOA5C0
Disk /dev/sdx - 515 MB / 492 MiB - CHS 3936 8 32, sector size=512, S/N:911A610058928003, FW:PMAP

Partition table type (auto): EFI GPT
Disk /dev/sda - 3000 GB / 2794 GiB - Hitachi HDS723030ALA640
Partition table type: EFI GPT

Analyse Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Data                  1060296    2120579    1060284 [primary]
check_part_gpt failed for partition
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
Current partition structure:
 1 P MS Data                       40    1060289    1060250 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 2 P MS Data                  1060296    2120579    1060284 [primary]
 2 P MS Data                  1060296    2120579    1060284 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 4 P MS Data               5859515976 5860511999     996024 [primary]

search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=35/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
     MS Data                       40    1060135    1060096
     ext3 blocksize=4096 Large_file Sparse_SB, 542 MB / 517 MiB

Raid magic value at 65/252/36
Raid apparent size: 1060096 sectors
Raid chunk size: 0 bytes
md9 md 0.90.0 L.Endian Raid 1: devices 0(8,1)* 1(8,17) 2(8,33) 3(8,49)
     Linux Raid                    40    1060263    1060224 [md9]
     md 0.90.0 L.Endian Raid 1: devices 0(8,1)* 1(8,17) 2(8,33) 3(8,49), 542 MB / 517 MiB
     Linux Swap               1060288    1060303         16
     SWAP2 version 0, pagesize=8192, 8192 B

recover_EXT2: s_block_group_nr=0/67032, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                  2120584 17574306183 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=2120584, size=17572185600, end=17574306183, disk end=5860533168)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                  1945734 17574131333 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=1945734, size=17572185600, end=17574131333, disk end=5860533168)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                  1945736 17574131335 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=1945736, size=17572185600, end=17574131335, disk end=5860533168)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                  1596294 17573781893 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=1596294, size=17572185600, end=17573781893, disk end=5860533168)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                  1596296 17573781895 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=1596296, size=17572185600, end=17573781895, disk end=5860533168)

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                  1246726 17573432325 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=1246726, size=17572185600, end=17573432325, disk end=5860533168)

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                  1246728 17573432327 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=1246728, size=17572185600, end=17573432327, disk end=5860533168)

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                   897158 17573082757 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=897158, size=17572185600, end=17573082757, disk end=5860533168)

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                   897160 17573082759 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=897160, size=17572185600, end=17573082759, disk end=5860533168)

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                   547718 17572733317 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=547718, size=17572185600, end=17572733317, disk end=5860533168)

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/67032, s_mnt_count=22/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2196523200
recover_EXT2: part_size 17572185600
     MS Data                   547720 17572733319 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
This partition ends after the disk limits. (start=547720, size=17572185600, end=17572733319, disk end=5860533168)

block_group_nr 25

recover_EXT2: part_offset problem

block_group_nr 25

recover_EXT2: part_offset problem

block_group_nr 25

recover_EXT2: part_offset problem

block_group_nr 25

recover_EXT2: part_offset problem

block_group_nr 27

recover_EXT2: part_offset problem

block_group_nr 27

recover_EXT2: part_offset problem

block_group_nr 27

recover_EXT2: part_offset problem

block_group_nr 27

recover_EXT2: part_offset problem

block_group_nr 49

recover_EXT2: part_offset problem

block_group_nr 49

recover_EXT2: part_offset problem

block_group_nr 49

recover_EXT2: part_offset problem

block_group_nr 49

recover_EXT2: part_offset problem
NTFS at 491/194/4
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                  7893967    7900140       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 491/194/4
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                  7900140    7906313       6174
     NTFS, blocksize=512, 3161 KB / 3087 KiB

block_group_nr 81

recover_EXT2: part_offset problem

block_group_nr 81

recover_EXT2: part_offset problem

block_group_nr 81

recover_EXT2: part_offset problem

block_group_nr 81

recover_EXT2: part_offset problem

block_group_nr 125

recover_EXT2: part_offset problem

block_group_nr 125

recover_EXT2: part_offset problem

block_group_nr 125

recover_EXT2: part_offset problem

block_group_nr 125

recover_EXT2: part_offset problem

block_group_nr 243

recover_EXT2: part_offset problem

block_group_nr 243

recover_EXT2: part_offset problem

block_group_nr 243

recover_EXT2: part_offset problem

block_group_nr 243

recover_EXT2: part_offset problem

recover_EXT2: s_block_group_nr=0/2, s_mnt_count=25/31, s_blocks_per_group=32768, s_inodes_per_group=32704
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 98048
recover_EXT2: part_size 784384
     MS Data               5859515976 5860300359     784384
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 401 MB / 383 MiB
Search for partition aborted
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 8998 GB / 8380 GiB)
The following partitions can't be recovered:
     MS Data                   547718 17572733317 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                   547720 17572733319 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                   897158 17573082757 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                   897160 17573082759 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                  1246726 17573432325 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                  1246728 17573432327 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                  1596294 17573781893 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                  1596296 17573781895 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                  1945734 17574131333 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                  1945736 17574131335 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 8996 GB / 8379 GiB
     MS Data                  2120584 17574306183 17572185600
     ext4 blocksize=4096 Large_file Sparse_SB, 8996 GB / 8379 GiB

Results
     MS Data                       40    1060135    1060096
     ext3 blocksize=4096 Large_file Sparse_SB, 542 MB / 517 MiB
     Linux Raid                    40    1060263    1060224 [md9]
     md 0.90.0 L.Endian Raid 1: devices 0(8,1)* 1(8,17) 2(8,33) 3(8,49), 542 MB / 517 MiB
   P Linux Swap               1060288    1060303         16
     SWAP2 version 0, pagesize=8192, 8192 B
     MS Data                  7893967    7900140       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
     MS Data                  7900140    7906313       6174
     NTFS, blocksize=512, 3161 KB / 3087 KiB
   P MS Data               5859515976 5860300359     784384
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 401 MB / 383 MiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 1060096 linear /dev/sda 40" | dmsetup create test0
echo "0 1060224 linear /dev/sda 40" | dmsetup create test1
echo "0 16 linear /dev/sda 1060288" | dmsetup create test2
echo "0 6174 linear /dev/sda 7893967" | dmsetup create test3
echo "0 6174 linear /dev/sda 7900140" | dmsetup create test4
echo "0 784384 linear /dev/sda 5859515976" | dmsetup create test5

interface_write()
 1 P Linux Swap               1060288    1060303         16
 2 P MS Data               5859515976 5860300359     784384
simulate write!

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Data                  1060296    2120579    1060284 [primary]
check_part_gpt failed for partition
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 1 P MS Data                       40    1060289    1060250 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB, 542 MB / 517 MiB
 2 P MS Data                  1060296    2120579    1060284 [primary]
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 4 P MS Data               5859515976 5860511999     996024 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 509 MB / 486 MiB
search_superblock

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=35/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)
  MS Data                       40    1060135    1060096 [primary]
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext3 -p -b superblock -B blocksize device
Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB - Hitachi HDS723030ALA640
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Data                  1060296    2120579    1060284 [primary]
check_part_gpt failed for partition
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 1 P MS Data                       40    1060289    1060250 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB, 542 MB / 517 MiB
 2 P MS Data                  1060296    2120579    1060284 [primary]
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 4 P MS Data               5859515976 5860511999     996024 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 509 MB / 486 MiB
search_superblock

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=17/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)
  MS Data                       40    1060135    1060096 [primary]
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext3 -p -b superblock -B blocksize device
Partition table type (auto): EFI GPT
Disk /dev/sdc - 3000 GB / 2794 GiB - Hitachi HDS723030ALA640
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Data                  1060296    2120579    1060284 [primary]
check_part_gpt failed for partition
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 1 P MS Data                       40    1060289    1060250 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB, 542 MB / 517 MiB
 2 P MS Data                  1060296    2120579    1060284 [primary]
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 4 P MS Data               5859515976 5860511999     996024 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 509 MB / 486 MiB
search_superblock

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=17/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)
  MS Data                       40    1060135    1060096 [primary]
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext3 -p -b superblock -B blocksize device
Partition table type (auto): EFI GPT
Disk /dev/sdd - 3000 GB / 2794 GiB - Hitachi HDS723030ALA640
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Data                  1060296    2120579    1060284 [primary]
check_part_gpt failed for partition
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 1 P MS Data                       40    1060289    1060250 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB, 542 MB / 517 MiB
 2 P MS Data                  1060296    2120579    1060284 [primary]
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 4 P MS Data               5859515976 5860511999     996024 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 509 MB / 486 MiB
search_superblock

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=18/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)
  MS Data                       40    1060135    1060096 [primary]
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext3 -p -b superblock -B blocksize device
search_superblock

recover_EXT2: s_block_group_nr=0/2, s_mnt_count=25/31, s_blocks_per_group=32768, s_inodes_per_group=32704
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 98048
recover_EXT2: part_size 784384
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/2, s_mnt_count=0/31, s_blocks_per_group=32768, s_inodes_per_group=32704
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 98048
recover_EXT2: part_size 784384
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)
  MS Data               5859515976 5860300359     784384 [primary]
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext3 -p -b superblock -B blocksize device
search_superblock

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=18/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)
  MS Data                       40    1060135    1060096 [primary]
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext3 -p -b superblock -B blocksize device
Partition table type (auto): EFI GPT
Disk /dev/sda - 3000 GB / 2794 GiB - Hitachi HDS723030ALA640
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Data                  1060296    2120579    1060284 [primary]
check_part_gpt failed for partition
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 1 P MS Data                       40    1060289    1060250 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB, 542 MB / 517 MiB
 2 P MS Data                  1060296    2120579    1060284 [primary]
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
 4 P MS Data               5859515976 5860511999     996024 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 509 MB / 486 MiB
search_superblock

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=35/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)
  MS Data                       40    1060135    1060096 [primary]
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext3 -p -b superblock -B blocksize device


dir_partition inode=2
 1 P MS Data                       40    1060289    1060250 [primary]
     ext3 blocksize=4096 Large_file Sparse_SB, 542 MB / 517 MiB
Directory /
       2 drwxr-xr-x     0      0      4096 27-Mar-2015 06:27 .
       2 drwxr-xr-x     0      0      4096 27-Mar-2015 06:27 ..
      11 drwx------     0      0     16384  1-May-2010 04:19 lost+found
    6725 -rw-r--r--     0      0        28 27-Mar-2015 07:23 .conf
    6641 drwxr-xr-x     0      0      4096 24-Apr-2015 05:43 .config
   13281 drwxr-xr-x     0      0      4096 24-Apr-2015 05:43 .logs
   19921 drwxr-xr-x     0      0      4096  7-Jun-2013 06:58 .sqdatabase
   19923 drwxrwxrwx     0      0      4096  4-Sep-2010 22:18 .spool
    6833 lrwxrwxrwx     0      0        24 27-Mar-2015 06:27 twonkymedia
   13284 drwxr-xr-x     0      0      4096 27-Mar-2015 06:27 update_pkg
      14 drwxr-xr-x     0      0      4096  4-Feb-2015 06:42 update
   13323 drwxr-xr-x     0      0      4096 22-Nov-2014 16:02 twonky
      15 -rw-r--r--     0      0     41984 19-Sep-2013 06:45 ds.db
      16 lrwxrwxrwx     0      0        26 18-Aug-2011 23:00 .centerim
      17 -rw-rw-rw-    99      0         0 13-Jan-2013 14:46 photo_scan.record
      40 drwxr-xr-x     0      0      4096 22-Nov-2014 15:17 ssl_lib
      18 -rw-r--r--     0      0   1048576  7-Dec-2014 22:15 .hdhinfo
      19 drwxrwxrwx     0      0      4096 27-Mar-2015 06:26 .inited
X   6870 -rw-r--r--     0      0         0 24-Apr-2015 05:43 .conf.bak

TestDisk exited normally.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#8 Post by Fiona »

Thanks for your info reading the first disk of your previous array.
Backup of a superblock would be only important if your superblock is damaged.
In some cases, data were after partition recovery immediately available.
But before we jump to any conclusions, you should run a diagnose.
I've got an overview about your current partition table and some info about the resuslts reading your first disk.
If you'd like to recreate your array:
Your disks should be arranged in sequential order exactly like before.
Block size must fit too (I assume standard was used before?).
Don't initlalize and format your array.
It's also not important to create any partition because testdisk can search for.

Fiona

berndms
Posts: 16
Joined: 09 May 2015, 10:20
Location: Stuttgart, Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#9 Post by berndms »

Dear Fiona,
I do appreciate all the time you are spending with my case here, thanks a lot!

However, just to make sure: 'running a diagnose' you mean I should use the linux system tools like fsck, or something that is built into testdisk? As you know, so far I only used the 'Analyze' and 'Superblock search' functions of testdisk.

The disks are in sequential order as before, block size was set by the system during initial configuration.
Given the output of testdisk.log, the filesystem of the large partition was ext4, I assume?

Thank you very much for being a little bit more specific, that would help me a lot!

Best regards
Bernd

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: QNAP TS-439 Pro II lost RAID-5-configuration / Filesyste

#10 Post by Fiona »

Data are only extracted out of your first single disk and it has no significance to judge your complete situation.
fsck only if needed!
As described in this link:
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock
The most important thing is to get a functionally array exactly like before.
I've seen that your previous array is degraded or doesn't exist anymore.
But until yet I didn't run a datarecovery process through SSH or SSHFS.
Only your single disks are available:
Hard disk list
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - Hitachi HDS723030ALA640, S/N:MK0351YHGEKBAA, FW:MKAOA5C0
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - Hitachi HDS723030ALA640, S/N:MK0331YHGLD64A, FW:MKAOA5C0
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - Hitachi HDS723030ALA640, S/N:MK0351YHGEKEGA, FW:MKAOA5C0
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - Hitachi HDS723030ALA640, S/N:MK0331YHGLSBHA, FW:MKAOA5C0
Disk /dev/sdx - 515 MB / 492 MiB - CHS 3936 8 32, sector size=512, S/N:911A610058928003, FW:PMAP
Here is your current GUID partition table:
check_part_gpt failed for partition
2 P MS Data 1060296 2120579 1060284 [primary]
check_part_gpt failed for partition
3 P MS Data 2120584 5859515969 5857395386 [primary]
Current partition structure:
1 P MS Data 40 1060289 1060250 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 1060296 2120579 1060284 [primary]
2 P MS Data 1060296 2120579 1060284 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 2120584 5859515969 5857395386 [primary]
3 P MS Data 2120584 5859515969 5857395386 [primary]
4 P MS Data 5859515976 5860511999 996024 [primary]
Partitions which are appearing twice are indicating that there is probably a problem with a superblock?
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker /message related to that green colored partition
2 P MS Data 1060296 2120579 1060284 [primary]

2 P MS Data 1060296 2120579 1060284 [primary]
Your RAID5 before was about 8.1 TB and should be listet as a Disk or physically disk?
Initializing, partitioning and formatting should be avoided.
Your RAID5 must be a GPT disk.
Then you'd be able to run a diagnose using testdisk and normal datarecovery software.
Otherwise you'd need datarecovery software supporting virual RAID5

Fiona

Locked