HP Software RAID + TrueCrypt = RAW Filesystem

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Srv02
Posts: 2
Joined: 22 Apr 2014, 14:35

HP Software RAID + TrueCrypt = RAW Filesystem

#1 Post by Srv02 »

Hi!

My name is mike and I got a real big problem. Last week I rebooted my Windows 2008 R2 server and it didn't came up again!
Inside the HP Server there is a HP BL110i RAID controller with 4x500GB HDDs, which are configured as RAID 1+0. There is one big NTFS system partition on it which was encrypted with Truecrypt.

The system stucked at the TC bootloader which didn't accept my encryption password, so I restored the key file and the bootsector with the TC rescue CD, but it only said: "No bootable partitions".

I tried several linux live CDs to decrypt and readout the data, but unfortunately the HP controller is only a software RAID and linux recognizes the 4 disks standalone and not the array itself. Then I set up a USB Stick with a bootable Windows 8.1, decrypted the partition and ran TestDisk with "Rebuild BS" but it didn't work. Boot and backup boot sectors are still bad and not identical.

Then I decided to permanently decrypt the system partition which took me 5 days straight with the TC rescue CD. Then I restored the original boot loader, but this didn't work either.
After another unsuccessful Windows TestDisk run, I am more desperate than in the beginning, because Ontrack EasyRecovery and EaseUS Recovery also didn't find any useful data. The HP Array Configuration Utility says that the RAID works fine.

Great question: Is there ANYTHING I can further do? I really need some data which were not backuped recently.

Very kind regards,
mike

Log:

Code: Select all

Sun Apr 20 07:46:32 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000148590592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000148590592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255691063296
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121594 255 63, sector size=512 - HP LOGICAL VOLUME, FW:0.00
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - STT_FTM5 6GX25H, S/N:604098AFBC22

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - HP LOGICAL VOLUME
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686

ntfs_boot_sector
 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
filesystem size           9842347813354187942 6221075676106038802
sectors_per_cluster       10 157
mft_lcn                   3440782593 2195104735
mftmirr_lcn               2073577202 209705981
clusters_per_mft_record   56 75
clusters_per_index_record 41 -28
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Change partition type:
 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
Not an exFAT boot sector.

 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
Can't open filesystem. Filesystem seems damaged.

 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
filesystem size           9842347813354187942 6221075676106038802
sectors_per_cluster       10 157
mft_lcn                   3440782593 2195104735
mftmirr_lcn               2073577202 209705981
clusters_per_mft_record   56 75
clusters_per_index_record 41 -28
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
filesystem size           9842347813354187942 6221075676106038802
sectors_per_cluster       10 157
mft_lcn                   3440782593 2195104735
mftmirr_lcn               2073577202 209705981
clusters_per_mft_record   56 75
clusters_per_index_record 41 -28
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
filesystem size           9842347813354187942 6221075676106038802
sectors_per_cluster       10 157
mft_lcn                   3440782593 2195104735
mftmirr_lcn               2073577202 209705981
clusters_per_mft_record   56 75
clusters_per_index_record 41 -28
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.

 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
Can't open filesystem. Filesystem seems damaged.
Change partition type:
 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686

ntfs_boot_sector
 1 * HPFS - NTFS              0   1  1 121594  33 60 1953409686
filesystem size           9842347813354187942 6221075676106038802
sectors_per_cluster       10 157
mft_lcn                   3440782593 2195104735
mftmirr_lcn               2073577202 209705981
clusters_per_mft_record   56 75
clusters_per_index_record 41 -28
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Top
User avatar
cgrenier
Site Admin
Posts: 5438
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: HP Software RAID + TrueCrypt = RAW Filesystem

#2 Post by cgrenier »

Can you try PhotoRec ?
Running it 15 minutes, check the recovered files, do you get some of your files ?
If there is no file or only false positive/junk, there is probably a problem with the disk decryption, it's why all the disk utilities have failed.
Top
Srv02
Posts: 2
Joined: 22 Apr 2014, 14:35

Re: HP Software RAID + TrueCrypt = RAW Filesystem

#3 Post by Srv02 »

Hi cgrenier! Thank you for your quick reply.

PhotoRec didn't find any files after an 1 hour run.

After the big crash, I booted into Windows and decrypted the partition with Truecrypt to inspect the volume, but it was in the same state as after the permanent decryption process. The weird thing was that the password was accepted like a flaw.

So from my point it is a decrypted piece of junk.
Top
Locked

Return to “Filesystem repair”