cgsecurity.org

I had a RAID1 setup and both disks got corrupted, but from using TestDisk it appears my data still exists. One disk has a corrupted boot sector and corrupted backup boot sector. To remedy this, I found an article about how I should RebuildBS, and that process is slowwwwwww on 1TB. Since there is another disk from the RAID setup, and since it has a valid boot sector, can I just copy that over to the other disk then botta-bing problem solved? Also worth noting is that the partition that is found is showing slightly larger size in sectors than the other disk's and I have no idea if there is data living within. If I understand correctly, the MBR contains the partition table?

It's advisable only to copy data to another unaffected healthy disk.
You shouldn't write to your RAID1.
Please copy and paste the content of your testdisk.log into your next post.

Fiona

Running TestDisk v7.0 with RebuildBS in Windows just eventually crashes. The 'stackdump' shows an access_violation. In Linux, running TestDisk v6.13, RebuildBS does nothing at all. I also tried copying over the boot sector from one disk to the other and it didn't work. Ha.

LOG:


Sat Aug 15 20:23:01 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=5122252800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=180045766656
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=5122252800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=180045766656
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
filewin32_getfilesize(\\.\PhysicalDrive7) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive7) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive7
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=21369978880
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
Hard disk list
Disk /dev/sda - 5122 MB / 4884 MiB - CHS 138950 18 4, sector size=512
Disk /dev/sdb - 180 GB / 167 GiB - CHS 21889 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 21 GB / 19 GiB - CHS 2598 255 63, sector size=512

Partition table type default to Intel
Disk /dev/sdc - 1000 GB / 931 GiB
Partition table type: None
New options :
Dump : No
Align partition: Yes
Expert mode : Yes

Interface Advanced
P Unknown 0 0 1 121601 80 63 1953525168
Change partition type:
P NTFS 0 0 1 121601 80 63 1953525168

ntfs_boot_sector
P NTFS 0 0 1 121601 80 63 1953525168
filesystem size 1208516115580653324 1
sectors_per_cluster 124 0
mft_lcn 416149986 0
mftmirr_lcn 85018310 0
clusters_per_mft_record -76 0
clusters_per_index_record 85 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
2 [main] testdisk_win 3248 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump



Stackdump:

Exception: STATUS_ACCESS_VIOLATION at eip=0043E5A6
eax=00000000 ebx=800B6A68 ecx=0028B88C edx=E1D8B058 esi=46381BF7 edi=00000000
ebp=800B6718 esp=0028B200 program=C:\Users\AMD\Desktop\testdisk-7_0_win\testdisk-7.0\testdisk_win.exe, pid 3448, thread main
cs=0023 ds=002B es=002B fs=0053 gs=002B ss=002B
Stack trace:
Frame Function Args
End of stack trace

Would it be possible that your RAID1 is already degraded and you've only 2 single disks?
It's not a big problem, because your data are only mirrored.
At least you shouldn't change your partition table type from Intel to None.
Before you run any boot sector diagnose you should make it for sure, that your partition in your partition table is correct.
Can you run TestDisk / Analyse and Quick Search.
If no partition would be found Deeper Search also.
Deeper Search searches additional for a backup of the boot sector.
If any partitions are found, please select them and press p tp have a try to list your files.
Can you copy the content of your testdisk log into your next post again?

Fiona

I believe there is still a good backup bootsector on one of the disks. It will take several hours to do any scans.

The one drive that appears to be working ok has 121575 cylinders. The other has 121601. If I mess around with Geomtry settings, in particular, the number of cylinders (using 121601 or 121575) will NOT show a partition on the bad disk. I would think having exactly the same Geomtry on each disk because they are the same kind, would work fine, but it's not? It still shows no good bootsector, and I am trying yet again to RebuildBS. Search and DeepSearch in progress...

In TestDisk disk selection, both disks have the same values:

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512

That's why I need your testdisk.log.
Until yet, I don't see any necessity to change geometry?

Fiona

Ok, due to the enormous amount of time spent and frustration, I tried again to simply copy/paste the boot sector (using dd). I've additionally fixed the backup boot sector. Now, both drives are mountable and showing my data.

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63
Partition Start End Size in sectors
>* HPFS - NTFS 0 1 1 121575 254 63 1953118377


Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121602 255 63
Partition Start End Size in sectors
>* HPFS - NTFS 0 1 1 121575 254 63 1953118377

Both disks also show:

Boot sector
Status: OK

Backup boot sector
Status: OK

MFT and MFT mirror matches perfectly.

--------------------------------------------

Now, how do I proceed to recreate the RAID1? I've tried creating the array with "fast initialization" (no data loss), but the MBR typically gets corrupted. Also, when I try to re-synchronize my array, I get a message saying it was never initialized.

Seems like I have successfully re-created my array, but TestDisk shows that the MFT "seems ok?" What's that about??? It still shows this even after I run "chkdsk C: /f" (C: now denoting the array).


Steps taken:

Firstly, I destroyed the RAID then re-created it using "Fast Initialization," after marking each disk as "online," leaving the data intact in addition to the previous work noted with TestDisk - having same CHS, boot sectors, MFT etc. I need to have this array working in Windows 7. So, I go take a look at the array in Management Console, and it shows as a disk that isn't initliazed. Fine, the O/S can't see it, so I initted to MBR. Ran TestDisk again and noticed the boot sector showed bad, with backup good. So, I located the partition again and write it. Restarted. Used the backup boot sector to replace the boot sector. Restarted. Once that was done, the Management Console shows a disk that has a partition and can then be assigned a letter. I ran TestDisk again and it shows both the boot sector and backup boot sector on the RAID array as "ok." I also successfully completed a sync of the disk. All seems fine, except the MFT concerns me.

How did you create your RAID1?
Did you use an onboard RAID Controller or did you use software to create your RAID?
Might be possible after RAID1-setup that your disk starts to mirror again and can override data.
At least, before you run any chkdsk repairing your MFT, you should have a backup.

Seems like I have successfully re-created my array, but TestDisk shows that the MFT "seems ok?" What's that about??? It still shows this even after I run "chkdsk C: /f" (C: now denoting the array).

MFT (Master File Table) and its Mirror are a part of the NTFS file system.
If they're ok, there would be nothing to do.

Fiona