QNAP died, recover RAID 1 with bad partition/superblock?

How to use TestDisk to recover lost partition
Post Reply
Message
Author
stephaneroy
Posts: 2
Joined: 01 Mar 2016, 19:30

QNAP died, recover RAID 1 with bad partition/superblock?

#1 Post by stephaneroy » 01 Mar 2016, 19:59

Hi there -
Let me start by saying thanks for reading. This post is mostly about me trying to learn how to properly use these tools with each other, but if you conclude that I'm in way over my head, that's okay too.

I had two 3 TB drives in a RAID 1 (mirror) in the 1st 2 bays of a QNAP TS419. After a firmware update, the NAS no longer boots (no beeps, QNAP support says it's dead). I don't have access to another QNAP NAS.
After dealing with QNAP support, I first tried to hook the drives up to a linux pc and mount them from there, but wasn't able to get it to work - more info below.
I found a 3rd party recovery tool that is able to locate all the files on one of the disks, so it seems the info is intact.
But I'd like to try and figure out if I can repair this myself. I have one of the drives hooked up to an ubuntu vm, and so I'm able to examine it.
The RAID was set up to be as large as possible, i.e. take up all available space on the 3TB drives.


First thing I did:

Code: Select all

sudo fdisk -l /dev/sdb
WARNING: GPT (GUID Partition Table) detected on '/dev/sdb'! The util fdisk doesn't support GPT. Use GNU Parted.
Disk /dev/sdb: 801.6 GB, 801569726464 bytes
255 heads, 63 sectors/track, 97451 cylinders, total 1565565872 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1  4294967295  2147483647+  ee  GPT
So the first confusing thing is that this is a 3TB drive, but fdisk only shows it as 800 GB.


I then tried parted, but that actually reports an error and crashes parted:

Code: Select all

sudo parted -l 
Error: Invalid argument during seek for read on /dev/sdb                  
Retry/Ignore/Cancel? i                                                    
Error: The backup GPT table is corrupt, but the primary appears OK, so that will
be used.
OK/Cancel? o                                                              
Backtrace has 8 calls on stack:
...
  1: parted() [0x804d521]
                                                                          
You found a bug in GNU Parted! Here's what you have to do:

Well so much for that.

Okay, so I read a little more about mdadm, and that maybe the partition table doesn't matter if there's separate raid info?

Code: Select all

sudo mdadm -E /dev/sdb
/dev/sdb:
   MBR Magic : aa55
Partition[0] :   4294967295 sectors at            1 (type ee)
At least I don't get an error, but 4294967295*512 bytes = 2199023255040, which isn't 3TB either, so I'm not sure if that's correct info.


Now I tried running testdisk, which reports the wrong size for the drive (801 GB, not 3TB), which it clearly says will be a problem. But when it analyzes (it's still analyzing) it seems to report

Code: Select all

MS Data                  2120582 5859515693 5857395112
... and that looks like it could be correct sector info, since 5857395112 * 512 = 2998986297344.
I'm hope I'm on the right track with this, but I'm not sure what to do once testdisk completes, since it doesn't see the correct drive size anyway.

I know this is a longshot, but I could use some help with what to try to do next? I'm happy to provide whatever additional info I can.

Thanks,
Stephane

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3615
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: QNAP died, recover RAID 1 with bad partition/superblock?

#2 Post by cgrenier » 02 Mar 2016, 07:44

As you haven't post the content of the testdisk.log file, it's hard to help you...

There should be several Linux Raid partitions on each physical disk.
Normally there are assembled in mdX (ie. md0, md1...) device.
Each /dev/mdX device is probably directly formatted as XFS or ext4.

stephaneroy
Posts: 2
Joined: 01 Mar 2016, 19:30

Re: QNAP died, recover RAID 1 with bad partition/superblock?

#3 Post by stephaneroy » 04 Mar 2016, 07:01

Okay testdisk finished running, here's testdisk.log. Again, it's on Ubuntu in virtualbox, fwiw, and /dev/sdb is the drive I'm interested in.
thanks.

Code: Select all


Wed Mar  2 23:15:02 2016
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-88-generic-pae (#126-Ubuntu SMP Mon Jul 6 21:47:47 UTC 2015) i686
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:16:54
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48 support
/dev/sda: size       16777216 sectors
/dev/sda: user_max   16777216 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 8589 MB / 8192 MiB - CHS 1044 255 63, sector size=512 - VBOX HARDDISK, S/N:VB84f5df1b-b19219a0, FW:1.0
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512 - ST3000VN 000-1HJ166

Partition table type (auto): EFI GPT
Disk /dev/sdb - 801 GB / 746 GiB - ST3000VN 000-1HJ166
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 1565565871)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 2 P MS Data                  1060296    2120579    1060284 [primary]
check_part_gpt failed for partition
 4 P MS Data               5859515976 5860511999     996024 [primary]
Current partition structure:
 1 P MS Data                       40    1060289    1060250 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 2 P MS Data                  1060296    2120579    1060284 [primary]
 2 P MS Data                  1060296    2120579    1060284 [primary]
 3 P MS Data                  2120584 5859515969 5857395386 [primary]
check_FAT: can't read FAT boot sector
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 4 P MS Data               5859515976 5860511999     996024 [primary]
 4 P MS Data               5859515976 5860511999     996024 [primary]

search_part()
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=4/31, s_blocks_per_group=32768, s_inodes_per_group=6640
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 132512
recover_EXT2: part_size 1060096
     MS Data                       40    1060135    1060096
     EXT3 Large file Sparse superblock, 542 MB / 517 MiB

Raid magic value at 65/252/36
Raid apparent size: 1060096 sectors
Raid chunk size: 0 bytes
md9 md 0.90.0 Raid 1: devices 0(8,1)* 1(8,17) 2(8,33)
     Linux Raid                    40    1060263    1060224 [md9]
     md 0.90.0 Raid 1: devices 0(8,1)* 1(8,17) 2(8,33), 542 MB / 517 MiB
     Linux Swap               1060296    2120535    1060240
     SWAP2 version 1, 542 MB / 517 MiB

Raid magic value at 131/254/36
Raid apparent size: 104 sectors
4 md 1.x Raid 1 - Array Slot : 0 (0, failed, 1, empty, failed, failed, failed)
     Linux Raid               1060296    2120559    1060264 [4]
     md 1.x Raid 1 - Array Slot : 0 (0, failed, 1, empty, failed, failed, failed), 542 MB / 517 MiB

Raid magic value at 131/254/44
Raid apparent size: 104 sectors
4 md 1.x Raid 1 - Array Slot : 0 (0, failed, 1, empty, failed, failed, failed)
     Linux Raid               1060296    2120559    1060264 [4]
     md 1.x Raid 1 - Array Slot : 0 (0, failed, 1, empty, failed, failed, failed), 542 MB / 517 MiB

recover_EXT2: s_block_group_nr=0/22344, s_mnt_count=13/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120584 5859515695 5857395112
     EXT4 Large file Sparse superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120584, size=1562427816, end=1564548399, disk end=1565565872)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

LVM magic value at 563/210/14

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

     Unknown                 44548569 30419402190967713 30419402146419144
     VMFS 116534200, 15574733 TB / 14165137 TiB
Partition not added.
check_FAT: Bad number of sectors per cluster

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

LVM magic value at 5632/98/26

block_group_nr 343

recover_EXT2: "e2fsck -b 11239424 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=343/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)
check_FAT: Bad number of sectors per cluster

LVM magic value at 7356/112/57

LVM magic value at 7927/48/40

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/22344, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732174389
recover_EXT2: part_size 1562427816
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
This partition ends after the disk limits. (start=2120582, size=1562427816, end=1564548397, disk end=1565565872)

HFS magic value at 10526/155/38
part_size 1133090991
     Mac HFS                169109992 1302200982 1133090991 [‘Ã}ªÉ‹‘gUÐ!1=g>õƒUÒ~]
     HFS, 580 GB / 540 GiB

HFS magic value at 84659/192/4
part_size 2739817516
     Mac HFS               1360058934 4099876449 2739817516 [ÓmœŽê	åÄ}e=>ìJžôyÿ®æélz,¡]
     HFS, 1402 GB / 1306 GiB
This partition ends after the disk limits. (start=1360058934, size=2739817516, end=4099876449, disk end=1565565872)

LVM magic value at 85499/191/24

HFS+ magic value at 86209/114/58
part_size 195096
     Mac HFS               1384954824 1385149919     195096
     HFS+, 99 MB / 95 MiB

HFS+ magic value at 86221/167/49
part_size 195096
     Mac HFS               1385150934 1385346029     195096
     HFS+, 99 MB / 95 MiB

HFS+ magic value at 86271/37/47
part_size 1331120
     Mac HFS               1385945992 1387277111    1331120
     HFS+, 681 MB / 649 MiB

HFS+ magic value at 86373/97/49
part_size 1331120
     Mac HFS               1387588404 1388919523    1331120
     HFS+, 681 MB / 649 MiB

HFS+ magic value at 87008/88/45
part_size 9178608
     Mac HFS               1397789108 1406967715    9178608
     HFS+, 4699 MB / 4481 MiB

HFS+ magic value at 88167/79/45
part_size 9178104
     Mac HFS               1416407876 1425585979    9178104
     HFS+, 4699 MB / 4481 MiB

HFS+ magic value at 88846/115/60
part_size 195752
     Mac HFS               1427318294 1427514045     195752
     HFS+, 100 MB / 95 MiB

HFS+ magic value at 89042/157/32
part_size 7725128
     Mac HFS               1430469652 1438194779    7725128
     HFS+, 3955 MB / 3772 MiB

HFS magic value at 91270/6/13
part_size 116903905
     Mac HFS               1466252940 1583156844  116903905 [
HR°*L ;F&]
     HFS, 59 GB / 55 GiB
This partition ends after the disk limits. (start=1466252940, size=116903905, end=1583156844, disk end=1565565872)

HFS magic value at 91682/109/23
part_size 3889162326
     Mac HFS               1472878219 5362040544 3889162326 [0é	o”_ÿàã +ÖâšÛ‰±R-œ†!€]
     HFS, 1991 GB / 1854 GiB
This partition ends after the disk limits. (start=1472878219, size=3889162326, end=1067073248, disk end=1565565872)

HFS magic value at 94867/137/60
part_size 645309379
     Mac HFS               1524047045 2169356423  645309379 [Ÿý³óùœŽqñe•ƒ?Ù8±h°IÿÔFƒ]
     HFS, 330 GB / 307 GiB
This partition ends after the disk limits. (start=1524047045, size=645309379, end=2169356423, disk end=1565565872)

HFS magic value at 96552/170/48
part_size 4316365
     Mac HFS               1551118637 1555435001    4316365 [¹›[[°ˆ®È›øÍoP]
     HFS, 2209 MB / 2107 MiB
Disk /dev/sdb - 801 GB / 746 GiB - CHS 97451 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (801 GB / 746 GiB) seems too small! (< 3000 GB / 2794 GiB)
The following partitions can't be recovered:
     MS Data                  2120582 5859515693 5857395112
     EXT4 Large file Sparse superblock Backup superblock, 2998 GB / 2793 GiB
     MS Data                  2120584 5859515695 5857395112
     EXT4 Large file Sparse superblock, 2998 GB / 2793 GiB
     Mac HFS               1360058934 4099876449 2739817516 [ÓmœŽê	åÄ}e=>ìJžôyÿ®æélz,¡]
     HFS, 1402 GB / 1306 GiB
     Mac HFS               1466252940 1583156844  116903905 [
HR°*L ;F&]
     HFS, 59 GB / 55 GiB
     Mac HFS               1472878219 5362040544 3889162326 [0é	o”_ÿàã +ÖâšÛ‰±R-œ†!€]
     HFS, 1991 GB / 1854 GiB
     Mac HFS               1524047045 2169356423  645309379 [Ÿý³óùœŽqñe•ƒ?Ù8±h°IÿÔFƒ]
     HFS, 330 GB / 307 GiB

Results
     MS Data                       40    1060135    1060096
     EXT3 Large file Sparse superblock, 542 MB / 517 MiB
     Linux Raid                    40    1060263    1060224 [md9]
     md 0.90.0 Raid 1: devices 0(8,1)* 1(8,17) 2(8,33), 542 MB / 517 MiB
     Linux Swap               1060296    2120535    1060240
     SWAP2 version 1, 542 MB / 517 MiB
     Linux Raid               1060296    2120559    1060264 [4]
     md 1.x Raid 1 - Array Slot : 0 (0, failed, 1, empty, failed, failed, failed), 542 MB / 517 MiB
   P Mac HFS                169109992 1302200982 1133090991 [‘Ã}ªÉ‹‘gUÐ!1=g>õƒUÒ~]
     HFS, 580 GB / 540 GiB
   P Mac HFS               1384954824 1385149919     195096
     HFS+, 99 MB / 95 MiB
   P Mac HFS               1385150934 1385346029     195096
     HFS+, 99 MB / 95 MiB
   P Mac HFS               1385945992 1387277111    1331120
     HFS+, 681 MB / 649 MiB
   P Mac HFS               1387588404 1388919523    1331120
     HFS+, 681 MB / 649 MiB
   P Mac HFS               1397789108 1406967715    9178608
     HFS+, 4699 MB / 4481 MiB
   P Mac HFS               1416407876 1425585979    9178104
     HFS+, 4699 MB / 4481 MiB
   P Mac HFS               1427318294 1427514045     195752
     HFS+, 100 MB / 95 MiB
   P Mac HFS               1430469652 1438194779    7725128
     HFS+, 3955 MB / 3772 MiB
   P Mac HFS               1551118637 1555435001    4316365 [¹›[[°ˆ®È›øÍoP]
     HFS, 2209 MB / 2107 MiB

interface_write()
 1 P Mac HFS                169109992 1302200982 1133090991 [‘Ã}ªÉ‹‘gUÐ!1=g>õƒUÒ~]
 2 P Mac HFS               1384954824 1385149919     195096
 3 P Mac HFS               1385150934 1385346029     195096
 4 P Mac HFS               1385945992 1387277111    1331120
 5 P Mac HFS               1387588404 1388919523    1331120
 6 P Mac HFS               1397789108 1406967715    9178608
 7 P Mac HFS               1416407876 1425585979    9178104
 8 P Mac HFS               1427318294 1427514045     195752
 9 P Mac HFS               1430469652 1438194779    7725128
10 P Mac HFS               1551118637 1555435001    4316365 [¹›[[°ˆ®È›øÍoP]
simulate write!

TestDisk exited normally.

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests