RAID5 Drive Recovery

[Bruce Cloutier]

Just to follow-up.

I had 4 PERC RAID drives from a failed Dell PowerEdge. I had thought that the disks were healthy since the server left us after some kind of mother board failure. There was information stored there that would be nice to have and that was not backed up. No matter what kind of backup that you have in place there is always some way that it will fail you. While that information was not "critical", we had wanted to retrieve it.

Anyway I bought 4 powered SATA to USB adapters making the drives each accessible from a Windows 7 machine. They obviously were not recognizable by the system. I resisted all requests by Windows to format or initialize the foreign drives. Boy MS is persistent.

I tried a couple of software packages purporting to recover RAID drives. Both would analyze for some 24 hours and end up reporting failure. Even after manually configuring the possible RAID parameters they failed. It would seem to me that they would be able to tell just after a few minutes that things were not going to work out but... If asked I can discuss those. (Stellar data Recovery & ZAR X)

So I dropped down a level and grabbed a couple of hex editors that are able to open drives (Active Disk Editor & WinHex). Both editors seemed to be useful but one (WinHex) was much much faster in searching drives for specific data. I knew of a large text file (actually C source) that was stored on the server. So when I found that, I could look for the parts and reconstruct what the RAID configuration had to be for the file to be whole.

That server was installed a dozen years ago and even thought I did it, I could not remember how the RAID was configured. The documentation from then was not where it should have been. If you had asked me I would have thought it was RAID 5 even though today that's not the best choice.

With the hex editor I noted that 2 of the 4 disks contained a valid Master Boot Record (MBR). I then noticed that those 2 disks were copies of each other (mirrors). I confirmed that the other pair were mirrors. Okay, so RAID 10 which was a better choice.

I set a pair aside and continued to look at the presumed RAID 0 pair. The disk with the MBR would be Disk 1 and the other, Disk 2. The default block size for PERC is 64KB (128 sectors on these old drives). Since I had the hex editor I searched to find that large text file. Sure enough it was broken on 64KB boundaries and properly divvied up between the two drives.

At this point I could unravel the 2 drives into a single disk image with one of the packages I had acquired but the attempt didn't end up with the result I had wanted. I picked up another program (Runtime.org RAID Recovery) that would construct a virtual image file (VIM) with the parameters that I felt were needed. I then used their Captain Nemo program to open the RAID 0 drive pair.

So now I can browse the NTFS partitions and copy off the data. Yay! If I had good recommendations for the software to use the recovery would have been a bit more cost-effective. But it still didn't cost nearly what it would if we sent the drives out for recovery or otherwise acquire another Dell system. And in trying to mount the drives on another system you run the risk of those being reinitialized and old data destroyed.

A nice educational adventure. But now nothing has been lost whether or not any of it was absolutely needed. And... I have some good (and not so good) software tools should I ever need to do this again.

[Carsten Kurz]

And... I have some good (and not so good) software tools should I ever need to do this again.

Probably not for the rest of your life, but at least now your effort and success has been documented here for others to follow your footsteps ;-)

[Marcel Birgelen]

At this point I could unravel the 2 drives into a single disk image with one of the packages I had acquired but the attempt didn't end up with the result I had wanted. I picked up another program (Runtime.org RAID Recovery) that would construct a virtual image file (VIM) with the parameters that I felt were needed. I then used their Captain Nemo program to open the RAID 0 drive pair.

So now I can browse the NTFS partitions and copy off the data. Yay! If I had good recommendations for the software to use the recovery would have been a bit more cost-effective. But it still didn't cost nearly what it would if we sent the drives out for recovery or otherwise acquire another Dell system. And in trying to mount the drives on another system you run the risk of those being reinitialized and old data destroyed.

A nice educational adventure. But now nothing has been lost whether or not any of it was absolutely needed. And... I have some good (and not so good) software tools should I ever need to do this again.

Thanks for your update. I've never used RAID recovery software as I've never really trusted them. In the environments I've worked at, we practically always had sufficient spare hardware available. I also kept old, decommissioned hardware around as spare for boxes still in production, whereas others would just throw them out. If some machine left us, we simply swapped motherboards or moved the RAID disks from one machine to the other. I can't really remember any need to do low-level RAID recoveries where we needed to bypass the controller, but one time. Sometimes you needed some funky emergency modes on some of those controllers to import or activate failed RAIDs.

That one time, I've done some low-level file recovery on a failed SATA RAID (2 out of 5 in a RAID 5), to retrieve a file with hashed passwords in it in a similar fashion you did. That password file was very important and for whatever reason didn't make the backup...

As for those professional restore services: We've used them a few times. They're expensive but not as horrendously expensive as they used to be like 20 years back. I guess data-recovery has become a more routine job nowadays. They were able to restore most of the data on failed customer RAIDs without backups...

[Mark Gulbrandsen]

Just to follow-up.

I had 4 PERC RAID drives from a failed Dell PowerEdge. I had thought that the disks were healthy since the server left us after some kind of mother board failure. There was information stored there that would be nice to have and that was not backed up. No matter what kind of backup that you have in place there is always some way that it will fail you. While that information was not "critical", we had wanted to retrieve it.

If they had saved the Perc controller, all that you would have had to do is put it in another server boot it up and keep going. In a worst case you would have had to import an existing raid configuration back into the PERC, but that is it..A failed motherboard does not affect the PERC.

[Bruce Cloutier]

We just didn't have compatible Dell hardware. I am not familiar with the PERC enough to know if it could be installed in any other type of system. Seems to be in a unique connector on this motherboard. We've been running mostly the 1U system servers now (like the Dell R240). We contacted Dell and it didn't sound like much could accept the PERC (6/i I think) board. But, yeah, I had figured that the PERC was probably still good to go.

It is nice though to be able to recover the data independent of the manufacturers.

[Carsten Kurz]

Yeah, it was interesting to learn it can be done that way. I would not have given the slightest chance using USB-SATA converters. You have been lucky of course with that specific RAID scheme. And it probably would have been possible to buy a cheap second hand server on ebay as well in the low 100US$.

[Mark Gulbrandsen]

We just didn't have compatible Dell hardware. I am not familiar with the PERC enough to know if it could be installed in any other type of system. Seems to be in a unique connector on this motherboard. We've been running mostly the 1U system servers now (like the Dell R240). We contacted Dell and it didn't sound like much could accept the PERC (6/i I think) board. But, yeah, I had figured that the PERC was probably still good to go.

It is nice though to be able to recover the data independent of the manufacturers.

Yes, it can. In fact you could put it in any old PC that has the appropriate PCI-X socket. I have a PERC 6 in one of my HP Workstations. Some of the auto indicators that communicate with the DELL server won't function is all, they would normally communicate with the little LCD readout on the Dell server. But otherwise it works like any other LSI raid card.

[Bruce Cloutier]

Yes, it can. In fact you could put it in any old PC that has the appropriate PCI-X socket.

Interesting. I'll look around for some hardware and give it a try just out of curiosity, especially now that there is absolutely nothing to lose.

[Marcel Birgelen]

Regarding those Dell PERC controllers: Keep in mind that there are both integrated versions and PCI-X and PCI-e cards. Some of the integrated controllers on Dell motherboards need some kind of license dongle, in order to be activated. Older PERCs are SCSI RAID controllers, while newer versions are SAS/SATA versions.

PERC stands for: Power Edge Raid Controller. While most recent-ish controllers are essentially just re-branded LSI controllers, many other models are re-badged Adaptec controllers.

[Mark Gulbrandsen]

Regarding those Dell PERC controllers: Keep in mind that there are both integrated versions and PCI-X and PCI-e cards. Some of the integrated controllers on Dell motherboards need some kind of license dongle, in order to be activated. Older PERCs are SCSI RAID controllers, while newer versions are SAS/SATA versions.

PERC stands for: Power Edge Raid Controller. While most recent-ish controllers are essentially just re-branded LSI controllers, many other models are re-badged Adaptec controllers.

Correct, it's mainly the older Dell servers... 2450, 2500, etc that need the Raid Key (See picture) and all those Raid keys are the same. The 2450's can take either SAS or SATA 3.5" drives because the back plane was designed as such, ditto on the current stuff. The 2950 and later servers did not require a key to have the Raid function. The PCIE and PCI-x is solely determined by age of the server. The PCIE being the older, obviously. All the newer Dell servers I have put in, R710's and R-810's all use a PCI-x Raid controller that plugs in horizontally to a short vertical riser. Two multipin connectors connect the card to the hard drive back plane... I don't go back any further than the 2450's. That was the server I learned on.

[Marcel Birgelen]

Yeah, I remember those dongles and also that it was quite hard to get them if you didn't order the RAID functionality outright. We once were stuck with a bunch (I think it was 6 of them) of PE2650s from a customer, all without RAID dongle and Dell didn't want to ship us the RAID licenses. We ended up putting PCI-X PERCs into them. In the end, those stand-alone controllers were more powerful than the on-board RAID, so it wasn't such a bad deal after all.

[Mark Gulbrandsen]

It seems the PCI-x cards always have a lot more memory on them than the built in raids do, probablt more of a lack of real estate on the server mother boards. Both can still have battery backups. But overall I also prefer separate Raid cards.