dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
1252

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL
(Software) pfSense
Netgear CM1000
Zoom 5341J

jay608

Member

Raid Recovery

Long story short, I had a total raid failure the other day (card failed), but there is some vital information that was on that raid, and the backup is 2 weeks old. Does anyone know of any software that I can use to recover the files. Drives are still good, none of those failed.

Jason24
join:2004-01-21
Davenport, FL

Jason24

Member

What is the RAID card and what level RAID was in use?

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL

jay608

Member

Was an LSI 8708, in a raid 10

donoreo
Premium Member
join:2002-05-30
North York, ON

1 recommendation

donoreo to jay608

Premium Member

to jay608
In theory you should be able to get another of the same card and recover.

Jason24
join:2004-01-21
Davenport, FL

Jason24 to jay608

Member

to jay608
If you can't get a replacement controller, I had good luck with Disk Internals Raid Recovery Software a while back. I have never tried to use it for RAID 10 though, but if you know the physical disk layout you should be able to assemble one of your RAID 0 sets.
ke4pym
Premium Member
join:2004-07-24
Charlotte, NC

ke4pym to jay608

Premium Member

to jay608
As donoreo noted, getting an exact replacement should get you set up (unless it wiped out the drives in its death throws - seen it happen).

RAID configuration information is stored on the controller and the disk array.

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL

jay608 to Jason24

Member

to Jason24
Thanks I'll give it a try.
jay608

jay608 to ke4pym

Member

to ke4pym
What I am scared of is that the config is gone totally. I really don't want to slap these into another controller until I can get the data off. And if I can't well that's another bridge I will have to cross.

Camelot One
MVM
join:2001-11-21
Bloomington, IN

Camelot One to jay608

MVM

to jay608
I have never tried with an LSI 8708........
I will say that again, I have never tried with an LSI 8708.....

But, as long as the array creation is manual, and not automatic, you should be able to just plug the drives into a new card of the same make/model, in the same disk order, and have the array recognized as it was before. The array information is stored on the disks.
The covet there is that the array creation has to be manual. Some controllers do an automatic configuration, and if it doesn't properly read the existing array info off the disks, it could try creating a new array for you. You don't want that.

If it were me, and if the data was really that important, I would get 2 new cards and some spare disks. Setup a new array with the spare disks, save some data to it, then see what happens when you plug the drives into the 2nd card.

donoreo
Premium Member
join:2002-05-30
North York, ON

donoreo to ke4pym

Premium Member

to ke4pym
said by ke4pym:

As donoreo noted, getting an exact replacement should get you set up (unless it wiped out the drives in its death throws - seen it happen).

RAID configuration information is stored on the controller and the disk array.

I have seen it happen too. Then you see men cry. Of course you have a backup, right? I mean RAID is not a substitute for an external backup.

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL

jay608

Member

Yeah I have a backup, but the backup is 2 weeks old, and the guy that 'controls' the back is in China for 2 weeks. So I can't even get it restored.

donoreo
Premium Member
join:2002-05-30
North York, ON

donoreo to jay608

Premium Member

to jay608
Well once you recover, you have a case for updating the back up procedures Something good can come out of this.

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL

jay608

Member

So true, but that doesn't help the cause right now. They aren't going to want to pony up the cost for the Disk Internals lol

dennismurphy
Put me on hold? I'll put YOU on hold
Premium Member
join:2002-11-19
Parsippany, NJ

1 recommendation

dennismurphy

Premium Member

said by jay608:

So true, but that doesn't help the cause right now. They aren't going to want to pony up the cost for the Disk Internals lol

Then the data must not be important.

What I'd do is make a dd copy of the drives to an identical pair, and then install the 'clone' drives to a new RAID card.

That way, the original is preserved 'just in case'.

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL

jay608

Member

It never important to higher ups, because its not their data

dennismurphy
Put me on hold? I'll put YOU on hold
Premium Member
join:2002-11-19
Parsippany, NJ

dennismurphy to jay608

Premium Member

to jay608
If you don't trust yourself with dd, try OSFClone.

»www.osforensics.com/tool ··· ges.html

Very simple way to make a complete clone of the disk.

Again, step 1 - get 2 more of the identical disk models
Step 2 - use OSFClone to make a copy of the originals
Step 3 - get a new LSI raid card
Step 4 - attach the clone disks to the new LSI raid card

Step 5 - data should come back.

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL

jay608

Member

Thanks for the link Dennis, much appreciated.

dennismurphy
Put me on hold? I'll put YOU on hold
Premium Member
join:2002-11-19
Parsippany, NJ

dennismurphy to jay608

Premium Member

to jay608
said by jay608:

It never important to higher ups, because its not their data

Diasgree. That's a failure of management to understand their business.

They get paid the big money to understand their business at a higher level.

If the data is really, truly important to the business (i.e. will cost them money!) then it's worth recovering.

If it is not, then it isn't.

That's a pretty simple value calculation to make...

If it takes someone you pay $10/hr 20 hours to recreate the data, that's a cost of $200.

If the cost to recover the data is $10,000 that's a poor value.

If the data contains $2,000,000 of outstanding account receivables, and it costs $10,000 to recover, then it's well worth doing.

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL
(Software) pfSense
Netgear CM1000
Zoom 5341J

jay608

Member

The situation is hard to explain. They aren't our servers, but we host them in our datacenter. We patch them, and keep them functional. But when something like this happens its actually out of our hands because its not our hardware. We have to help them out.

dennismurphy
Put me on hold? I'll put YOU on hold
Premium Member
join:2002-11-19
Parsippany, NJ

dennismurphy

Premium Member

said by jay608:

The situation is hard to explain. They aren't our servers, but we host them in our datacenter. We patch them, and keep them functional. But when something like this happens its actually out of our hands because its not our hardware. We have to help them out.

That's not complicated, it's called managed colocation.

Best of luck with the recovery -- how big are the drives if you don't mind me asking?

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL

jay608

Member

If I remember correctly they are 4 x 1TB 7200RPM

Its an educational institution so there's more that comes into play.

exocet_cm
Writing
Premium Member
join:2003-03-23
Brooklyn, NY

exocet_cm to dennismurphy

Premium Member

to dennismurphy
said by dennismurphy:

said by jay608:

So true, but that doesn't help the cause right now. They aren't going to want to pony up the cost for the Disk Internals lol

What I'd do is make a dd copy of the drives to an identical pair, and then install the 'clone' drives to a new RAID card.

Bingo. This is the same procedure we do in our forensics shop when analyzing disks from a RAID array.
Write block the originals.
Image the originals.
Boot the image.

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL

jay608

Member

Well they shelled out for a program call File Scavenger, and it seems to find all of the files. I have my fingers crossed for them.

dennismurphy
Put me on hold? I'll put YOU on hold
Premium Member
join:2002-11-19
Parsippany, NJ

dennismurphy

Premium Member

said by jay608:

Well they shelled out for a program call File Scavenger, and it seems to find all of the files. I have my fingers crossed for them.

How's it going?

I would think duping the disks and getting a new RAID controller would be a lot better/easier/quicker/safe than trying to recover data... that isn't a recovery, but just bringing it back online. But I guess some $100 program is cheaper on the surface...

jay608
Going Nucking Futs
join:2007-01-22
Homewood, IL
(Software) pfSense
Netgear CM1000
Zoom 5341J

2 recommendations

jay608

Member

They recovered almost everything. They had esxi (free) running on the machine, so everything was in vdmks.

They have/had one issue where they could not get a vm to boot back up because a device wouldn't load. They got it into safe mode and copied all the data off. So as of right now all is quite with that department. The are now moving things to the cloud.

dennismurphy
Put me on hold? I'll put YOU on hold
Premium Member
join:2002-11-19
Parsippany, NJ

dennismurphy

Premium Member

Good deal! Glad the important stuff came back. Nothing worse than potentially losing data.

Now that I no longer do IT professionally, I can say that I've been close but never lost data. Worst I ever encountered was a HA clustered system (Sun Cluster 2.2) where a fellow admin intervened during a failover and somehow managed to import the volumes and start Oracle simultaneously on 2 nodes.

That was a cluster-F to undo. I ended up hex-editing the Veritas VxVM private regions on each disk to undo the damage... But somehow I got it right, and we got the customer care database for the entire country (supporting, oh, only about 60 million customers at the time) back online.

Going to tape was going to be a multi-day process for recovery... Glad I avoided that. Someone (not me) would've lost their job if that happened.
ke4pym
Premium Member
join:2004-07-24
Charlotte, NC

1 edit

ke4pym to jay608

Premium Member

to jay608
Remind me to never comment on threads about storage ever again.

Had an old DL380 G3 lose its mind this morning. It marked the data RAID 5 array as failed. Drives were looking okay. The controller, for some reason, felt the drives had been removed and reinserted. Told it to re-enable the array and accept "data loss". Something got hosed. SQL server wouldn't fire up.

Thankfully the C and D drives were intact. So, I made the executive decision to virtualize the box and restore the E drive from backup. Waiting on the last few gigs to write..

Oh well. One less physical box on the floor now.

exocet_cm
Writing
Premium Member
join:2003-03-23
Brooklyn, NY

exocet_cm

Premium Member

What kind of RAID card? I have a P400 from a 380 G5 collecting dust.