Reconstructing a RA...
 
Notifications
Clear all

Reconstructing a RAID 5

kintern
(@kintern)
New Member

Hello,

Is it possible to reconstruct a RAID 5 configuration with 2 of the 4 hard drives failing? I was thinking of imaging each drive and trying a program called RAID Reconstructor.

Has anyone tried this before or have any alternatives?

Quote
Topic starter Posted : 04/05/2016 8:47 pm
Igor_Michailov
(@igor_michailov)
Senior Member

R-Studio+Xways

ReplyQuote
Posted : 04/05/2016 9:16 pm
mscotgrove
(@mscotgrove)
Senior Member

If the drives are failing, I presume you mean that you can access maybe 90% or better of the sectors on the drives. In this case, recovery will be possible except for some blocks when the stripe hits two drive failures. As long as three drives work for a stripe, data can be recovered.

If you image the drives, you will need to know which sectors did not have valid data. eg PC3000 fills sectors with 'DE AD'

If 2 of the 4 drives have failed, then only very small files will be recoverable.

ReplyQuote
Posted : 04/05/2016 10:39 pm
kintern
(@kintern)
New Member

If the drives are failing, I presume you mean that you can access maybe 90% or better of the sectors on the drives. In this case, recovery will be possible except for some blocks when the stripe hits two drive failures. As long as three drives work for a stripe, data can be recovered.

If you image the drives, you will need to know which sectors did not have valid data. eg PC3000 fills sectors with 'DE AD'

If 2 of the 4 drives have failed, then only very small files will be recoverable.

I should of worded my question slightly better but it seems you have given me an answer.

For sure 2 of the 4 drives have failed. That is confirmed. I attempted to use a Logicube Falcon to image the good drives into a single hard drive as well as the failed ones (if it could read it, I thought I would give it a try). I do understand that a RAID 5 needs 3 drives for it to work just as you've mentioned. I am unsure of the chances of recovering the failed hard drives data as my Logicube Falcon displays that it is unable to read it (even though the drive still spins).

With the 2 good drives, after imaging it to a singular 2TB hard drive, is it possible in creating lets say an .E01 in AccessData Forensic ToolKit and attempting to analyze it that way for some type of recovery? Or is this technique not possible as I need at least 3 hard drives to be transferred to the singular hard drive first?

ReplyQuote
Topic starter Posted : 05/05/2016 12:11 am
mscotgrove
(@mscotgrove)
Senior Member

With two failed drives (out of 4) for each stripe you will only get 25% or 50% of the data. If the size of each stripe was 0x20 sectors, this means the longest run of data will be 0x40 sectors, 32KB of data. (Stripe sizes can vary a lot, so his is only an example)

Unless one of the drives can be repaired, I would start looking very seriously elsewhere for the data.

ReplyQuote
Posted : 05/05/2016 4:08 am
zxvdfqs
(@zxvdfqs)
New Member

If you loose two out of four drives in a raid 5 set, you have lost 50% of your data, and the missing data is spread evenly – two of each four 64KB blocks of data are unrecoverable. 64KB is the typical default block size, but it can be altered in the raid card's BIOS setup.

Data for each file is written across all four drives in stripes. A stripe is a contiguous block composed of typically 64KB segments per drive.

Here is an illustration of the first four stripes.
Each column represents a drive.
Each row represents a stripe.
Each block is either D=data, or P=parity.
D D D P
D D P D
D P D D
P D D D

Note there are 12 data blocks total.

If you loose one drive, you have lost the redundancy. There will be scattered parity (P) blosks that must be translated back into data.

If you loose a second out of three remaining drives, you can no longer use the parity blocks to recover data. So you loose both the missing data blocks on the missing drives, and any parity blocks on the remaining drives.

Given only the first two, your remaining data is
D D
D D
D P
P D

There are 6 data blocks remaining.

You cannot translate the Parity blocks back into data, because you need three drives to do so. This means the P (parity) blocks are unrecoverable.

In summary, you have 6/12 blocks recoverable or 50% of your data. Two out of every four 64KB blocks of data will either be missing, or be parity. The parity blocks will look like random (noise) data.

ReplyQuote
Posted : 19/05/2016 5:38 am
Share:
Share to...