Contents
The goal and the method
The goal is to identify drives order using known disk content. Four-disk NAS similar to Buffalo Terastation, Iomega StorCenter, Synology etc. use software RAID or non-RAID configuration, built on 'data partitions' - the largest partitions of each NAS drive.
To do drives configuration analysis you should connect them first to Windows PC. Please read the description of for details.
For this kind of NAS, there is XFS file system that is distributed among disk data partitions and it's possible to identify RAID parameters by known data fragments on data partition starts.
Automatic RAID detection
Linux-based NAS boxes often use MD (Multiple Devices) software RAID configurations. Such RAID configurations are created with well-knwon 'mdadm' utility and can describe linear (JBOD), multipath, RAID 0 (stripe), RAID 1 (mirror), RAID 5 and RAID 6 software RAID configurations. It creates pseudo-partitions on the drives along with metadata information: this information is enough to build RAID automatically.
Support of Linux MD RAID automatic assembly is available since version 4.9.1 of UFS Explorer software. With UFS Explorer Standard Recovery version 4.9.1 and later you can do this as:
Run UFS Explorer; make sure all drives (or drive image files) are opened;
Click 'Build RAID' button or 'Plugins' -> 'Build virtual RIAD';
Select ANY data partition of the software RAID to add it to virtual RAID;
Once partition is added and MD metadata is detected, software will ask for automatic RAID assembly;
Press 'Yes' to build RAID automatically: the software will load disk partitions in correct order, will set RAID level, stripe size, parity rotation etc.;
Now press 'Build' to add RAID to UFS Explorer.
Please note that software uses the most recent RAID configuration. This means if device was reset to a different RAID level, drives order or stripe size, previous RAID configuration could be detected only manually. In this case you should answer 'No' to automatic RAID assembly questions and use manual specification for RAID parameters.
Analysing on-disk content
It's recommended to examine on-disk content with free software. The following steps are required:
- to Windows, Mac or Linux recovery PC;
Linux users: do not mount file systems from NAS drives!
Mac users: never attempt any diagnose, repair etc. actions to disks with disk utility!
- Boot PC, install and run software;
Windows XP and below: run the software under Administrator user account;
Windows Vista/7 with UAC: run the software as Administrator from context menu;
Mac OS: authenticate yourself as system Administrator when program starts;
Linux: from command line run 'sudo cihexview' or 'su root -c cihexview'.
- Click 'Open Disk Storage' (Ctrl+Shift+'O'); open data partition of each NAS drive.
Each NAS drive will contain same partition structure (1-3 small 'system' partitions with total size of about several gigabytes) and large data partition (usually over 95% of total drive capacity). More information about partitions layout is available .
RAID Configuration and advanced drives order detection
Open hexadecimal view of data partitions of NAS drives as described above.
The following pictures show example of expected on-disk information for XFS file system. The example information is taken from default RAID 5 configuration with 64KB stripe size:
Pict. 1. XFS file system start (superblock).
The start block of XFS file system contains 'XFSB' string at start, file system parameter values and much zeros. Valid superblock never contains any non-zero data at 0x100..0x200 bytes range. It's easy to identify it by these properties.
Pict. 2. XFS I-nodes block.
The I-nodes block that lays at offset 64KB for this kind of XFS format. According to and layouts, for default 64K stripe size it will be located at zero offset of data partition of Drive2.
The I-nodes could be identified by 'IN' string ('49 4E' byte sequence) at start of each 256 (0x100) byte blocks. Each I-node describes file system object.
The upper digit of third byte defines object type. 4X byte means directory and 8X defines file.
On picture above the first I-node defines a directory and the second defines a file.
Pict. 3. RAID5 parity block.
The parity block contains 'mix' of data from data blocks of other drives. It may look like 'garbage'; often with visible fragments of data from data blocks.
Even in case parity block contains valid 'XFSB' string (like superblock) it will also contain non-zero data at 0x100..0x200 bytes range that makes it different from start block. Please also note that view of parity block usually contains much more non-zero bytes.
Now, using this known content examples and assuming 'start block' is first block of data partition of a given drive, let's identify RAID systems:
RAID 5:
Only one first block will contain superblock (Pict.1);
If stripe size is 64KB (usual for Terastation), the one of first blocks will contain I-nodes; first I-node must describe directory (root directory). If root directory had only few files - their names will be in I-node body (like at Pict.2);
Start block of third drive will contain data or I-nodes table;
Start block of fourth drive will contain parity (Pict. 3);
If you will try to apply XOR operation to bytes from start blocks of each disk at same byte position you will always get zero result.
RAID 5 could be identified as RAID with only one superblock at start block and with parity. XOR operation over bytes from each start block at same byte position gives zero result.
Drives order is: drive with superblock - first, drive with root directory - second. Drive with parity - fourth; remaining drive is third.
How to check partity:
Choose partition offset with non-zero data;
Run 'calculator' software (e.g. Windows standard calculator); choose 'View' as 'Scintific' or 'Programming', switch mode from 'Dec' to 'Hex';
Type a hexadecimal digit from first drive, press 'Xor' button;
Type the hexadecimal digit from the next drive at exactly the same offset and press 'Xor' again;
Repeat until the last drive. Before entering data from last drive, calculator must show the same number as it is at specified position of last disk. Doing 'Xor' with it will give zero.
Non-zero value for any of offsets means either calculation error or there are no parity.
RAID 0:
Only one first block will contain superblock (Pict.1);
If stripe size is 64KB (usual for Terastation), the one of first blocks will contain I-nodes; first I-node must describe directory (root directory). If root directory had only few files - their names will be in I-node body (like at Pict.2);
Any other first blocks will not contain other superblocks or parity;
Other drives may contain more I-nodes at first block.
RAID0 could be identified as RAID with only one superblock at start block and with no parity.
Drives order is: drive with superblock - first, drive with root directory - second. There are uncertainties for 3rd and 4th drives, however it's possible to try both and find which one is right.
RAID 10/0+1:
RAID 10/0+1 could be identified as RAID with two superblocks at start blocks.
Drives order is: drive with superblock - first, drive with no superblock (data or I-nodes) - second. The are two such pairs and both could be used for data recovery.
RAID 1 and multi-part storage:
RAID 1/and multi-part storage could be identified as RAID with superblocks at all start blocks.
Drives order is: any drive from RAID 1 gives all the data. For multi-part storage - each drive has individual valid file system.
 |
In case analysis didn't give single-meaning result and some uncertainty still exits - it's recommended to try all remaining combinations and choose the best. The RAID reconstruction with UFS Explorer does not modify data on disks thus you may repeat RAID reconstruction with different parameters.
|
Final notes
If you not sure you can recover data by yourself, it's strongly recommended to bring your NAS to specialized data recovery laboratory to avoid data loss.
In case you are working in data recovery but have difficulties with mass NAS analysis, you may commercially use .
Last update: 18.04.2011
