---

Contents

• The goal and the method
• Using HEX viewer software
• Using UFS Explorer
• Simple drives order detection (Buffalo NAS)
• RAID Configuration and advanced drives order detection
• Final notes

The goal and the method

The goal is to identify drives order using known disk content. Four-disk NAS similar to Buffalo Terastation, Iomega StorCenter, Synology etc. use software RAID or non-RAID configuration, built on 'data partitions' - the largest partitions of each NAS drive.
To do drives configuration analysis you should connect them first to Windows PC. Please read the description of how to connect drives to Windows PC for details.

For this kind of NAS, there is XFS file system that is distributed among disk data partitions and it's possible to identify RAID parameters by known data fragments on data partition starts.

---

Using HEX viewer software

If you are already using any HEX viewer software that supports access to physical drives, you may use it for drives order identification. Also you may consider of looking for any free or commercial HEX viewer software products to examine drives data.

For data analysis you need to open data partition of analyzed disk with HEX viewer software.

---

Using UFS Explorer software

You will require UFS Explorer Professional Recovery edition, version 3.14 and above. The operation is avialble in both "registered" and "trial" software modes. To invoke HEX preview, right-click disk or disk partition and choose 'HEX preview'. This will display 256KB chunk of information.

---

Simple drives order detection (Buffalo NAS)

Open HEX preview of entire disk drive. In UFS Explorer: right-click the disk and choose 'HEX preview'.

In modern, advanced Buffalo NAS systems the drive data will start from drive order identification string like 'DRIVE1', 'DRIVE2' etc. "DRIVE1" means drive is first, "DRIVE2" - the second etc.

If this information is not available, please process to the next section.

---

RAID Configuration and advanced drives order detection

Open HEX preview of data partition of the disk. This is the largest partition of the disk without sub-partitions, taking over 90% of total disk space. In UFS Explorer: right-click the disk data partition and choose 'HEX preview'.

The HEX view of data we expecting to see there is shown on pictures below:



Pict. 3. XFS file system start (superblock).

The start block of XFS file system contains 'XFSB' string at start, file system parameter values and much zeros. Valid superblock never contains any non-zero data at 0x100..0x200 bytes range. It's easy to identify it by these properties.



Pict. 4. XFS iNodes block.

The i-nodes block lays at least at 64KB offset from XFS start but could be located at some of data partition starts for striped RAID (RAID0, RAID5, RAID10). The 'i-nodes' could be identified by 'IN' string ('49 4E' byte sequence) at start of each 256 byte blocks. Each i-node describes file system object.

The upper digit of third byte defines object type. 4X byte means directory and 8X defines file.

On picture above first i-node defines a directory and second defines a file.



Pict. 5. RAID5 parity block.

The parity block contains 'mix' of data from data blocks of other drives. Visually it looks like 'garbage', often with visible fragments of data from data blocks. On the picture above you can see start of 'XFSB' string (starting 'XF') and mixed data on the place of iNode from different data partition start.
Even in case parity block contains valid 'XFSB' string (like superblock) it will also contain non-zero data at 0x100..0x200 bytes range that makes it different from start block. Please also note that view of parity block usually contains much more non-zero bytes.

Using knowledge above let's identify RAID systems (let's call start of data partition of selected drive as 'first block'):

RAID 5:

• Only one first block will contain superblock (Pict.3).
• If stripe size is 64KB (usual for Terastation), the one of first blocks will contain iNodes; first iNode must describe directory (root directory). If root directory had only few files - their names will be in iNode body (like at Pict.4);
• Start block of third drive will contain data or iNodes table.
• Start block of fourth drive will contain parity (Pict. 5).
• If you will try to apply XOR operation to bytes from start blocks of each disk at same byte position you will always get zero result.

RAID 5 could be identified as RAID with only one superblock at start block and with parity. XOR operation over bytes from each start block at same byte position gives zero result.

Drives order is: drive with superblock - first, drive with root directory - second. Drive with parity - fourth; remaining drive is third.

How to check partity:

1. Choose partition offset with non-zero data;
2. Run 'calculator' software (e.g. Windows standard calculator); choose 'View' as 'Scintific' or 'Programming', switch mode from 'Dec' to 'Hex';
3. Type a hexadecimal digit from first drive, press 'Xor' button;
4. Type the hexadecimal digit from the next drive at exactly the same offset and press 'Xor' again;
5. Repeat until the last drive. Before entering data from last drive, calculator must show the same number as it is at specified position of last disk. Doing 'Xor' with it will give zero.

Non-zero value for any of offsets means either calculation error or there are no parity.

RAID 0:

• Only one first block will contain superblock (Pict.3).
• If stripe size is 64KB (usual for Terastation), the one of first blocks will contain iNodes; first iNode must describe directory (root directory). If root directory had only few files - their names will be in iNode body (like at Pict.4);
• Any other first blocks will not contain other superblocks or parity;
• Other drives may contain more iNodes at first block.

RAID0 could be identified as RAID with only one superblock at start block and with no parity.

Drives order is: drive with superblock - first, drive with root directory - second. There are uncertainties for 3rd and 4th drives, however it's possible to try both and find which one is right.

RAID 10/0+1:

• First blocks of two drives will contain valid superblock (Pict.3).
• Other two drives will contain data at start block and for 64KB stripe size they will contain iNodes.

RAID 10/0+1 could be identified as RAID with two superblocks at start blocks.

Drives order is: drive with superblock - first, drive with no superblock (data or iNodes) - second. The are two such pairs and both could be used for data recovery.

RAID 1 and multi-part storage:

• First blocks of each drive will contain valid superblock (Pict.3).

RAID 1/and multi-part storage could be identified as RAID with superblocks at all start blocks.

Drives order is: any drive from RAID 1 gives all the data. For multi-part storage - each drive has individual valid file system.

In case analysis didn't give single-meaning result and some uncertainty still exits - it's recommended to try all remaining combinations and choose the best. The RAID reconstruction with UFS Explorer does not modify data on disks thus you may repeat RAID reconstruction with different parameters.

---

Final notes

If you not sure you can recover data by yourself, it's strongly recommended to bring your NAS to specialized data recovery laboratory to avoid data loss.
In case you are working in data recovery but have difficulties with mass NAS analysis, you may commercially use SysDev Laboratories data recovery services.

---