[clug] RAID recovery with lost metadata

[Alex Ferrara]

Hi everyone,

Firstly, can I say that this is a disaster recovery exercise and not my last resort to recover data. I do have good backups. The fact that I will be recovering a Windows disk is not really relevant as I want to use Linux tools to do so.

The scenario goes like this. I am looking after a server (in this case Windows 2008 R2), and it is installed on 4xWD 150GB Raptors in a RAID-10 configuration. The raid controller (Adaptec 3805 SATA/SAS 8-port) started beeping, indicating a degraded array. Upon running the software, I found that one of the hard drives are faulty and have been removed from the array. I replaced the failed disk with a new disk of the exact same type and then the fun began.

The beeping stopped, but then I noticed that the server had rebooted itself. Upon the RAID bios coming up, it indicated that only 1 out of 4 disks had valid metadata (hooray for Adaptec). So I have 3 disks that *could* make up a degraded RAID-10, but the raid controller doesn't recognise the disks.

I have performed the following;

- Used dd to make a bitwise disk image of each of the three disks.
- Used dd to extract some data from the middle of each disk for comparison sake
- Determined that two of the images are "identical" (the same side of the raid 0)

My question is, where to from here. Somehow, I need to determine the stripe size and then somehow I need to recreate a disk image from these two striped images. Somewhere in there we have disk metadata, which I am guessing needs to be ignored. What, if any tools exist for this kind of work?

Does anyone on the list have strong disk-fu?

aF