Recover mdadm raid

[ptmuldoon]

I have a 5 x 1TB Raid5 build using mdadm in ubuntu that I'm hoping to recover.  Basically, here's the background on what has happened.  Mainly my fault for screwing with a working system.

I attempted to resize the file system down from 5 drives to 4 drives since I do not need the full space, with only about 1.5TB in actual media an the raid.  However, I had a power failure during the resize and can not longer mount the raid (dev/md0) because of a bad superblock

After lots of reading, I tried to repair the superblock on /dev/md0 from a backup, but am still getting file system errors and can't mount it.  Next, I tried to recreate the /dev/md0 raid as I read in recreating the raid will not harm the actual data on it.  However, I still can't mount it.

Thus, I pulled all 5 drives, and now have them scanning with irecover.   It has been a very slow scan, but I figure that's because of the large disk/file size.  Its been going now for a little over 24hrs, and I do have a large amount 'blue' data being shown in the scan.

At this point, I'm just hoping to recover and move the data off to an external drive, and than start fresh with the drives.  To my knowledge, all the drives are ok and working and have not failed, and just the power failure during the resize has screwed things up.

Any one have any suggestions?  Am I on the right track?

Please note, I'm using the 'demo' to scan the drives right now.  Assuming it finds the data, I believe I will need first purchase the license, and than rescan the drives again correct?  Or can you enter the license after the scan?

Thanks in advance for a tips or advice.
PT

[Joep]

Hello,

For those arrays there are 2 options. Scan the array using RAID reconstruction like you're doing now, or see if iRecover picks up the array. For the latter you need to enable 'scan for md-raid volumes' in the disks and partitions TAB of the configuration settings. By default that's off. And once you'd have done that you'd pick the normal Linux and Windows partition recovery option and see if the array appears.

Once you have scanned you can enter a license key without the need to rescan.

[ptmuldoon]

I started with the Raid Constructor, and its 70% through the Step 3 "Volume Analysis" at this point, and is showing/finding a lot of blue data fragments, and only 1 bad sector at this point.   I'm hoping it completes later today to see what it may have found.

I'm not in any rush to recover the data, as it mainly just home media, but definitely hoping to recover all our home pictures, as I can't replace those.  Even after its done, I may even try Option 2 you mentioned, to enable the scan for md-raid volumes, and see if that finds and recovers things any better.

I'll keep you posted on its status, and how it goes.    And if anyone else has any tips, I'm definitely open to suggestions.

[ptmuldoon]

Well, bad news so far......

After finishing stage 3, it went all the way to 100%, it than gave a "Severe Error" message saying it was unable to continue, and there were no files.  Does this seem strange as the scan is showing a lot of data fragments? And when clicking ok, it just closes the program, without at least saving it.

I'm going to likely try option 2 you mentioned, but now i'm getting worried.  

Should I send the log file to anyone to take a look at?

[Tom]

Should I send the log file to anyone to take a look at?

Yes, zip it up and attach it to a posting. Find the log in the program's install folder.

[ptmuldoon]

I saved a copy of the log file before trying again with Option 2.  And with Option 2 and scan for md-raid volumes check, irecover identified 2 of the 5 drives in the raid, so not sure if that will find enough or not.  Its scanning right now.

Attached is the log file as well.  Hopefully it sheds some light on things.  Really hoping to recover something.  And was just reading some more here about maybe trying again with mdadm in ubuntu

http://blog.al4.co.nz/2011/03/recovering-a-raid5-mdadm-array-with-two-failed-devices/

EDIT:  I'm told the upload folder is full, and the post will not accept the attachment.  I did just check the zip, and its saying it a little over 2MB, thus I uploaded it here:
http://d01.megashares.com/dl/Fl6HziR/logfile.zip

[Joep]

Hello,

I cleaned up our attachments folder so you can try again, it should work now. The megashare site doesn't give me access:

"All download slots for this link are currently filled.
Please try again momentarily."

I'm not going to try again.

iRecover finding data fragments is to be expected *even* on a file-system type it doesn't know. If there are known file types on the disk(s) like .BMP or .JPG files then iRecover will show blue dots.
The green dots indicate that we find file system structures (like the MFT on NTFS). If we don't find those or too little of them then we can't build a virtual file system. What was the file system type volumes were formatted with?

And was just reading some more here about maybe trying again with mdadm in ubuntu

http://blog.al4.co.nz/2011/03/recovering-a-raid5-mdadm-array-with-two-failed-devices/

Yeah I am sorry, I can't comment on that but I know there are numerous situations where data appears to be lost but can be made visible by Linux again. But we basically go on the file system structures that we can find on a disk when accessing it on a sector level to recover data and we aren't Linux experts.

[ptmuldoon]

I've attached the zip file again to review.

The file system should be in linux/ubuntu ext4.  Hopefully I can find some way to recover the data.  Again, i'm in rush on it either, just hoping to get some data off the raid. 

Let me know what the log file tells you.

And thanks again for taking the time to help.

[Tom]

It seems iRecover is having a hard time trying to make sense of the disks. The error you've seen is not so much an error but an indication that not enough can be found to create the virtual array. Not surprising, given what happened. In addition there's one disk that has sectors pending for re-allocation (meaning, the disk is having physical problems); this one: WDC WD10EADS-11M2B1, ID 0103.
You could retry the RAID reconstruction with that disk out of the list; 4 out of 5 disks is enough for iRecover to reconstruct data, though it will probably not make a big difference.
Have both options suggested earlier run to completion and did both give bad results?

[ptmuldoon]

The sectors pending for reallocation is likely do to the attempted file system resize that failed.     The second option gave the same problem as well.

I'm attempting now with 4 of the 5 disk in trying to build the raid again via the raid reconstructor.  If that fails, I may try back with mdadm to see if i reconstruct from there.   Again, I really think the data may be fine, just having a tough problem accessing it.   I'm not writing it off just yet, and not in any rush to get it recovered.  Just hoping I can eventually!