Raid 5 Degraded

[Craig24689]

I have a Dell server with 3 hard drives that make one virtual RAID 5 drive.   One of the drives is more or less dead (SMART, confidence test,....), one is good, and one has some bad blocks.

I was thinking the totally safe way is to make images of the ones I can.  Any recommended software?  Will iRecover do that?  Any imaging SW that will try to work with the bad SMART stuff?  That is all kind of one question.

Can I make the image onto a DVD?  Or do I need drive space.

From there, I assume I can use iRecover to paste the images together as best as it can.  Any gotchas to watch out for?  I've read the FAQ's and some of this forum and the web site page on RAID recovery.

[Joep]

Hello,

If disks are < 2 TB you can use:

- DiskPatch to do a disk to disk copy
- iRecover to do a disk to image file copy

We do not have anything that will allow you to write the copy to DVD. For DiskPatch to clone a disk we need a destination of at least equal size. With iRecover, writing the image file to a compressed NTFS folder may save some space, but iRecover also writes a 1 : 1 image file.

Once you have the 'copies', whether it being actual disks or image files, you use iRecover to analyze them to try to recover the data.

When dealing with RAID 5 iRecover needs at least 2 of the original disks. Keep that in mind as an option. It is better to try that at some point than spending loads of time on the almost dead disk.

[Craig24689]

Thanks. I decided to try without the image.

After the first step (the long one), I got a screen with two things on it that I couldn't understand from the help. It said something like:
Virtual Raid 0   468 GB

 then below that as a second choice was that was indented

    Linux swap 232 GB

I was expecting so see something about RAID 5.  Which do I choose?  I picked the linux choice because it was the right size but neither "sounds" right (The RAID 5 Virtual Array was made up.  thx.

Should I have started differently?

[Craig24689]

Never mind. I went back to the beginning, sigh. Realized I didn't see the drop down RAID 5 vs the other choice.

[Craig24689]

Wow, so I thought I had found about 300 GB of data -- real file names and dates but not one of them will open.  What does that mean?

[Joep]

Hello,

it means something is wrong.

What did you do exactly? How many disks did you use, all 3? After the array was found to be in degraded state what has been tried?

From your description we have one completely unreliable disk. One is partially ok, one is ok. That's not a very good starting point, for RAID 5 recovery we need x-1 good disks. So no matter the number of members, if one is bad, just don't use that one and we should still be ok.

What matters next is how long 'a situation' exists and what was done after the critical situation was discovered. If one disk fails and NOTHING was done after that then in general in RAID 5 we're in good shape. If disks were swapped and (partial) rebuilds were attempted then 9 out of 10 times we're out of luck.

[Craig24689]

Yes, 02 fails smart, 01 is good and 00 has bad blocks.  So, a degraded RAID 5.

I have done nothing other than try to reboot a few times then pull the drives from the server.

I used 00 and 01 to try to rebuild the array.

It acted like it did, found a lot of files in their file structure and more files not in the file structure (
lost files").  Random sample says none of them are good.

Right now I finished imaging 00, which apparently, can't be done in RAID mode.  I am starting to image 01.  After that I will try 02 and see if the software can work around the smart issues.

And, to be complete, the server boots most of the way so it is not really realistic to think that none of the files are bad -- at least given my level of knowledge.

Thoughts?

[Craig24689]

That should have been, it is not really realistic to think that none of the files are good.

[Joep]

Hi,

And, to be complete, the server boots most of the way so it is not really realistic to think that none of the files are bad

Boots from where/what?

I used 00 and 01 to try to rebuild the array.

In iRecover you mean?

[Craig24689]

Before I removed the drives from the server, it would nearly boot.

And, yes, I moved them to a desktop and used iRecover to try to recover the Raid 5 array using 00 and 01.

[Craig24689]

And, another question.  I had to stop it for now but will restart 02 in the morning.  Even though it fails smart tests and the RAID Controller considered it failed, it looks like I can get an image of it.  IF that turns out to be true and I have three images (one with bad blocks, one good and one of undetermined state) should I try 2 of three (00, 01 and 01, 02) for a rebuild or something with all three?

[Joep]

Hello,

SMART failed in itself doesn't mean a whole lot if we don't know which attributes failed. The disk may be reliable. In that case, use it. iRecover can display SMART parameters: right click the individual disk.

I start to get confused more and more:

- You can almost get Windows to boot from the array? If so, then why was the array broken? Why not boot a Windows DVD and see if either Windows can be fixed and/or to mount volumes and copy data to a safe location first?

- You're doing all sorts of stuff, start something, stop it again etc.. I can't follow all that.

- What did the array actually look like? You mention a Linux SWAP partition? Where do you see all that stuff. If you're doing something in iRecover, describe step-by-step or include a screenshot.

Anyway, no need to answer the above, it's to illustrate you can't exepect me to follow all that.

Code:

RAID 5 recovery with iRecover is simple and it either works or it doesn't.

- You need access to the individual disks or raw disk images.

- In case of RAID5 we can still process the array if one disk is missing.

RAID 5 with iRecover involves 2 steps:

- Retrieving array parameters.

- followed by file system analysis. it's the same procedure as analyzing a single disk.

If one of those 2 steps fails then either iRecover will give up (it will say things like, 'no file system', or 'no files found') - or - iRecover may think it has got the correct parameters set but it will recover corrupt data.

To kind of predict the quality of the recovery, iRecover does validation. It will tell this much (%) of a number of files we checked are valid.

If you give us information at any point, it must be complete and not be open for multiple interpretations

Good luck with the wild goose chase!

[Craig24689]

Sorry for the confusion.

Here is the SMART data from 02 -- the one the RAID controller won't use at all:

Device Disk 0 - ST3250310NS S.M.A.R.T. status
ID   Attribute   Value   Worst   Threshold   Raw
1   Read Error Rate   78   63   44   04EC7253
3   Spin Up Time   99   99   0   00000000
4   Start/Stop Count   100   100   20   0000001B
5   Reallocated Sectors Count   1   1   36   000007FF
7   Seek Error Rate   79   60   30   30E5D8969
9   Power On Hours Count   77   77   0   00004F71
10   Spin Retry Count   100   100   97   00000000
12   Power Cycle Count   100   37   20   0000001B
184   Unknown attribute (184)   100   100   99   00000000
187   Unknown attribute (187)   92   92   0   00000008
188   Unknown attribute (188)   100   100   0   00000000
189   Unknown attribute (189)   100   100   0   00000000
190   Unknown attribute (190)   70   66   45   1F1E001E
194   Temperature   30   40   0   120000001E
195   Hardware ECC Recovered   53   37   0   04EC7253
197   Current Pending Sector Count   100   100   0   00000000
198   Off-Line Uncorrectable Sectors Count   100   100   0   00000000
199   Ultra DMA CRC Error Rate   200   200   0   00000000

I don't know how to read it.

Good question on why not load them back in and boot frorm Windows CD.  Dell was leading and we didn't try that.  If I can't image 02, I will try that before proceeding further.

[Tom]

Yes, 02 fails smart, 01 is good and 00 has bad blocks.  So, a degraded RAID 5.

No, that's a BAD raid. The definition of degraded is something quite different. Simply put, this is not a good place to start from, as said before.

IF that turns out to be true and I have three images (one with bad blocks, one good and one of undetermined state) should I try 2 of three (00, 01 and 01, 02) for a rebuild or something with all three?

Worth a try I guess but really not that interesting: if you know that you can more or less trust disks 0 and 1, then why not focus on them? Create images from these 2 disks (so you have a safety net) and get to work with those images. Or, as you have done, work on the 2 disks directly and see what comes up.

And, yes, I moved them to a desktop and used iRecover to try to recover the Raid 5 array using 00 and 01.

That is the correct approach, yes. This or imaging first, as explained above. If this doesn't lead to the results you were hoping for then we probably can't help you further. Much has happened to these disks and it's tricky to get a good idea of the state of these disks.

One more thing: one of the confusions here is the 'almost booting' issue. I have no idea what that means. It either boots or it doesn't. Are there error messages, is there a BSOD, does any Windows display come up? You'll have to put yourself in our mind; we need to know details, or else we can not give accurate advice. If for instance things have booted half way, or Windows has had access to the disks while the RAID was being rebuilt or was in degraded state, things could be a huge mess on those disks and recovery could be impaired by this. So details are everything.