irecover on disk images?

[bioster]

My situation:
I have 4 old SCSI hard drives, and I've been told they were running RAID 5.  I no longer have the original controller, and instead am using another controller.  I am not sure how damaged (if at all) these drives are.
I have verified that all four drives work individually (at least, the SCSI controller can see them), but when I plug more than one in at once the SCSI controller sees nothing.

I have purchased iRecovery Pro (just today), and would like to use this to recover the data on these drives.

What I would like to know is whether I can plug the drives in individually, image them, and then run iRecovery on the images.  If I can do that, can you point me to the recommended tools to do the disk imaging?  Also, any sort of FAQ or tutorials on doing this would be appreciated.

[Joep]

Hello,

Yes, that's something you can try. You can use iRecover to create the disk images, I suggest you image the physical disks: right click a disk and select 'create image file'.

[bioster]

Hello again!

I'm attempting to image the disks.  The first disk seemed to go ok, but now I'm doing the second disk.  iRecover 4.0 went through the disk but is now sitting here at a "Writing disk image 100.0% complete" window with just a Cancel button.  On the first disk it closed this dialog.  It doesn't show as "not responding" and the other iRecover windows still look responsive, so I don't think it's hung.  It's also not consuming any CPU resources.

I don't see anything to do with the second disk image in the logfile.txt file.  Just the first disk image.

If I cancel it, is it likely to have completed the image?  Or should I run it again?

[bioster]

Well, I canceled it and tried again.  It seemed to work the second time.

When I ran the recovery, I selected both of the available RAID 5 options and after about an hour it gave me a menu with two options, one that was an MBR partition and the other looked like it was intended to let someone manually configure a partition (define volume?).  When I went to the next screen (volume analysis?), it immediately bailed and told me that there was either no data on the drive or that it was misconfigured.  That dialog exited the app, so I'm basically going on memory here.

In the logfile.txt file I do see a lot of:
ALERT!: MFT entry with alloc size 0 was encountered during identification; Base record ID #

A google search doesn't really tell me what that means.  Can someone fill me in?

I'm trying again with both RAID 5 options checked, and the RAID 0 checked, though I'm not sure if I should be checking the RAID 0 option.  Beyond that, are there any other configuration options I should be looking at? (Are there any guides about for this sort of thing? I didn't see anything on the faq.)

[bioster]

Ok, that finished.  I am currently looking at a 'Select Volume to Process' dialog.
I have one real entry:
ID 04000000
Filesystem Type: Compaq Diagnostic
Offset: 0 MB
Size: 8001 KB
Origin: MBR/Primary

And then I have the 'Define Manually' entry.  Just in case it's useful, I right-clicked on the MBR entry and saved it to an image.

Now, let's select the MBR volume and click next...

"UNABLE TO CONTINUE:
There seem to be no files on the volume.
Unable to continue processing, program will now terminate.
Not a bug - data is probably beyond repair, or something is misconfigured."

Ok, how do I proceed from this point?  A volume size of about 8MB is obviously incorrect.  I'm looking in the logfile.txt and I don't see any obvious errors for when I imaged the four disks.  Here's the relevant log text in case it matters (note that the second disk image is the one I cancelled after it sat at 100.0%... it's not being used, I only added the four presumably good ones):

File management init done with a status of 100
NT 6.1.7600 ; 4095 MB RAM
Open physical drive 00000100 success, 1397 GB : ST31500341AS - Port 2, Bus 0, Target 1, LUN 0; maxLBA=2930277168
Open physical drive 00000101 success, 17365 MB : COMPAQ BD0186349B - Port 6, Bus 0, Target 0, LUN 0; maxLBA=35565080
Starting image writer
Preallocating disk image
Preallocation complete
Imager starting forward pass
Imager starting reverse pass with 0 ranges
Finished image writer
TS: Stop validation
TS: Stopped validation
Logging - shut down
Init done - logging
File management init done with a status of 100
NT 6.1.7600 ; 4095 MB RAM
Open physical drive 00000100 success, 1397 GB : ST31500341AS - Port 2, Bus 0, Target 1, LUN 0; maxLBA=2930277168
Open physical drive 00000101 success, 17365 MB : COMPAQ BD0186459A - Port 6, Bus 0, Target 0, LUN 0; maxLBA=35565080
Starting image writer
Preallocating disk image
Preallocation complete
Imager starting forward pass
Imager starting reverse pass with 0 ranges
Finished image writer
TS: Stop validation
TS: Stopped validation
Logging - shut down
Init done - logging
File management init done with a status of 100
NT 6.1.7600 ; 4095 MB RAM
Open physical drive 00000100 success, 1397 GB : ST31500341AS - Port 2, Bus 0, Target 1, LUN 0; maxLBA=2930277168
Open physical drive 00000101 success, 17365 MB : COMPAQ BD0186459A - Port 6, Bus 0, Target 0, LUN 0; maxLBA=35565080
Starting image writer
Preallocating disk image
Preallocation complete
Imager starting forward pass
Imager starting reverse pass with 0 ranges
Finished image writer
TS: Stop validation
TS: Stopped validation
Logging - shut down
Init done - logging
File management init done with a status of 100
NT 6.1.7600 ; 4095 MB RAM
Open physical drive 00000100 success, 1397 GB : ST31500341AS - Port 2, Bus 0, Target 1, LUN 0; maxLBA=2930277168
Open physical drive 00000101 success, 17365 MB : COMPAQ BD0186349B - Port 6, Bus 0, Target 0, LUN 0; maxLBA=35565080
Starting image writer
Preallocating disk image
Preallocation complete
Imager starting forward pass
Imager starting reverse pass with 0 ranges
Finished image writer
TS: Stop validation
TS: Stopped validation
Logging - shut down
Init done - logging
File management init done with a status of 100
NT 6.1.7600 ; 4095 MB RAM
Open physical drive 00000100 success, 1397 GB : ST31500341AS - Port 2, Bus 0, Target 1, LUN 0; maxLBA=2930277168
Open physical drive 00000101 success, 17365 MB : COMPAQ BD01864544 - Port 6, Bus 0, Target 0, LUN 0; maxLBA=35565080
Starting image writer
Preallocating disk image
Preallocation complete
Imager starting forward pass
Imager starting reverse pass with 0 ranges
Finished image writer
TS: Stop validation
TS: Stopped validation
Logging - shut down

--------------------------------------------------

And a partial log for when I run the images:

File management init done with a status of 100
NT 6.1.7600 ; 4095 MB RAM
Open physical drive 00000100 success, 1397 GB : ST31500341AS - Port 2, Bus 0, Target 1, LUN 0; maxLBA=2930277168
Open physical drive 00000200 success, 17365 MB : C:\SCSI Disk Images\DiskA.img
Open physical drive 00000201 success, 17365 MB : C:\SCSI Disk Images\DiskB_try2.img
Open physical drive 00000202 success, 17365 MB : C:\SCSI Disk Images\DiskC.img
Open physical drive 00000203 success, 17365 MB : C:\SCSI Disk Images\DiskD.img
Open physical drive 00000100 success, 1397 GB : ST31500341AS - Port 2, Bus 0, Target 1, LUN 0; maxLBA=2930277168
Starting RAID5 parity check
Parity detected in 1% of 200 tests
One drive will be rebuit for RAID5 tests
Raw scanner starting on disk 0200 from LBA 0 to LBA 35565056
Raw scanner starting on disk 0201 from LBA 0 to LBA 35565056
Raw scanner starting on disk 0202 from LBA 0 to LBA 35565056
Raw scanner starting on disk 0203 from LBA 0 to LBA 35565056
ALERT!: MFT entry with alloc size 0 was encountered during identification; Base record ID 3440000

----------------------------

Now, I get a lot of those alerts.  Most are alloc size 0, but occasionally there's a large number there instead of 0.  I'm skipping these because there are quite a lot of them.

In with those alerts is:
QS LSIDE: 0
QS RSIDE: 2453
Quick scan failed, reverting to full scan mode
QS LSIDE: 0
QS RSIDE: 2300
Quick scan failed, reverting to full scan mode
QS LSIDE: 0
QS RSIDE: 3351
Quick scan failed, reverting to full scan mode
QS LSIDE: 0
QS RSIDE: 1127
Quick scan failed, reverting to full scan mode

----------------------------

And then after that is:

AS start
Performance: Ident data query (27062 of 27062) 0s
Performance: Ident data query (28909 of 28909) 0s
Performance: Ident data query (21653 of 21653) 0s
Performance: Ident data query (24843 of 24843) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (27062 of 27062) 0s
AS done
Performance: Ident data query (12495 of 27062) 0s
RAID: fetch 12495 entries, drive 0200
Performance: Ident data query (14458 of 28909) 0s
RAID: fetch 14458 entries, drive 0201
Performance: Ident data query (13067 of 21653) 0s
RAID: fetch 13067 entries, drive 0202
Performance: Ident data query (13598 of 24843) 0s
RAID: fetch 13598 entries, drive 0203
Performance: Ident data query (12495 of 27062) 0s
RAID: fetch 12495 entries, drive 0500
Sequencer start
Sequencer start
Sequencer start
Sequencer start
Sequencer start
Sequencer start - 2
Sequencer start - 1
Sequencer start - 3
Sequencer start - 4
Sequencer start - 0
Sequencer done - 0
Sequencer done - 1
Sequencer done - 3
Sequencer done - 2
Sequencer done - 4
Performance: BuildSwitchList 2m 31s
Vote RAID stripe size: 32; Count=333 ; separation 98.8%
Purged a total of 2226 known false positives (stripe size mismatched)
Remaining 777 records
Vote Start offset: 0; Count=771 ; separation 99.7%
RAID: Test RAID0
Vote RAID starting disk: 514; Count=277 ; separation 45.5%
Vote Next disk for 0202: 513; Count=65 ; separation 10.8%
Vote Next disk for 0201: 514; Count=76 ; separation 19.7%
RAID loop closed
Performance: Ident data query (14517 of 27062) 0s
Parity for disk 0200 at 4
ALERT!: Too low separation (2857 vs. 2903)
ALERT!: Too low separation (2857 vs. 2981)
ALERT!: Too low separation (2857 vs. 2909)
ALERT!: Too low separation (2857 vs. 2867)
Performance: Ident data query (14401 of 28909) 0s
Parity for disk 0201 at 3
ALERT!: Too low separation (2840 vs. 2844)
ALERT!: Too low separation (2840 vs. 2931)
ALERT!: Too low separation (2840 vs. 2877)
ALERT!: Too low separation (2840 vs. 2909)
Performance: Ident data query (8546 of 21653) 0s
Parity for disk 0202 at 3
ALERT!: Too low separation (1539 vs. 1742)
ALERT!: Too low separation (1539 vs. 1832)
ALERT!: Too low separation (1539 vs. 1829)
ALERT!: Too low separation (1539 vs. 1604)
Performance: Ident data query (11205 of 24843) 0s
Parity for disk 0203 at 3
ALERT!: Too low separation (2168 vs. 2284)
ALERT!: Too low separation (2168 vs. 2200)
ALERT!: Too low separation (2168 vs. 2241)
ALERT!: Too low separation (2168 vs. 2312)
Performance: Ident data query (14517 of 27062) 0s
Parity for disk 0500 at 4
ALERT!: Too low separation (2857 vs. 2903)
ALERT!: Too low separation (2857 vs. 2981)
ALERT!: Too low separation (2857 vs. 2909)
ALERT!: Too low separation (2857 vs. 2867)
Parity index conflict between 0200 and 0500
Parity index conflict between 0201 and 0202
Parity index conflict between 0202 and 0201
Parity index conflict between 0203 and 0201
Parity index conflict between 0500 and 0200
RAID: Test RAID5/Checkerboard
Vote Starting disk: 514; Count=277 ; separation 45.5%
Vote Next disk for 0202: -1; Count=0 ; separation exact
RAID: Test RAID5/LDM
Vote LDM start disk: 515; Count=147 ; separation 10.2%
LDM disk 0: 0203
LDM disk 1: 0200
LDM disk 2: 0500
LDM disk 3: 0201
LDM disk 4: 0202
Vote Parity rot RAID5 (MS/LDM): 0; Count=2 ; separation 50.0%
Rotation parameters for array type RAID5 (MS/LDM) start 4 rotation 0
ALERT!: LDM rotation parameters mismatch
Final nonzero RAID layout scores
RAID0 (Stripe set):18.92
RAID5 (MS/LDM):81.85
Virtual RAID settings changed for Virtual RAID #0
-------------------------------------
Volume information for ID 00000000
Origin             : Reconstructed RAID
Partition type     : Unknown
Capacity           : 69463 MB
Number of sectors  : 142260224
RAID type          : RAID5 (MS/LDM)
Stripe size        : 32
Rotation parameters: 4 / 0
Member 00          : 35565056 sectors at LBA 0 on device 0203
Member 01          : 35565056 sectors at LBA 0 on device 0200
Member 02          : 35565056 sectors at LBA 0 on device 0500
Member 03          : 35565056 sectors at LBA 0 on device 0201
Member 04          : 35565056 sectors at LBA 0 on device 0202
The device C:\SCSI Disk Images\DiskD.img, ID 0203 is not S.M.A.R.T.-capable
The device C:\SCSI Disk Images\DiskA.img, ID 0200 is not S.M.A.R.T.-capable
The device Parity disk #0, ID 0500 is not S.M.A.R.T.-capable
The device C:\SCSI Disk Images\DiskB_try2.img, ID 0201 is not S.M.A.R.T.-capable
The device C:\SCSI Disk Images\DiskC.img, ID 0202 is not S.M.A.R.T.-capable
Loading RAID ID transform
Done loading RAID ID transform
Sector 0, row 1 - 0/0 @ base 0 - Empty
Sector 0, row 2 - 0/0 @ base 0 - Empty
Sector 0, row 3 - 63/16002 @ base 0 - Compaq Diagnostic
Sector 0, row 4 - 0/0 @ base 0 - Empty
Ldm: started processing of the device 0200
Ldm: started processing of the device 0201
Ldm: started processing of the device 0202
Ldm: started processing of the device 0203
Ldm: started processing of the device 0100
Ldm: started processing of the device 0500
Ldm: started processing of the device 0400
Starting image writer
Preallocating disk image
Preallocation complete
Imager starting forward pass
Imager starting reverse pass with 0 ranges
Finished image writer
Processing volume ID 04000000
-------------------------------------
Volume information for ID 04000000
Origin             : MBR/Primary
Partition type     : Compaq Diagnostic
Capacity           : 8001 KB
Number of sectors  : 16002
RAID type          : Simple volume
Stripe size        : 1
Rotation parameters: 0 / 0
Member 00          : 16002 sectors at LBA 63 on device 0400
The device Virtual RAID #0, ID 0400 is not S.M.A.R.T.-capable
-------------------------------------
Volume information for ID 04000000
Origin             : MBR/Primary
Partition type     : Compaq Diagnostic
Capacity           : 8001 KB
Number of sectors  : 16002
RAID type          : Simple volume
Stripe size        : 1
Rotation parameters: 0 / 0
Member 00          : 16002 sectors at LBA 63 on device 0400
The device Virtual RAID #0, ID 0400 is not S.M.A.R.T.-capable
Starting raw scanner for a total of 16002 sectors
Raw scanner starting on disk 0400 from LBA 63 to LBA 16065
QS RAID INHIBIT
QS SIZE INHIBIT
AS start
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (106444 of 106444) 0s
AS done
Object count : Unknown   0
Object count : Physcially bad   0
Object count : FAT16 boot sector   1
Object count : FAT32 boot sector   0
Object count : FAT16 sector   65
Object count : FAT32 sector   0
Object count : NTFS boot sector   0
Object count : NTFS MFT entry   0
Object count : NTFS INDX block   0
Object count : NTFS RSTR block   0
Object count : NTFS RCRD block   0
Object count : ext2/3/4 superblock   0
Object count : JFS superblock   0
Object count : ReiserFs superblock   0
Object count : Whole FAT directory   0
Object count : Start of FAT directory   0
Object count : FAT directory run   57
Object count : GIF image   0
Object count : JPEG image   0
Object count : TIFF image   0
Object count : WAV sound   0
Object count : ZIP archive   0
Object count : RAR archive   0
Object count : EXE/DLL DOS/Windows executable module   15
Object count : OLE Structured Storage   0
Object count : MP4 video   0
Object count : Adobe PDF   0
Object count : PNG image   0
Object count : Real Media   0
Object count : LNK shortcut   0
Object count : MIDI   0
Object count : CAB archive   0
Object count : CHM help file   0
Object count : CRW Canon raw image   0
Object count : MOV Quick Time movie   0
Object count : ICM color profile   0
Object count : GZip archive   0
Object count : Olympus RAW (ORF)   0
Object count : AVI video   0
Object count : AMR audio   0
Object count : BMP bitmap image   0
Object count : MRW Minolta Raw   0
Vote filesystem type: 2; Count=456 ; separation 100.0%
Detected filesystem type : FAT
Volume processing  - Detect parameters start
Performance: Ident data query (15 of 138) 0s
CF=2: 100.0%
CF=4: 100.0%
CF=8: 78.6%
Determined CF=4
Volume processing - Detect parameters started
Solver purged 0 B
Performance: Slow solve CF/SS for FAT 0s
Solver: decoupled input 42/81
Autotrim status 1
CFLAGS -----------------------X------------------
RFLAGS ------------------------------------------
Vote Decoupled SS (001): 8801; Count=47 ; separation 31.9%
Vote Decoupled SS (002): 8242; Count=32 ; separation 3.1%
Vote Decoupled SS (004): 7082; Count=46 ; separation 6.5%
Vote Decoupled SS (008): 4822; Count=48 ; separation 2.1%
Vote Decoupled SS (016): 8622; Count=34 ; separation 2.9%
Vote Decoupled SS (032): -10626; Count=45 ; separation 20.0%
Vote Decoupled SS (064): -28194; Count=35 ; separation 28.6%
Vote Decoupled SS (128): -57322; Count=22 ; separation 13.6%
Vote Decoupled SS (256): -147746; Count=31 ; separation 38.7%
Performance: Solver: decoupled CF/SS 0s
CF/SS: 8/4822
Volume processing - Detect parameters complete
Volume processing - Parse filesystem start
Volume processing - Parse filesystem started
FAT type is FAT16
Vote FAT start vote: 4426; Count=11 ; separation 90.9%
Vote FAT size vote: 32; Count=96 ; separation 33.3%
FAT Start/Size : 4426/32
Performance: Ident data query (0 of 138) 0s
Performance: Ident data query (57 of 138) 0s
Performance: Initial directory read-in 0s
FAT directory read-in complete
Performance: Directory tree processing 0s
Blank FAT32 root created
10
Root check loop done with 0 objects
Performance: Fix FAT16/32 root 0s
Volume processing - Parse filesystem complete
Fragment reordering start
No fragments stored, rolling back
FNC STATUS: 18 B of 36 B, 50%
Scavenger starting
Scavenger started
Starting 8 worker(s)
Object ROOT has been marked for deletion (empty)
Started 8 worker(s)
Done 8 worker(s)
Started tree mods
Done tree mods
Start purge
Done purge, 1 objects
Scavenger stopping
Scavenger stopped
Autosave starting
Autosave started
AS start
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (0 of 0) 0s
Performance: Ident data query (106444 of 106444) 0s
Performance: Ident data query (138 of 138) 0s
AS done
Autosave stopping
Autosave stopped
Final TS start
FL load starting
FL load started
FL root operation
UNABLE TO CONTINUE:
There seem to be no files on the volume.
Unable to continue processing, program will now terminate.
Not a bug - data is probably beyond repair, or something is misconfigured.

[Joep]

Hello,

Object count : FAT16 sector   65
Object count : FAT32 sector   0
Object count : NTFS boot sector   0
Object count : NTFS MFT entry   0
Object count : NTFS INDX block   0
Object count : NTFS RSTR block   0
Object count : NTFS RCRD block   0
Object count : ext2/3/4 superblock   0
Object count : JFS superblock   0
Object count : ReiserFs superblock   0
Object count : Whole FAT directory   0
Object count : Start of FAT directory   0
Object count : FAT directory run   57
Object count : GIF image   0
Object count : JPEG image   0
Object count : TIFF image   0
Object count : WAV sound   0
Object count : ZIP archive   0
Object count : RAR archive   0
Object count : EXE/DLL DOS/Windows executable module   15
Object count : OLE Structured Storage   0
Object count : MP4 video   0
Object count : Adobe PDF   0
Object count : PNG image   0
Object count : Real Media   0
Object count : LNK shortcut   0
Object count : MIDI   0
Object count : CAB archive   0
Object count : CHM help file   0
Object count : CRW Canon raw image   0
Object count : MOV Quick Time movie   0
Object count : ICM color profile   0
Object count : GZip archive   0
Object count : Olympus RAW (ORF)   0
Object count : AVI video   0
Object count : AMR audio   0
Object count : BMP bitmap image   0
Object count : MRW Minolta Raw   0

What was on that array? Because we do not find anything, almost. No known file formats, almost no file system structures.

[bioster]

Well, it's been quite a few years since the disks have been used so we're working on old (and possibly poorly remembered) memories, but it should be a development environment for a software product.

Is it normal for the volume to be only about 8MB?

[Joep]

Hello,

The 8 MB volume appears some compaq diagnostic/utility partition and will not contain anything of interest.

But I fear we don't have much luck reconstructung the array. For starters iRecover assumes/determines one disk is missing. If this is not the case (so you are sure there were only 4 disks) then this indicative for conflicting information on the disks.

Normally if you'd look at a sector on one disk, XOR that with that same LBA sector on the next disk, and XOR that again with the next, you can calculate what info should be on the next array member in the sector with the same LBA address. If that does not match, iRecover will assume we're missing an array member. If indeed a disk is missing we can calculate what should be on the missing disk. If it is however certain what we have all disks, then one disk (at least) does not have the correct information on it.

With that happening it can sometimes be worth it to experiment and analyze 3 disks instead of 4 and try that for different combinations. That way, if ONE of the 4 disks was corrupted, results could be improved.

[bioster]

Well, I ran a strings program on one of the images.  There's definitely data there.

I've also found out that the raid was being run on Novell Netware.  Probably 5.x given the timing.  Is that the problem?  Looking at the wikipedia page for NetWare File System, I see it was "based on a heavily-modified version of FAT".

[Joep]

Hi,

We can't do anything with netware file systems. See if those guys can help: http://www.portlock.com/.