Hello all, I need some advise with regard to rescuing data from a raid disk. History: I gave a friend a Synology two bay NAS set up as a raid array to store their data safely and suggested that it was backed up regularly to another disk as well for safely. All their family photos for the last 10 years or so are stored there - the only copies. Husband (Windows User) familiarized himself with the Synology and things seemed to be OK. However he decided that I was being overcautious and that extra backup wasn't needed. :-( Unfortunately one of the disks failed and husband in his wisdom decided to 'fix' it and instead wiped all the data from the good disk - disaster. Current: I can access the damaged disk by attaching it to my Kubuntu workstation, reading it with testdisk and all the partitions and data appears to be still there, but I can't see the files because of the RAID filing system. I have tried ddrescue which I have been able to use to copy data from the main partition on the damaged disk onto an old ntfs disk I had lying around but it is still unreadable as the raid filesystem refuses to mount and I still can't see the files. I have the good disk still (no data as it was wiped, but partitions still there) and another spare identical 2 Tb disk as well. All I want is to rescue the photo files from the disk - I can then replace the disks in the Synology NAS and reinstall as well as having the photos safely saved elsewhere. How am i best to proceed?
Hello again, It has been suggested that I probably should have included the following information: There were 2 hard drives, both WD Caviar Greeen 2.0TB Raid 1 I think Ext4 not btrfs Thanks Bob
Hello all,
I need some advise with regard to rescuing data from a raid disk.
History:
I gave a friend a Synology two bay NAS set up as a raid array to store their data safely and suggested that it was backed up regularly to another disk as well for safely. All their family photos for the last 10 years or so are stored there - the only copies.
Husband (Windows User) familiarized himself with the Synology and things seemed to be OK. However he decided that I was being overcautious and that extra backup wasn't needed. :-(
Unfortunately one of the disks failed and husband in his wisdom decided to 'fix' it and instead wiped all the data from the good disk - disaster.
Current:
I can access the damaged disk by attaching it to my Kubuntu workstation, reading it with testdisk and all the partitions and data appears to be still there, but I can't see the files because of the RAID filing system. I have tried ddrescue which I have been able to use to copy data from the main partition on the damaged disk onto an old ntfs disk I had lying around but it is still unreadable as the raid filesystem refuses to mount and I still can't see the files.
I have the good disk still (no data as it was wiped, but partitions still there) and another spare identical 2 Tb disk as well.
All I want is to rescue the photo files from the disk - I can then replace the disks in the Synology NAS and reinstall as well as having the photos safely saved elsewhere.
How am i best to proceed?
_______________________________________________ luv-main mailing list luv-main@luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-main
bob via luv-main <luv-main@luv.asn.au> writes:
I can access the damaged disk by attaching it to my Kubuntu workstation, reading it with testdisk and all the partitions and data appears to be still there, but I can't see the files because of the RAID filing system.
This sort of puzzles me. Under Linux software raid 1, both drives are an identical copy of each other, and you should be able to access each disk independantly. Possibly in this case, there is some sort of proprietary layer between the ext4 and the actual disk partition, in which case you might be out of luck here :-( What exactly do you mean by "I can't see the files because of the RAID filing system."? Have you tried mounting it (readonly) anyway? -- Brian May <brian@linuxpenguins.xyz> https://linuxpenguins.xyz/brian/
Hi Bob, On Fri, Jul 19, 2019 at 10:10:46AM +1000, bob via luv-main wrote:
the RAID filing system. I have tried ddrescue which I have been able to use to copy data from the main partition on the damaged disk onto an old ntfs disk I had lying around but it is still unreadable as the raid filesystem refuses to mount and I still can't see the files.
firstly, my sympathies. raid recoveries are not fun :-/ there's some stuff here, but it looks quite synology specific https://serverfault.com/questions/568166/how-to-recover-an-mdadm-array-on-sy... if you are treating this as a generic linux recovery instead (probably safer IMHO) then yup, ddrescue is the right way to go. hopefully ddrescue didn't report many issues getting data off the drive? first check that the ddrescue image is vaguely ok with eg. file ddrescue.img losetup -P -r /dev/loop0 ddrescue.img to see what it looks like read-only. after that I would not touch the real disk again, or the orig ddrescue image either. make a copy of a the ddrescue image you have, and experiment with loopback mounts on that. losetup -d /dev/loop0 cp ddrescue.img play.img losetup -P /dev/loop0 play.img and then see if you can force mdadm to accept eg. /dev/loop0p2 in degraded mode. mdadm --examine .. I don't know the exact recipe for this that'd work off the top of my head, but it shouldn't be too hard. if something does wrong then you can always start again with another cp from ddrescue.img. you could do quick raid experiments with small loopback filesystems and mdadm too. another hint is that if the filesystem you store the images on supports sparse files then you can likely save some space with cp --sparse=always instead of cp. cheers, robin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, On 19/7/19 10:10 am, bob via luv-main wrote:
I need some advise with regard to rescuing data from a raid disk.
If it's a RAID1 mirror, then why not just try to assemble the RAID with the missing member; it won't be a proper RAID1 now, but it might be accessible in the normal way without the need for ddrescue or other "special tools" to recover photos. Once the RAID is assembled, even without the redundancy, you can then look at normal mounting of file systems that you can find. Cheers A. -----BEGIN PGP SIGNATURE----- iHUEAREIAB0WIQTJAoMHtC6YydLfjUOoFmvLt+/i+wUCXTG2jwAKCRCoFmvLt+/i +1WqAP9DZgH8W/TdPcdQ8jH9tZ9aMEZHcYS7VQSzx7e1oQEHmQEAuK8ouoEYoFRy DETdxIvqz0G6LZVOT21GSKc7yVZ5Ne0= =CLYD -----END PGP SIGNATURE-----
On 19/7/19 10:10 am, bob via luv-main wrote:
I can access the damaged disk by attaching it to my Kubuntu workstation, reading it with testdisk and all the partitions and data appears to be still there, but I can't see the files because of the RAID filing system ... the raid filesystem refuses to mount and I still can't see the files.
Just asking for some clarification: * Are you saying that the files in the image are not visible with a file carving tool such as photorec? I'd only suggest file carving as a last resort as it is time consuming, but I've had success with it particularly for static photo collections which tend to be small files and relatively unfragmented, and you can use the jpg exif data to reconstruct a semi-useful filename. * When the good disk was 'wiped', was it just formatted or completely erased? If you do have to do low level file recovery, it might be better to work with that image instead (assuming you have more spare terabytes of storage lying around to copy it onto!) * When you say raid 'filesystem', are you saying it isn't a standard file system on top of the raid? Or that there is a backup format on top of the filesystem, maybe compressed? All the best with the recovery, Glenn -- pgp: 833A 67F6 1966 EF5F 7AF1 DFF6 75B7 5621 6D65 6D65
Firstly when recovering start by making 2 copies of the raw device on separate hardware. If need be buy 2*4TB disks to store this (the price of the disks is nothing compared to the value of the data). On Friday, 19 July 2019 10:10:46 AM AEST bob via luv-main wrote:
I can access the damaged disk by attaching it to my Kubuntu workstation, reading it with testdisk and all the partitions and data appears to be
How exactly is the disk "damaged"? This will be important later.
still there, but I can't see the files because of the RAID filing system. I have tried ddrescue which I have been able to use to copy data from the main partition on the damaged disk onto an old ntfs disk I had lying around but it is still unreadable as the raid filesystem refuses to mount and I still can't see the files.
When you have an image of the disk stored safely run use losetup to set it up as a loop block device and then kpartx to access the partition table. After doing that run "file -s" on the block devices for the kpartx created partition entries and give us the output. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/
If you can't restore the filesystem you could run "photorec" on it. This essentially ignores partitions and filesystems and looks for any sequence of bytes on the disk which looks like a jpeg (or other file type it knows about). You won't get the file names or directory structures, but it should be easy to try and low risk (tell it to put the found files on a different disk). On 19/7/19 10:10 am, bob via luv-main wrote: Hello all, I need some advise with regard to rescuing data from a raid disk. History: I gave a friend a Synology two bay NAS set up as a raid array to store their data safely and suggested that it was backed up regularly to another disk as well for safely. All their family photos for the last 10 years or so are stored there - the only copies. Husband (Windows User) familiarized himself with the Synology and things seemed to be OK. However he decided that I was being overcautious and that extra backup wasn't needed. :-( Unfortunately one of the disks failed and husband in his wisdom decided to 'fix' it and instead wiped all the data from the good disk - disaster. Current: I can access the damaged disk by attaching it to my Kubuntu workstation, reading it with testdisk and all the partitions and data appears to be still there, but I can't see the files because of the RAID filing system. I have tried ddrescue which I have been able to use to copy data from the main partition on the damaged disk onto an old ntfs disk I had lying around but it is still unreadable as the raid filesystem refuses to mount and I still can't see the files. I have the good disk still (no data as it was wiped, but partitions still there) and another spare identical 2 Tb disk as well. All I want is to rescue the photo files from the disk - I can then replace the disks in the Synology NAS and reinstall as well as having the photos safely saved elsewhere. How am i best to proceed? ------------------------------------------------------------------------ luv-main mailing list luv-main@luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-main
participants (7)
-
Andrew McGlashan -
Brian May -
forums＠wtaustralia.com -
Glenn McIntosh -
Kim Oldfield -
Robin Humble -
Russell Coker