Thursday, May 28, 2009, 02:03 AM - Linux
Posted by Administrator
Posted by Administrator
Background of my problem
A few days ago my Dell XPS 720 decided to die on me. When I push the power button it turns on for about 1/2 second and then turns off. After much debate, I bought a new power supply for it (non-standard of course [24pin AND 20pin power connectors]). Today I received the power supply and low-and-behold that wasn't the problem. Now I need to buy either a motherboard or a new CPU (the existing one is a Core 2 Quad Extreme 3.0). I decided that buying from Dell was a bad choice and I'll just build myself a Phenom II system. Meanwhile, the XPS 720 shipped with 2x 120GB 10k Raptors in a RAID-0 using the sub-par onboard SATA RAID controller. I would just love to get my data off the system, but I can't get it up and running and I'm not going to sink anymore money into it. I decided to figure out exactly how the data was stored on the array members and try to deinterlace it directly into a raw image that I could then mount via loopback device in Linux and copy all my data back out :) It sounds easy, huh? I found this GREAT little python code snippet that does the heavy lifting for me - thanks Simón A. Ruiz!!!
How I recovered the array
First, I noted which SATA ports my drives were plugged into on my XPS and labeled them SATA0 and SATA1 so I would remember (if you already unplugged them, fdisk -l the drives, the one with a valid partition table is SATA0). Once they were labeled, I went to another desktop and popped in an ubuntu 8.10 x64 Desktop CD that I had laying around and booted into the GUI (just so I could get a bigger terminal ;) ). Once in the GUI, I loaded up a couple of terminals and got root with sudo su -. Now I used fdisk to find my drives:
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# fdisk -l /dev/sda
Disk /dev/sda: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x2b242b24
Device Boot Start End Blocks Id System
/dev/sda1 * 1 18935 152095356 7 HPFS/NTFS
/dev/sda2 18936 24036 40973782+ 83 Linux
/dev/sda3 24037 24792 6072570 5 Extended
/dev/sda5 24037 24792 6072538+ 82 Linux swap / Solaris
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# fdisk -l /dev/sdb
Disk /dev/sdb: 160.0 GB, 160000000000 bytes
255 heads, 63 sectors/track, 19452 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x20000000
Device Boot Start End Blocks Id System
/dev/sdb1 1 6 48163+ de Dell Utility
/dev/sdb2 7 1312 10485760 7 HPFS/NTFS
/dev/sdb3 * 1312 38905 301963264 7 HPFS/NTFS
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# fdisk -l /dev/sdc
Disk /dev/sdc: 160.0 GB, 160000000000 bytes
255 heads, 63 sectors/track, 19452 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000
Disk /dev/sdc doesn't contain a valid partition table
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# fdisk -l /dev/sdd
Disk /dev/sdd: 750.1 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x8d399bc0
Device Boot Start End Blocks Id System
/dev/sdd1 1 91201 732572001 7 HPFS/NTFS
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# fdisk -l /dev/sde
Disk /dev/sde: 16.0 GB, 16013852672 bytes
78 heads, 14 sectors/track, 28641 cylinders
Units = cylinders of 1092 * 512 = 559104 bytes
Disk identifier: 0x2c26e771
Device Boot Start End Blocks Id System
/dev/sde1 8 28642 15634496 c W95 FAT32 (LBA)
In my case, sda is my recovery computer's hard drive, sdb is my SATA0 array member, sdc is my SATA1 array member, sdd is my external firewire drive (I'll use this to store the data) and sde is my thumbdrive.
Note how /dev/sdb has a valid partition table and /dev/sdc does not - this is because of how RAID-0 works, it uses striping to put stripes (pieces) of data on each drive, alternating back and forth - the first drive in a RAID-0 should always have the partition table on it since that data is in the first stripe. The stripe size can vary depending on your setup and RAID controller - mine is 64k, so the RAID controller writes 64K of data to SATA0, then the next 64K to SATA1 and so forth.
Next I took the python script from Simón A. Ruiz' blog and modified it to show me a status indication:
#!/usr/bin/python
#
# raid0_deinterlace.py
#
# INTENT = This is a script for deinterlacing two raw dd images
# or drives from a RAID-0 and combine them into a single
# image file
#
# This is strictly experimental.
#
# Original Script By: Simon A. Ruiz; Thursday, May 1, 2008
#
# Modified By: Steve Kamerman; Thursday, May 28, 2009
# Changes: Added status indicator so you can estimate ETA
import datetime
inputFiles = [open("/dev/sdb","rb"),open("/dev/sdc","rb")]
outputFile = open("output","wb")
chunkSize = 65536 # change this to your stripe size in bytes
# And, so as not to have to figure this out every time through the loop...
numFiles = len(inputFiles)
i = 0
a = 0
gb = 0
while True:
if a == 16384:
gb += 1
print 'Copied', gb, 'GB of data', datetime.datetime.now()
a = 0
nextChunk = inputFiles[i%numFiles].read(chunkSize)
if not nextChunk:
print 'Done! No more data.'
break
outputFile.write(nextChunk)
i += 1
a += 1
outputFile.close()
for file in inputFiles:
file.close()
Since I'm using /dev/sdb and /dev/sdc, this script is setup correctly for me. If you are using different devices, change those names in script. You can also point the script at dd images instead of physical drives if that's what you're trying to recover from. This process will create a single file that contains the entire array in raw image form with the name output in the current working directory.
When you run this script you will see a notification for every GB it processes, something like this:
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# ./raid0_deinterlace.py
Copied 1 GB of data 2009-05-27 23:14:30.742032
Copied 2 GB of data 2009-05-27 23:15:01.828132
Copied 3 GB of data 2009-05-27 23:15:33.043268
Copied 4 GB of data 2009-05-27 23:16:04.179799
Copied 5 GB of data 2009-05-27 23:16:35.243319
Copied 6 GB of data 2009-05-27 23:17:06.471911
Copied 7 GB of data 2009-05-27 23:17:37.526823
Copied 8 GB of data 2009-05-27 23:18:09.352929
Copied 9 GB of data 2009-05-27 23:18:40.196855
Copied 10 GB of data 2009-05-27 23:19:11.309716
Copied 11 GB of data 2009-05-27 23:19:42.529761
Copied 12 GB of data 2009-05-27 23:20:13.553971
Copied 13 GB of data 2009-05-27 23:20:44.419778
Copied 14 GB of data 2009-05-27 23:21:15.461924
Copied 15 GB of data 2009-05-27 23:21:46.650109
Copied 16 GB of data 2009-05-27 23:22:17.699218
Copied 17 GB of data 2009-05-27 23:22:48.770149
Copied 18 GB of data 2009-05-27 23:23:19.780599
Copied 19 GB of data 2009-05-27 23:23:51.019963
Copied 20 GB of data 2009-05-27 23:24:22.066913
Copied 21 GB of data 2009-05-27 23:24:59.482170
Copied 22 GB of data 2009-05-27 23:25:33.433475
Copied 23 GB of data 2009-05-27 23:26:04.662601
Copied 24 GB of data 2009-05-27 23:26:36.083603
Copied 25 GB of data 2009-05-27 23:27:09.586955
Copied 26 GB of data 2009-05-27 23:27:39.184255
Copied 27 GB of data 2009-05-27 23:28:19.708569
Copied 28 GB of data 2009-05-27 23:28:51.849345
Copied 29 GB of data 2009-05-27 23:29:23.161374
Copied 30 GB of data 2009-05-27 23:29:54.155994
Copied 31 GB of data 2009-05-27 23:30:25.264944
Copied 32 GB of data 2009-05-27 23:30:56.101558
Here's how to verify that this process is going to work:
Wait for a couple GBs to finish copying, then you can fdisk the new image and even mount it if the entire partition has already been copied! Here's how to check the partition table:
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# fdisk -lu output
You must set cylinders.
You can do this from the extra functions menu.
Disk output: 0 MB, 0 bytes
255 heads, 63 sectors/track, 0 cylinders, total 0 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x20000000
Device Boot Start End Blocks Id System
output1 63 96389 48163+ de Dell Utility
output2 98304 21069823 10485760 7 HPFS/NTFS
Partition 2 has different physical/logical endings:
phys=(1023, 254, 63) logical=(1311, 136, 41)
output3 * 21069824 624996351 301963264 7 HPFS/NTFS
Partition 3 has different physical/logical beginnings (non-Linux?):
phys=(1023, 254, 63) logical=(1311, 136, 42)
Partition 3 has different physical/logical endings:
phys=(1023, 254, 63) logical=(38904, 57, 1)
Don't worry about the errors for now - fdisk isn't happy that the file isn't written completely yet. Meanwhile, I was able to mount my two first partitions since they we very small. Note the starting sector of the partition you want to mount by looking at the fdisk -lu output (the -u displays sectors so it is mandatory). For my first partition, the starting sector is 63 (very very common). Now we are ready to mount the image. The mount command loop option takes a starting offset in bytes, but we see it as a starting sector (63 for me). Multiplying the sectors by 512 gets us the byte offset that mount is looking for. I put this multiplication in the code, so you just need to replace the 63 with your starting sector.
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# mkdir /media/dell
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# mount -o loop,ro,offset=$((63*512)) -t auto output /media/dell
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# ls -al /media/dell/
total 168
drwxr-xr-x 3 root root 16384 1969-12-31 18:00 .
drwxr-xr-x 6 root root 160 2009-05-27 23:57 ..
-rwxr-xr-x 1 root root 726 2007-10-19 12:51 autoexec.bat
-rwxr-xr-x 1 root root 726 2007-08-13 10:45 autoexec.up
-r-xr-xr-x 1 root root 53569 2005-06-21 11:54 command.com
-rwxr-xr-x 1 root root 137 2007-10-19 12:51 config.sys
-rwxr-xr-x 1 root root 137 2007-08-13 10:45 config.up
-rwxr-xr-x 1 root root 85 2007-08-13 10:45 copyup.bat
-r-xr-xr-x 1 root root 29690 2005-07-25 11:48 dellbio.bin
-rwxr-xr-x 1 root root 320 2007-08-13 10:45 delldiag.ini
-r-xr-xr-x 1 root root 33352 2005-06-21 11:54 dellrmk.bin
drwxr-xr-x 2 root root 4096 2007-10-19 12:51 diags
-rwxr-xr-x 1 root root 15299 2007-08-13 10:46 himem.sys
-rwxr-xr-x 1 root root 7 2007-10-29 03:12 oobedone.flg
As you can see, I am able to access the data on that partition just fine! Using this same method, I can access my big partition:
root@ubuntu:/media/750GB EXT/RAID_RECONSTRUCT# mount -o loop,ro,offset=$((624996351*512)) -t auto output /media/xps_c_drive
I'm getting really tired now and my screwdrivers are starting to kick in, so I'm going to call this one finished!




( 2.9 / 16 )

Calendar



