Recently, Darth Data Recovery took over a RAID 5 of an HP server. One of the disks could not be physically identified. So the rest of the three disks were used to recover the data. It was found that the recovered data was abnormal. So I tried to fix the physical fault. Hard drive, fortunately repaired this physical failure of the hard drive, the image is done. So follow the steps below:
1. Participate in the RAID5 combination with the image of the failed hard disk, and the different hard disk combination data is divided into 3 times;
2. Export the data that you think is problematic, try to open it and see if the file is normal.
The result: no matter which disk is missing, the combined data is abnormal, and there is a problem with opening. Using the "escort ship" to detect the redundancy of the four disks, there is data that does not meet the raid5 redundancy information. Based on past experience, it may be possible to directly declare a recovery failure. Suddenly remembered a case I had recovered a long time ago, similar to this case. So combined in a way that does not lack the disk, the result is unexpected: the recovered data can be opened!
From this case, the initial idea is to fall into the Raid5 lack of disk to eliminate the combination of abnormal hard drives, you can certainly determine which disk is not fresh trap. Let's analyze it:
1, Raid5 of 4 discs, if 4 discs are all good, using 4 discs to combine data is certainly no problem, lack of any disc combination data is no problem;
2, Raid5 of 4 discs, if one of the disc data is not fresh, then we can determine which disc data is not fresh by the lack of disc combination verification data;
3. If there is a lack of disk combination and the data is not correct, then we will often give up the next recovery (this situation will occur when there is a physical problem with a disk at the beginning of the takeover, we will try to use the remaining hard disk to recover the data. If the data is wrong, we think there must be a disk data is not fresh, and the hard disk is not in the normal hard disk. When we repair the original broken hard disk, the idea we take is to use this original The bad disk participates in the combination, lacking one of the original good disks, instead of using all the hard disks to combine, it is we ignore this step)
In the array of Raid5 consisting of 4 disks, why are we missing any of the disk combination data is wrong? And using all the hard disk combination data is right? Maybe in the data recovery industry, some people have encountered this problem, and maybe I didn't want to understand what was going on. After some thoughts, I came to the following conclusions:
Because the XOR operation module of the RAID card does not work or an exception occurs, the data block is successfully written when writing data to the disk array, but the redundancy (check) block is not successfully written or the XOR operation error results in an incorrect result. Write the check block position, so we get a wrong result when we use the tool to calculate the XOR result of 4 disks, we think there is a bad disk. Because the data block is written normally and the check block is wrong, we can't combine it with the lack of disk. It must be combined with all the hard disks to recover the normal data.
Fat Caster
Ningbo Mywin Caster Co., Ltd. , https://www.mywin-caster.com