How to reassemble files from bytes after drive recovery

[FirstTimer]

I had several drives in my RAID5 array die at the same time. I shipped them off to a recovery service, who claim that they've been able to pull all the bits off the drives. They don't, however, seem to be able to recombine the bits back into a filesystem. I think they're more familiar with hardware RAID.

Are there any existing tools that could help them recombine the bits? I imagine they have access to the "standard" drive recovery tools. Is there any technical info that might help them?

Thanks.

 

[Patrick M. Hausen]

Have them give you the byte-wise images of all of your drives. On an arbitrary FreeBSD system with enough space you can turn them into block devices by mdconfig. Then your partitions will be visible to the OS and you should be able to import your pool.

 

[Yorick]

I think I read "RAID5 array". So, is this actually a raidzN pool, or a RAID5 array?

 

[FirstTimer]

I think I read "RAID5 array". So, is this actually a raidzN pool, or a RAID5 array?

Unfortunately, this is stuff that I learn a little about to setup my system, and then forget immediately when I move on. It's also been probably two years since I set that system up.

On the replacement system - assuming that I'm somewhat consistent - it's a 6-disk ZFS RAIDZ1 pool.

I hope that helps.

 

[Patrick M. Hausen]

In that case - get the disk images into a current FreeBSD system ...

 

[Yorick]

Then I'd go with Patrick's advice. I don't have experience with this. I am assuming -t vnode -f file for mdconfig. Not sure about size and cylinder parameters, let Patrick guide you :).

A quick web search finds the -d switch for zpool import: https://docs.oracle.com/cd/E19120-01/open.solaris/817-2271/gaztk/index.html , so you could try the files directly as well, though I don't know that it would work.

 

[FirstTimer]

I will pass thing along to the vendor and see if it's something he can provide or do himself. Thanks for the very quick guidance!

 

[Patrick M. Hausen]

@Yorick -t vnode -f file - precisely. No need to fiddle with geometry. The result will be a /dev/mdN with all the partitions inside.

I have never done this in practice - @FirstTimer if there is money involved to get the data, give me time until tomorrow - I will invest a couple of minutes and try it for you ...

Patrick

 

[Yorick]

Something like this might also work, just obviously not sparse files:

Code:

thorsten@raidz-expand:~$ sudo zpool import -d zfile/
[sudo] password for thorsten:
   pool: expool
     id: 16959442244845269796
  state: ONLINE
 action: The pool can be imported using its name or numeric identifier.
 config:

    expool                                 ONLINE
      raidz1-0                             ONLINE
        /home/thorsten/zfile/sparse_disk1  ONLINE
        /home/thorsten/zfile/sparse_disk2  ONLINE
        /home/thorsten/zfile/sparse_disk3  ONLINE
        /home/thorsten/zfile/sparse_disk4  ONLINE
thorsten@raidz-expand:~$ sudo zpool import -d zfile/ expool
thorsten@raidz-expand:~$ sudo zpool status
  pool: expool
 state: ONLINE
  scan: none requested
raidz expand: Expansion of vdev 0 copied 1.98G in 0h0m, completed on Tue Apr  7 14:00:24 2020
config:

    NAME                                   STATE     READ WRITE CKSUM
    expool                                 ONLINE       0     0     0
      raidz1-0                             ONLINE       0     0     0
        /home/thorsten/zfile/sparse_disk1  ONLINE       0     0     0
        /home/thorsten/zfile/sparse_disk2  ONLINE       0     0     0
        /home/thorsten/zfile/sparse_disk3  ONLINE       0     0     0
        /home/thorsten/zfile/sparse_disk4  ONLINE       0     0     0

errors: No known data errors

 

[Patrick M. Hausen]

Are these complete disk images, partition table and all? My guess is they are not.

 

[Patrick M. Hausen]

OK, seems to work, partiition table and everything:

Code:

cd /some/dir

for i in 0 1 2 3 4 5
do
    truncate -s 1g disk${i}
    mdconfig -a -f disk${i}
done

gpart create -s gpt md0
gpart add -t freebsd-zfs -a1m md0

for i in 1 2 3 4 5
do
    gpart backup md0 | gpart restore md${i}
done

zpool create testpool raidz2 md0p1 md1p1 md2p1 md3p1 md4p1 md5p1
zpool status testpool

zpool destroy testpool
for i in 0 1 2 3 4 5                                             
do
    mdconfig -d -u ${i}
    rm disk${i}
done

Result:

Code:

  pool: testpool
 state: ONLINE
  scan: none requested
config:

    NAME        STATE     READ WRITE CKSUM
    testpool    ONLINE       0     0     0
      raidz2-0  ONLINE       0     0     0
        md0p1   ONLINE       0     0     0
        md1p1   ONLINE       0     0     0
        md2p1   ONLINE       0     0     0
        md3p1   ONLINE       0     0     0
        md4p1   ONLINE       0     0     0
        md5p1   ONLINE       0     0     0

 

[Yorick]

Nice. So you are taking the raw disk data, minus partitioning data, then throw it into an md with a gpt partition table, and you are off to the races. Cool test!

 

[FirstTimer]

Crap, it turns out I misunderstood the vendor. They have images for 3 of the 6, but they're still fighting with some unreadable sectors on the others.

I'll hold onto this thread, which might help if they're eventually successful.

Thanks!

 

[Patrick M. Hausen]

@Yorick I fear you misunderstood me. You take the raw disk data, which includes the partition table, and turn it into an md device. That will give you mdNpM, which you can then access as a pool component just like adaNpM or whatever ...