ReclaiMe Data Recovery Training
Useful Tips in Data Recovery

Case Study 4 - Data recovery from RAID1E

RAID1E is a rare array type, that’s why our software hasn't supported it earlier - there was neither automatic nor manual recovery. However, recently we have faced a case involving data recovery from an array created by the LSI SAS3041e controller. First, we searched the web for the controller documentation (http://vb.net/products/lsilogic/lsisas3041erds.pdf) and discovered that the LSI SAS3041e controller supports the following RAID levels -Integrated RAID0, IR RAID1, and IR RAID 1E.

As usual, we started the recovery process with the Content analysis and got the following:

Obviously, there are no mirror disks. According to the entropy data, we can highlight Disk 5.

Then we launched the entropy analysis and got this picture:

The disk set doesn't look like a disk set from an array having parity blocks. Disk 5 still differs from the others. Theoretically, this picture is consistent with the documentation data indicating that the controller doesn't support RAID5 and RAID6.

Now we need to detect what the array type is used – RAID1, RAID1E, or RAID0. We can definitely say that this is not a RAID1 since there are no mirror pairs, but how to distinguish between RAID1E and RAID0? Let's remember the theory and see what types of RAID1E arrays exist. Generally, there are three RAID1E configurations that are sometimes called RAID1E near, RAID1E interleaved, and RAID1E far.

RAID1E configurations

RAID analyzes available in ReclaiMe Pro do not allow to determine that we are dealing with a RAID1E, not to mention telling RAID1E near from RAID1E far and from RAID1E interleaved, so we decided to add a new analysis - a mirror map for RAID1E. Unlike all other content analyzes, for the RAID1E mirror map, you have to specify the block size manually. So, we got several pictures for different block sizes.

32 KB block size:

64 KB block size:

128 KB block size:

The same color indicates mirror blocks on different disks. We see that for 64 KB block size the mirror blocks distribution looks like a typical distribution for a RAID1E interleaved where you have mirror blocks distributed over adjacent rows. As far as the disk order goes, you can try this one: disk 3-> disk-5> disk 6-> disk 8.

The next step is to set the parameters for the manual configuration - we have added RAID1E support to ReclaiMe Pro.

So, the block size is 64 KB, the disk order is Disk 3 – Disk 5 – Disk 6 – Disk 8, the array type is RAID1E interleaved.

Once we set the configuration, we got the partitions:

Launched filesystem scanning on the partition and got a good recovery result:

We can see a normal boot sector in the preview meaning that the. vmdk file is correct and the recovery in general is successful.

As for the automatic RAID recovery, it should have been done with the following settings:

However, in this case the automatic recovery has failed since Disk 5 and Disk 6 are not a complete mirror.

So, based on the recovery case, we added the RAID1E mirror blocks analysis and both manual and automatic RAID1E recovery to ReclaiMe Pro.

We have a mailing list in which we talk about interesting cases we encounter and share some tips and tricks.