Useful Tips in Data Recovery
Case Study 4 - Data recovery from RAID1E
RAID1E is a rare array type, that’s why our software hasn't supported it earlier -
there was neither automatic nor manual recovery. However, recently we have faced a case involving data recovery
from an array created by the LSI SAS3041e controller. First, we searched the web for the controller documentation and
discovered that the LSI SAS3041e controller supports the following
RAID levels -Integrated RAID0, IR RAID1, and IR RAID 1E.
As usual, we started the recovery process with the Content analysis and got the following:
Obviously, there are no mirror disks. According to the entropy data, we can highlight Disk 5.
Then we launched the entropy analysis and got this picture:
The disk set doesn't look like a disk set from an array having parity blocks. Disk 5 still differs from the others.
Theoretically, this picture is consistent with the documentation data indicating that the controller doesn't
support RAID5 and RAID6.
Now we need to detect what the array type is used – RAID1, RAID1E, or RAID0. We can definitely say that this is not a
RAID1 since there are no mirror pairs, but how to distinguish between RAID1E and RAID0? Let's remember the theory and
see what types of RAID1E arrays exist. Generally, there are three RAID1E configurations that are sometimes called RAID1E near,
RAID1E interleaved, and RAID1E far.
RAID1E configurations
RAID analyzes available in ReclaiMe Pro do not allow to determine that we are dealing with a RAID1E,
not to mention telling RAID1E near from RAID1E far and from RAID1E interleaved, so we decided to add a new analysis -
a mirror map for RAID1E. Unlike all other content analyzes, for the RAID1E mirror map, you have to specify
the block size manually. So, we got several pictures for different block sizes.
32 KB block size:
64 KB block size:
128 KB block size:
The same color indicates mirror blocks on different disks. We see that for 64 KB block size the mirror
blocks distribution looks like a typical distribution for a RAID1E interleaved where you have mirror blocks distributed over adjacent rows. As far as the disk order goes,
you can try this one: disk 3-> disk-5> disk 6-> disk 8.
The next step is to set the parameters for the manual configuration - we have added RAID1E support to ReclaiMe Pro.
So, the block size is 64 KB, the disk order is Disk 3 – Disk 5 – Disk 6 – Disk 8, the array type is RAID1E interleaved.
Once we set the configuration, we got the partitions:
Launched filesystem scanning on the partition and got a good recovery result:
We can see a normal boot sector in the preview meaning that the. vmdk file is correct and the recovery
in general is successful.
As for the automatic RAID recovery, it should have been done with the following settings:
However, in this case the automatic recovery has failed since Disk 5 and Disk 6 are not a complete mirror.
So, based on the recovery case, we added the RAID1E mirror blocks analysis and both manual and automatic
RAID1E recovery to ReclaiMe Pro.