Shulou(Shulou.com)06/02 Report--

1. Description of server data recovery failure

Server model: HP P2000

Server operating system: VMWARE ESX

Server file system: VMFS

Disk array level: RAID-5

The server that needs data recovery mounts 8 hard disks to form a RAID-5 disk array, of which disk 4 is a hot spare. During normal operation, two hard disks of the server turn on × × × fault lights. After detection by the user's maintenance personnel, the faulty hard disk should be a physical fault, as shown by: the serial number cannot be read, and the hard disk cannot be recognized on the SAS expansion card. Data recovery for raid disk array is required

two。 Physical failure repair of hard disk

Due to the serious failure of the server, it is necessary to first determine the cause of the disk drop of the raid array. After receiving the user's server, the engineer first deals with the two disconnected disks in the raid array, connects the bad disk to the external SAS expansion card for power-up detection, and the magnetic head is not sought, the engineer separates the PCB and checks the hard disk HDA components to find some oxidation, and the power-up check still cannot be found after the cleaning operation. So the engineer carried out a very complicated repair work (photography is prohibited in the clean room. There is no drawing in the process of repairing the disk)

Since the hot spare is a normal hard disk, it can be used as a spare disk. So the hardware engineer opened the spare disk (that is, disk 4 in the raid array) and installed the PCB on the faulty disk to replace the PCB of the faulty disk for repair, and then removed and replaced the ROM chip on the faulty disk PCB to the new PCB. After the hardware repair of the hard disk is completed, the faulty hard disk can be detected again, and the sound of head seek is normal, but the sound of knocking is obvious. Because the magnetic head of disk 4 does not match with the fault disk, the hard disk can be identified normally and the data of the fault disk can be mirrored successfully by replacing the head after finding another part.

3. Reassemble RAID-5 disk array

Use the data recovery tool to open 7 disks and find that all the 0 sectors of the hard disk have a "55 AA" flag. The 0x01C2H indicates the type of the partition. "05" is shown here, indicating that this is an extended partition. Therefore, from sector 0, this is an abnormal MBR partition structure.

Continue to search according to this method, and find the sign of "55 AA" on disk 7 and 8 respectively. The query results of disk 8 are as follows. This is a normal MBR partition whose value at 0x01C6 represents the header pointing to the next sector GPT.

The query results of disk 7 are as follows. The value at 0x01C6 indicates that it points to the next sector. But the next sector is clearly not the head of the GPT.

From this, it can be determined that disk 8 is the first disk, and disk 7 may be the last one. The sector in which the GPT partition is located starts at sector 172032, so it is preliminarily determined that the starting sector for LUN is 172032 sector.

Supplementary lessons of knowledge: stripes are also known as raid array blocks, which are the basic units of RAID data processing. Different RAID arrays have different stripe sizes. There is a check area in one stripe group of RAID-5. According to this rule, the raid-5 array can be analyzed, and the stripe size can also be determined by comparison method. If there is a significant difference between the check area in a band group and the non-check area in this band group, you can find the stripe size by checking and comparing it with WinHex. The engineer analyzed the server raid array and found that the stripe size was 1024 sectors.

Split according to 1024 sectors so that a record is the size of a stripe, as shown in figure 5. And 7 disks jump to the same record 283123.

When all 7 disks are located in the same position, the direction of the check area can be judged by comparison, and then the trend of the whole RAID-5 can be judged. It has been judged that disk 8 is the first disk. Put disk 8 in the first position and make sure that RAID-5 is moving to the left. The order of the disk is 8, 2, 3, 4, 1, 7, 5.

The engineer initially determined that the starting sector of the LUN is 172032 sector. Use the data recovery tool to jump to the 172032 sector to observe the use of the hard disk. Normally, the No. 5 disk in the stripe to which this sector belongs should be the check area, but in fact, it shows that the check area is disk No. 8. According to the law of the left direction of the raid, the check area of the No. 5 disk should be in the 172032-10240171008 sector, that is, the previous strip. Jump to sector 171008 and find that the check area is disk 5. Therefore, it can be determined that the starting sector of the LUN is 171008 sectors.

Use the data recovery tool to reassemble the raid according to the determined disk order and add it, as shown in the figure. Select RAID-5,Stripe size 512KB, left out of step.

Click Build to reorganize. After grouping, since the data starts from 10248192 sectors, if the professional recovery tool does not have the function to jump to this sector, then the newly assembled RAID must perform another Build reorganization operation with a file. RAID start sector (Start sectors) select 8192, this file can choose the starting sector and size (Count sectors), the following figure is the reorganized raid5 disk array.

4. Server data recovery results

The reconstruction of the RAID-5 disk array has been verified by the customer, and the server data has been recovered successfully.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.