Shulou(Shulou.com)06/02 Report--

Introduction to Raid5 disk Array

"RAID 5 is a storage solution that combines storage performance, data security, and storage costs. RAID 5 can be understood as a compromise between RAID 0 and RAID 1. RAID 5 can provide data security for the system, but the degree of protection is lower than that of Mirror and the utilization of disk space is higher than Mirror. RAID 5 has a data read speed similar to that of RAID 0, but with one more parity information, and writing data is slightly slower than writing to a single disk. At the same time, because multiple data correspond to a parity information, RAID 5 has higher disk space utilization and lower storage cost than RAID 1, so it is a widely used solution at present. "

Principle of Raid5 data recovery

Raid5 data recovery has a concept of parity. That is, the "XOR operation" that is often mentioned in raid data recovery, and the identity commonly used is xor. The rule of operation is that if the values of the two are the same, the result is 0, and if the results are different, the result is 1. For example, if 0101 xor 0010 is calculated according to the above operation rules, the first bit of both is 0, and the result is 0; if the values of the second, third and fourth digits are different, the result is 1, so the final result is 0111, expressed by the formula as: 0101 xor 0010 = 0111, so if one of them is missing in a xor bounded c, we can calculate it from other data, which is the key knowledge of raid5 data recovery.

Successful case of Raid5 disk array data recovery

The raid5 disk array of a company was offline by two hard drives that failed. After detection, it was found that both of the offline hard drives had hardware faults. After repairing the hardware, the hardware data recovery engineer looked at the underlying data of the disk array and found that sector 0 showed "55 AA" (0x01C2H indicates the type of partition, and "05" is shown here, indicating that this is an extended partition. Therefore, the structural state of the MBR partition is abnormal. Except that hard disk No. 8 is a normal MBR partition, the value at its 0x01C6 represents the header pointing to the next sector GPT.

Figure 1

The value at the 0x01C6 of hard disk No. 7 points to the next sector. But the next sector is clearly not the head of the GPT.

Figure 2

Therefore, the data recovery engineer preliminarily inferred that disk 8 and disk 7 in the array were the first and last hard disk respectively, and the sector where the GPT partition was located started from the 172032 sector, so it was preliminarily determined that the starting sector of the LUN was 172032 sector. The data recovery engineer analyzed the server raid array and found that the stripe size was 1024 sectors. The 1024 sector is divided so that a record is the size of a stripe, and seven disks jump to the same record 283123.

When all 7 disks are located in the same position, the direction of the check area can be judged by comparison, and then the trend of the whole RAID-5 can be judged. It has been judged that disk 8 is the first disk. Put disk 8 in the first position and make sure that RAID-5 is moving to the left. The order of the disk is 8, 2, 3, 4, 1, 7, 5.

The engineer initially determined that the starting sector of the LUN is 172032 sector. Use the data recovery tool to jump to the 172032 sector to observe the use of the hard disk. Normally, the No. 5 disk in the stripe to which this sector belongs should be the check area, but in fact, it shows that the check area is disk No. 8. According to the law of the left direction of the raid, the check area of the No. 5 disk should be in the 172032-10240171008 sector, that is, the previous strip. Jump to sector 171008 and find that the check area is disk 5. Therefore, it can be determined that the starting sector of the LUN is 171008 sectors.

Use the data recovery tool to reassemble the raid according to the determined disk order and add it, as shown in the figure. Select RAID-5,Stripe size 512KB, left out of step.

Click Build to reorganize. After grouping, since the data starts from 10248192 sectors, if the professional recovery tool does not have the function to jump to this sector, then the newly assembled RAID must perform another Build reorganization operation with a file. The starting sector (Start sectors) of the RAID is selected as 8192. The file can choose the starting sector and size (Count sectors) arbitrarily. The raid5 disk array data has been restored successfully.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.