Shulou(Shulou.com)06/02 Report--

Description of server data recovery failure

Today's introduction of the data recovery of the server failure is the hard disk offline, the failure server is composed of multiple hard drives of a group of raid5 disk array, due to the server hard disk crash caused by offline, the administrator check the server found that these two hard drives are physical failure, want to restore data must first be on the offline hard disk physical fault repair.

two。 Physical failure repair of hard disk

The server data recovery engineer first detects the two disconnected hard drives. After the hard disk is powered on, the head cannot be found. After separating the PCB to clean the HDA components, it is still impossible to find the power up again. The faulty hard disk can only be physically repaired (photography is prohibited in the clean room, there is no picture here).

3. Reassemble RAID-5 disk array

Observing the underlying data of all the hard drives in the server, it is found that "55 AA" appears in sector 0 (0x01C2H indicates the type of partition, and "05" is shown here, indicating that this is an extended partition. Therefore, the structural state of the MBR partition is abnormal. Except that hard disk No. 8 is a normal MBR partition, the value at its 0x01C6 represents the header pointing to the next sector GPT.

Figure 1

The value at the 0x01C6 of hard disk No. 7 points to the next sector. But the next sector is clearly not the head of the GPT.

Figure 2

Therefore, the data recovery engineer preliminarily inferred that disk 8 and disk 7 in the array were the first and last hard disk respectively, and the sector where the GPT partition was located started from the 172032 sector, so it was preliminarily determined that the starting sector of the LUN was 172032 sector. The data recovery engineer analyzed the server raid array and found that the stripe size was 1024 sectors. The 1024 sector is divided so that a record is the size of a stripe, and seven disks jump to the same record 283123.

When all 7 disks are located in the same position, the direction of the check area can be judged by comparison, and then the trend of the whole RAID-5 can be judged. It has been judged that disk 8 is the first disk. Put disk 8 in the first position and make sure that RAID-5 is moving to the left. The order of the disk is 8, 2, 3, 4, 1, 7, 5.

The engineer initially determined that the starting sector of the LUN is 172032 sector. Use the data recovery tool to jump to the 172032 sector to observe the use of the hard disk. Normally, the No. 5 disk in the stripe to which this sector belongs should be the check area, but in fact, it shows that the check area is disk No. 8. According to the law of the left direction of the raid, the check area of the No. 5 disk should be in the 172032-10240171008 sector, that is, the previous strip. Jump to sector 171008 and find that the check area is disk 5. Therefore, it can be determined that the starting sector of the LUN is 171008 sectors.

Use the data recovery tool to reassemble the raid according to the determined disk order and add it, as shown in the figure. Select RAID-5,Stripe size 512KB, left out of step.

Figure 3

Click Build to reorganize. After grouping, since the data starts from 10248192 sectors, if the professional recovery tool does not have the function to jump to this sector, then the newly assembled RAID must perform another Build reorganization operation with a file. RAID start sector (Start sectors) select 8192, this file can choose the starting sector and size (Count sectors), the following figure is the reorganized raid5 disk array.

Figure 4

4. Server data recovery results

The reconstruction of the RAID-5 disk array has been verified by the customer, and the server data has been recovered successfully.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.