RAID-0 recovery

Hardware & Field

RAID-0 recovery

214,000+ files from a pair of junk disks.

Problem

A pair of Windows disks pulled from a dead machine, previously run as a RAID-0 stripe. No controller to read them, and RAID-0 keeps no standard on-disk metadata once that controller is gone. Guess the stripe parameters wrong and every file is noise. The disks were junk; the data on them was not.

Diagnosis

RAID-0 interleaves data across both disks in fixed-size chunks. To reassemble it in software I needed three things right: chunk size, disk order and starting offset. Get any of them wrong and every file corrupts. My plan: probe candidate parameters, reassemble with the Linux device mapper, mount read-only, and prove the filesystem parses before recovering a single file.

Action

  • Reassembled the stripe pair in Linux with dmsetup striped, probing chunk size, disk order and offset until the filesystem structure parsed
  • Mounted read-only. The originals never change
  • Ran a full recovery pass with Sleuth Kit's tsk_recover: 214,311 files
  • Ran a targeted pass through the NTFS master file table for what mattered most: 157 photos, 1,555 audio files and a pile of Android development data

Outcome

  • 214,000+ files recovered from a stripe set with no working controller
  • 157 real photos, 1,555 audio files, and a pile of development data rescued from what was nearly a wipe
  • A repeatable method: probe, reassemble, verify, recover, and never write to the source disks

What I'd do differently

Pending

Reflection to be written by Jupiter.

Clock
--:--:--—Local time