Solved

Iomega StorCenter RAID Failure

Posted on 2013-05-12
13
764 Views
Last Modified: 2013-05-28
The Iomega Storcenter holds the firmware on 20gb of the drives and the data on the rest of the drive.  Unfortunately, the firmware has gotten corrupt.  As a result, the Iomega StorCenter will not present the second part of the data for me to retrieve the data.

Does anyone know how to retrieve the data off a RAID 5e set?  I have used R-Studio and can see the data.  However, I cannot retrieve it as it appears to be an IOMEGA format.
0
Comment
Question by:securitythreat
  • 7
  • 6
13 Comments
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Be specific, "see" the data?  Does that mean you can read 1s and 0s from every block in all HDDs, or that R-Studio has determined the block sizes, drive ordering, but don't know specifics of file system parameters and how to mount them?

What do you mean by "IOMEGA" format.  There is no such thing as an IOMEGA format, or more correctly, that terminology is rather unique, as IOMEGA does not have a proprietary file system.
0
 
LVL 1

Author Comment

by:securitythreat
Comment Utility
Two things make me believe the data exist:

First, I can still see the shares when the drives are in the Iomega StorCenter.  However, I cannot access them as they have permission issues.  I am unable to adjust permissions since the firmware is not allowing the OS to load all the way.

Second, when I scan the disk with R-Studio (http://www.r-studio.com/) it shows that there is data on the map.  However, it doesn't recognize the format which is leading me to believe it doesn't understand how to read whatever format it is that Iomega uses.
0
 
LVL 1

Author Comment

by:securitythreat
Comment Utility
See attached for Scan Information and Partition layout.  I have reason to believe the first set of data is the firmware partition (20gb) and the second is the user data.  The user data is what I'm attempting to retrieve.  The drives are the ST31000520ASCC38
drives.jpg
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Seeing the shares can mean as little as the first 64KB of the filesystem is good on the first drive in the RAID5 set, and the rest of the disks are scrambled in wrong order, or even the block size is too large.

Can you mount read/only and read the entire contents of all files and are they corrupted?  IF not, then you haven't reconstructed properly.

So pick a few files > (256KB * (nDiskDrives - 1)).   Maybe jpg, pdf, movie, something that you can pull up and easily confirm if it works.   Having a file this large insures that stripes at least are correct.  Mount read-only to avoid permission problems.
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Looked at the image.  you do NOT have it reconstructed properly.  Could be any or all of wrong stripe size, incorrect drive ordering.   Starting ending blocks for partitions are going to be wrong because they can't be right if you don't get the first two things correct.
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
P.S. Exactly what model do you have?
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 1

Author Comment

by:securitythreat
Comment Utility
I understand what you saying.  If I go to the Parents tab, seen in the screenshot, the alignment appears correct.(on the left).  The model I'm working with is IX4-200d.

Please forgive my ignorance on this topic as it is not my specially.

In regards to your comment "So pick a few files > (256KB * (nDiskDrives - 1)).   " I am a bit lost.  

I am seeing some files, some of which open ok and some are scrambled.  I am looking for directories and not finding it in the search.  Furthermore, I'm not sure if it is a limitation to the current software, but I do not see most of the .pub files that I know exist.

I do not know how to mount these drives without messing them up.  I believe they are of a Linux format ant I'm on windows at the moment.
0
 
LVL 1

Author Comment

by:securitythreat
Comment Utility
Here was the drive list I tried to attach
drives-list.jpg
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Well, bottom line, I can't walk you through this.  First, you need to be using LINUX.  You need to have scratch disks and image copies of all drives.  You'll have to run diagnostics to assess health and potentially root cause.  You may have had a file system failure and the crappy kernel wrote a new file system on top of what you had.

I'd have to look at hex dumps of partitioning, and even look at the raw data to learn what is really there.

R-Studio is a pretty decent consumer product, but if it just doesn't automatically work out-of-the-box then you'll just have to pay somebody to look at it, as this takes a lot of experience and software that does things RStudio does not.

Sorry.
0
 
LVL 1

Author Comment

by:securitythreat
Comment Utility
I have tried running knoppix live and looking at the partition.  However, I didn't know how to mount them up.  I suppose it is time to read up some more.  Thanks for your assistance
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Don't even *think* of doing this unless you make image backups.  You can use mdadm to reconstruct, but you'll have to figure out the ordering and stripe size by looking at the raw data itself.
0
 
LVL 1

Accepted Solution

by:
securitythreat earned 0 total points
Comment Utility
This ended up being a bust as the tools used saw data but the Iomega StorCenter had already wrote over it.
0
 
LVL 1

Author Closing Comment

by:securitythreat
Comment Utility
Own answer
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Storage devices are generally used to save the data or sometime transfer the data from one computer system to another system. However, sometimes user accidentally erased their important data from the Storage devices. Users have to know how data reco…
The article will include the best Data Recovery Tools along with their Features, Capabilities, and their Download Links. Hope you’ll enjoy it and will choose the one as required by you.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now