Rescuing a RAID-0 FAKE-RAID Array

Recently, I zapped my precious motherboard with 220V¹⁾, killing it in the process. I eventually got a replacement board (same make/model) and went about diagnosing the rest of my setup.

Everything checked out except my 500GB RAID-0 array, controlled via my Gigabyte GA-7NNXP OnBoard SATA RAID controller (a Silicon Images 3112, aka Sil3112). The RAID controller correctly assembled the array²⁾, and Windows showed it as a single 500GB drive. However, the drive consisted entirely of “Unallocated Space” according to the Logical Disk Manager.

So here is how I went about getting my data back. I have put this up in the hope that it will be useful to others.

“Know your enemy”

Most OnBoard RAID controllers (which tend to only support RAID-0 and RAID-1) are infact FAKE-RAID controllers, at least this is how they are commonly referred to in geeky forums. They are infact just BIOS implementations of software RAID, you see your operating system still needs drivers to assemble the array. So what's the point? Well, it allows you to boot from one of these array, because the BIOS understands that the two disks are to be treated as one.

It is worth pointing out I am only interested (and familiar) with RAID-0, which is where you stripe data across the array, increasing performance. RAID-1 is commonly referred to as “Mirroring”, and so I can't see you'd have a big problem booting off a mirrored disk, even if the BIOS didn't understand it was mirrored.

The software RAID system is called “Medley”, and is an open-standard. Windows XP Pro SP2 has built-in support for it, and you probably don't need to know the systems name except if you're planning on a hard-core approach to your problem, such as linux.

While I cannot be certain of this, it is my experience that it doesn't matter what order connect your drives to your motherboard, in my case the array was assembled correctly both times. (Though it was still considered unallocated by windows).

The first progress I made was when I used the excellent GetDataBack for NTFS (v2.31). At the time of writing their website doesn't look very impressive at all, but don't let that fool you, I have tried a lot of data-recovery software in the past, I can truly say that GetDataBack hasn't failed me yet.

GetDataBack for NTFS successfully generated a list of available files and allowed me to preview them to check their quality, however the free version is only a demonstration, and while you can preview files, you cannot copy them all back; although you can preview a file and then fetch this 'preview' from your windows temporary directory easily enough.

GetDataBack does not alter your harddrive at all - and there is no way to ask it to. While sensible, it does mean you can't simply re-write the partition table and any NTFS-related bits that may need writing. Having only 11GB of space available on my other drive, I am limited to recovering a DVD's worth at a time, burning it, and then repeating this.

I backed-up the disk-scan results to another PC, and decided to dive into rewriting the partition table (safe in the knowledge that I have a useable index of where the files are, so I won't make things worse unless I do a low-level format).

Linux has a wealth of free software which deals with recovering and analysing disks, so I thought I'd give these a try. Here is where the fun starts.

Linux doesn't detect and assemble FAKE-RAID arrays out-of-the-box, instead you need to compile in support for this sort of thing to the kernal, or otherwise install some special software. While looking into doing this, you need to knwo that the RAID standard used for describing the array is called 'Medley'. After much searching I found a few useful things.

• Infomational
  • Linux SATA RAID FAQ - Lists FAKE-RAID chipsets and links to HOWTOs on how to get them up and running. Informative, but the HOWTOs are only useful if you actually have linux installed on the PC in question.
  • Serial ATA (SATA) on Linux - Thorough source of info on how to get your RAID array recognised
• Applications with good results
  • dmraid - “Discover and Activate Software (ATA)RAID”
    • Gentoo LiveCD with dmraid - A quick way to test if dmraid will work for you, download and burn a bootable ISO, and boot it. Very handy, but lacking in data-recovery utilities.
  • dd_rescue and dd_rhelp - The first is a utility for making disk images from disks with physical faults (bad sectors), and the second is a little front-end for dd_rescue which intelligently skips over bad bits of the disk and comes back to them later, it is designed to be interrupted and to get as much recoverable data as fast as possible. If you don't interrupt it, it'll do the same job as dd_rescue, only with the overhead of jumping around the disk in an effort do the easy bits first.
• Applications which didn't quite work for me, because I used a LiveCD
  • magicrescue - Scans disk surface looking for certain file signatures (such as a JPEG or MP3 header etc) and then intelligently copies the data to another drive. It's simple, and you can write your own 'receipes' to detect other file types.

The last gruop above didn't quite work for me because I don't have (nor intend to have) Linux instaled on the PC which needed rescuing. I love linux, but I don't have a free disk to install it to. Instead I was using bootable LiveCDs of Linux.

The Gentoo LiveCD with dmraid worked well, and assembled my array without problems. If you try this you might find it interesting to try dmraid –native_log and read about your array. This disk is small, but it doesn't have any useful apps for rescuing a disk.

So I tried the Knoppix 4.0.2 LiveDVD and found that it has devfs on it, while I don't know the details of what this does, I do know that I need it to make dmraid work. So I opened a root console, and installed dmraid³⁾. Then I tried dmraid -ay to assemble and activate my array, and then dmraid -s to list raid sets. It showed my set:

*** Set
name   : sil_afagagcecdcb
size   : 976788160
stride : 32
type   : stripe
status : ok
subsets: 0
devs   : 2
spares : 0

Then using gpart on this new device (/dev/mapper/sil_fagagadbcdc) I would have been able to recover the partition; however a friend of mine gave me a copy of PowerQuest PartitionMagic 8.0 (for windows) which managed to undelete my drive in a matter of minutes.