Welcome to the Data Recovery Portal, where you can find many ways to recover your lost data, and see programs to recover.
Restoring Data RAID arrays simple methods
Introduction
In this article written about data recovery from RAID arrays in simple cases. We use methods that can be learned without having expertise in this area, and for a short time. Cases that can be attributed to the complex, too different from each other, and require an individual approach, so it makes no sense to describe them in one article. However, you can discuss the specific situation in a dedicated section of the forum.
Of course, if the lost information is crucial, and you are not a specialist in media and data recovery, it is highly recommended to go directly to the company, whose main field of activity is the solution of such problems. But if the opportunity is more likely to get back valuable information pales before their own desire to try to restore the data, then this article is for you.
The reasons for withdrawal RAID arrays fail
The most common cause of failure of disk arrays is the negligence system administrators who are counting on that “one bomb crater twice does not fall. During the work, such as RAID 5, the failure of one of the disks. Array continues to operate more correctly, but with a noticeable decrease in speed. System Administrator, noting the failure of the drive, not in a hurry to take action, because expects that the array in a form more able to spend some quality time. It is at times misleading.
If you break down one of the drives, it is best to immediately back up critical data, and then replacing one of the drives, make rebild array.
Why do have to note that you must first make a backup? Because when you try rebilda array, sometimes happens is that the process hangs. Typically, this happens if in the process of reading \ writing on one of the disks found bad-block, and the controller can not deduct information from the sector. As a result, after a long and useless waiting, server overload. After that, it turns out that the array is fully collapsed. Stuck in such cases is likely due to incorrect processing of the exception. Typically, this phenomenon is more prevalent in low-cost models of controllers, but also occurs when using expensive hardware.
To avoid such a situation can also recommend to rebildom test drives on the bad-blocks.
Another common reason for denial of an array is the simultaneous transfer of multiple disk mode off-line. Practice shows that most often occurs because of problems with SMART, or the accumulation of bad-blocks. While their number does not exceed a certain value, the disk is working properly, but one day, the array no longer starts. And like all good, and the media, judging by the sound, normally starts, and the controller correctly determined, but there just do not understand why the status of a disk off-line, the array does not start and the data does not give. All due to the fact that the controller when you try to take the necessary data from the disk can not count them, or diagnosing SMART, identifies the disk as “dead”.
One can cite many examples of failures in the array, but what if it happened yet? Information is lost, it must be restored.
A small digression
Available now, you can see lot of different equipment, which can be used to create arrays, at prices ranging from 20 to several thousand dollars. Comparison of reliability – a complex question, but guess what the price difference is “not a finger sucked”, I think everyone can.
First and foremost I would like to pay special attention to the fact that the preservation of data using RAID arrays is not a panacea. When using arrays without performing timely backups, data loss can occur, the question is, what these losses can be caused, and what is the probability of their occurrence. Practice shows that occur as a malfunction of the controller, as well as failures in the hard disk, or is one from another.
Controllers budget level, naturally less reliable, as they have a simplified algorithm works and disaster recovery, resulting in a greater probability of losing information. Dear model, though also not perfect, much more reliable, including from the fact that algorithms for error handling them more perfect. Matters relating to features of certain models RAID controllers, you can ask here.
In any case, relying on the reliability of the arrays and not taking care of the timely backups, you risk one day stay without “safely stored” information. The probability of data loss can be significantly reduced by regularly monitoring the state of the array and performing maintenance work, but completely nullify the way it can.
Theory: RAID Levels and principles of recovery
Most now use arrays of levels 0, 1, 10, 5, 50. Recently there has been increasing interest in the sixth level.
Below is a summary of the principles of the arrays. More information about this, please read the relevant article.
RAID 0 – use of alternating records (stripe). Constructed from two or more drives. Information is recorded on all drives in the array definition block (8Kb, 16Kb, 32Kb, 64 Kb, 128Kb …) size. Files whose size is one block, uniformly “scattered” on two or more disks included in the array.
Due to the lack of redundancy or duplication of data, at a failure of one drive, restore the information in full, without the use of data from a failed drive is not possible. Exceptions will only files smaller than block size. For a full recovery in these cases, you must first remove the data from a failed disk, then restore the RAID.
In cases where the disks are in good working order, and the array refuses to work correctly, the restoration is produced programming methods, which are described below.
RAID 1 – mirroring the use of technology (mirror). Constructed from two disks. Information on them is identical. In the event of failure of one drive array will remain operational.
If there is a malfunction of the controller and an array ceases to be determined, then the data recovery can be performed using the tips from the article “A simple data recovery. To do this, one of the drives to be connected to the computer directly, bypassing the RAID controller. If you are lucky, after you connect your data may be accessible without the use of the programs described in the above article.
RAID 10 – is an association of level 0 to level 1, ie Two stripe together in a mirror. In an array using at least 4 disks. He can remain operational in case of breakdown of one of its constituent RAID 0.
If you have any problems, you must first decide what exactly has a problem – with the controller or disk.
When the problem at the controller level, you should determine which hard drives are the pairs that make up the stripe. It is important not to confuse the disk, because this will lead to lost time and lack of results. Once it becomes known, takes one such couple, and it removed the information in the same manner as with independent RAID 0.
During operation, RAID 10, it does happen that fail two disks. Here, the following options:
1) Both the disk belong to the same stripe, the controller will correctly handle the exceptional situation, and the array continues to function normally.
2) Both disks belong to the same stripe, but the array is falling apart. In this case, simply take the defective stripe, and software collect it (more on that below).
3) Disks belong to different stripe, but one of them survived the first, and in another second drive. Try the software to collect from them RAID 0.
4) out of order with the same name disks of different stripe. Alas: (One of the failed disk will repair, or any another way to open its data. Then, a software build.
RAID 5 – arrays with parity. Their chief advantage is that they block the distribution of information and control blocks of parity across all disks in the array. To create such an array requires a minimum of three disks. The volume of the array is equal to the sum of volumes of its constituent drives minus one drive. Power parity is used to calculate the missing information at a failure of one of the drives that make up the array. Thus, the loss of one drive and data is lost, and the array can continue to work.
Unfortunately, the condition is that after the failure of one drive, the controller does not correctly handle an exceptional situation and an array ceases to work properly or fully “drops”. Such failure may also arise during executed after replacing the disk rebilda. Sometimes, such that within a short time after the death of the first disk fails another.
If the array has collapsed, and the number of faulty disks no more than one, then it is possible to collect the software, just as going RAID 0. Failure of the two drives will first need to recover, or remove information on the defective drive with one of them, and only then you can do assemble the array.
Practice: Description of the action in the fall of the array
I’ll tell you about what you should not do, in order to finally lose data.
First of all, do not create a new array of old CDs in the hope that it will run and will operate as before. This may work, but rather high probability that the controller will be implemented actions that will lead to an irreversible loss of data.
Starting the initialization is also nothing good will not, so it is recommended to reject it, and if it is not possible, then use only the quick init.
What else can hurt an array? Launch chekdiska or something like that. But in general it is best to remember that the loss of information on RAID should reject any entry on the disks. If you are unsure whether certain actions will lead to a loss of information or not, it is best to either consult with someone who knows it, or refuse to comply.
Methods and algorithms for RAID recovery
Software RAID reconstruction for example arrays 0 and 5 levels
The main way to recover data from RAID is a software build an image of the array. Ie using software components from different disks are arranged in the correct sequence. The order of blocks in the array depends on the location of disks on the channels and the algorithm of the controller.
Before the work is to create clones of all disks in order to protect themselves from wrong actions. Copies can be made both in the form of files or directly to other drives. Work with copies or originals – you decide. I strongly recommend that you use in the copy, because For example, if the source media in some sectors were bad-blocks, then work with these disks can significantly worsen their condition.
If you know the parameters with which to create an array, then it will accelerate the build process. When the known size of the block and the sequence of titles, the selection of these parameters, knowledge of which is necessary for correct assembly of the array, you do not need. But if they still remain unknown, the work will be more.
There are automated tools to search configuration and recovery RAID, for example, such as software RAID Reconstructor. If you put in it the level of the array, it will try to find the original sequence of disk block size, and suggest an algorithm to write information to disk.
Next I will describe step by step action when using this utility.
So, here we face a window running the program:
The first step required to get started – is the choice of type array, which you need. The choice is made in the window «RAID TYPE».
By specifying the type of the array for the assembly you must specify the number of disks in the box «# drives». After you specify the required number of titles below will flash white a few fields (their number will equal the number of values you drive). Brings to each of the illuminated windows, we click the right mouse button and select the disks that there is a weight. Once the drive is selected – go to the item «Block size».
Here you must specify the block size, if known, if not, leave the item unchanged and boldly press on «Open drives» and then immediately on the button «Analyze».
Before you appears a new window. In the case of RAID 0 is:
And in the case of a RAID 5 there is:
So, in front of us is a window that will ask your search drive sequence, the size of the block, and if we collect RAID 5, parity rotations.
Having information about what the controller was to create an array which was used by the algorithm to write information to disk, as well as knowledge of the block size, will help save time. To do this, you want to exclude unnecessary parameters in the windows «Block size» and «Parity rotations». But if you do these parameters do not know, it’s best to leave everything unchanged and click «Next», thus providing a tool to sort out themselves.
Once you click, the program will calculate all possible options and will try to give you the most faithful, though in cases where the destruction of the array are quite strong, the result may not be entirely accurate. If after reenactors spent analysis, the bottom appeared the inscription «Recommendation: choose entry 1″, you can breathe easy. The correct algorithm is found.
Further options may be few. Either rewrite the image of the array to the file or save it to disk or array, or create a virtual image and continue the analysis of utility Captain Nemo, Get Data Back or DiscEditor. What exactly is done – you decide.
Even as an option, using the knowledge about the location of disks, the algorithm records and block size, you can restore the RAID, using a program called UFS Explorer. Guidelines for use of this product can be found in the documentation.
When an array is built correctly, and file systems on it have no logical damage, you can get access to the data by standard methods. In particular, if the image is copied onto the hard disk will be enough to connect it to your computer and restart the OS (if you do not support hot insertion).
I remind you that the above method can recover RAID only in the most simple cases. Description of complex situations is beyond the scope of this article, and does not imply the use of lay persons. For example, you may not be able to restore the RAID method described in the case when the controller writes the start of the disk configuration information. Do not tell the program the number of sectors occupied by official data, you can get an incorrect result of automatic selection of the configuration of the array. These configuration blocks are unique to each model, controller, and know exactly their size can only examine the contents of the primary sectors.
Hardware RAID reconstruction
An alternative to creating the image may be a hardware assembly. I must say that without knowing the algorithm of the controller, or without a backup absolutely all disk array, use this “shamanic method” is strictly not recommended, because You can make these changes to disk, resulting in you no longer get the data, even turning to specialists. This information is given for educational purposes rather than as a guide to action.
So, the method is that the array is recreated on the controller again, with all similar previous configuration settings. Please note that if you create will be launched rebild, the chances that your data will survive a little. Some models of controllers after a new array automatically perform initialization, which can also lead to irreversible loss of data.
If all drives in the array was undamaged, it is likely that without any further action you will again have access to information. It is also possible that it will take to work with tools such as R-Studio, Get Data Back or something similar.
In the cases of Reid fifth level, when one of the disks fails, you can create an array with the replacement drive for the same defective. When an array is created (rebild not to!), After the operating system, this disc will need to disable “in hot”. As a result, again, you can get access to their data directly, or through the use of programs for the logical reconstruction of information.
Posted in 
Forum Posts about Data Raid restore
| hunter *, 9/8/2005 13:03 |
| Situation such. There is a following configuration: Motherboard Abit KT7-A RAID, 2 HDD 80 Gb IBM Deskstar IC35L080AVVA07-0.
Screws are generated in stripped array (RAID 0). File system NTFS. To put it briefly the situation such, is two halves rejda, one normal with another something not that. Whether It is possible to restore a file or how that to rescue the data? My acquaintance had a case when rejd also has broken up and did not unite, it in NDD has made something and vrozhe all has earned. What thoughts are? |
| 1. punk_mic, 9/8/2005 17:45 |
| There was at me a similar problem, raid stripped on Silicon Image Fast Trak 150 TX PCI (or that type) from 2 160 seagate IDE and SATA, once IdE-shnyj the screw has fallen out of a file, restartnulsja I look a file is not defined, has come in BIOS evojnyj is written screw SATA as it should be, IDE “disconnected or unpowered”, a shower pancake in heels infy 300 gig was, has removed a file then peresozdal without a format and all well only IDE to rustle the beginnings as a vacuum cleaner, a question in that when it will be whooped definitively. |
| 2. hunter *, 9/9/2005 07:24 |
| At me a problem just that it would be desirable to restore the data. So anew would create a file. Has banished disk R-Studio, the table speaks that wrong MFT, partitsii are not defined. At the second screw everything is all right. It is interesting, whether there are any utilities which work with RAID… |
| 3. Roman Olmezov, 9/9/2005 08:53 |
| Is RAID Reconstructor (http://www.runtime.org/raid.htm)… |
| 4. Leo, 9/9/2005 11:35 |
| hunter*: I would not advise in general more to include this screw which has begun gljuchit. Can it is bad will come to an end, for infy. There is at AVVA such feature, already some disks came across, partially shabby after such glitches. |
| 5. hunter *, 9/9/2005 11:44 |
| The citation:
Leo: hunter*: I would not advise in general more to include this screw which has begun gljuchit. Can it is bad will come to an end, for infy. There is at AVVA such feature, already some disks came across, partially shabby after such glitches. If not to include, as then to restore? Addition from 9/9/2005 11:52: The citation: Roman Olmezov: Is RAID Reconstructor (http://www.runtime.org/raid.htm)… Many thanks for the reference. Esteemed the description, that seems just that is necessary. A unique problem that I can not download the program. When I pass to zakachke writes forbidden. Access from our region can is closed. If at you I will is this program it is very grateful. I can give ftp or a mail for loading. Or can will prompt where it is possible to download. Thanks. |
| 6. Antech, 9/9/2005 12:17 |
| hunter* So that a program to use, it is necessary to treat the screw in the beginning. Look at payments of the AVVA. If in the centre will find out microcircuits with an inscription “Korea”, it is necessary perepaivat on Taiwan. Symptoms are similar on… However, all perfectly know, on what it is similar. |
| 7. hunter *, 9/9/2005 15:00 |
| The citation:
Antech: hunter* So that a program to use, it is necessary to treat the screw in the beginning. Look at payments of the AVVA. If in the centre will find out microcircuits with an inscription “Korea”, it is necessary perepaivat on Taiwan. Symptoms are similar on… However, all perfectly know, on what it is similar. Well the screw like is defined, sounds of strangers does not publish. The glitch was in that that in the middle of night has stopped also the beginnings stova is got and so some times tried, then has simply gone out. Mikruhi looked like the burnt are heated. How to treat that in general? And on what it is similar in your words? |
| 8. Antech, 9/9/2005 15:18 |
| hunter* You not on gorelosti look, and on the manufacturer. The glitch can repeat. Though other reasons are possible also: poor-quality BP, bad contact in a food socket, gljuchnyj a loop… After all all these reasons including microcircuits should be checked up. And in general: where yours bekap? Valuable infa on strip Raid0, moreover and without bekapa, besides on IBM AVVA is a full finish! Of what you thought? |
| 9. shishimor, 9/9/2005 15:46 |
| The obvious case for spetsa, is a number of thin places of demanding experience, to train on valuable infe I do not advise |
| 10. hunter *, 9/12/2005 08:02 |
| The citation:
shishimor: The obvious case for spetsa, is a number of thin places of demanding experience, to train on valuable infe I do not advise And so where the such you will find While I try to restore partitsiju on sbojnom the screw. The data there is, in Diskeditor all on a place, and the screw is defined as pure Addition from 9/12/2005 08:04: The citation: Antech: hunter* You not on gorelosti look, and on the manufacturer. The glitch can repeat. Though other reasons are possible also: poor-quality BP, bad contact in a food socket, gljuchnyj a loop… After all all these reasons including microcircuits should be checked up. And in general: where yours bekap? Valuable infa on strip Raid0, moreover and without bekapa, besides on IBM AVVA is a full finish! Of what you thought? Itself I know, it is guilty And in general now I think, what I houses to myself Raid0 have made?! Same it was necessary to guess. And last bakap did in February, therefore and is insulting. For half a year a lot of new work has appeared, and all it now in one place. |
| 11. Scad, 9/15/2005 12:08 |
| hunter* Results of restoration ozvuchte, fur-trees it is not difficult… Approximately the same trouble… Seagate barracuda 5 (one of two) periodically clicked heads, and then rajd 0 was gone… |
| 12. hunter *, 9/15/2005 13:14 |
| The citation:
Scad: hunter* Results of restoration ozvuchte, fur-trees it is not difficult… Approximately the same trouble… Seagate barracuda 5 (one of two) periodically clicked heads, and then rajd 0 was gone… While it turns out nothing. neznaju as it is possible to restore partitsiju on the screw. |
| 13. FormatCeft, 9/15/2005 18:58 |
| hunter* While it turns out nothing. neznaju as it is possible to restore partitsiju on the screw. Here it is interesting, what for and HOW to restore section on one screw which was in zero rejde? You though about storoenie rejdov esteem: |
| 14. vels, 9/15/2005 20:25 |
| I will take advantage of already created theme. Prompt, pliz how to restore a Raid-file 0+1. Integrated controller SilImage 3114. 4 screws on 80гб obedeneny in Raid 0+1. One of screws has dropped out Of a file. Have connected another. Means Windows and means bios rebilding do not possible to make the controller. Can eat any features at restoration 0+1? Had no operational experience with this file. |
| 15. hunter *, 9/16/2005 07:43 |
| The citation:
FormatCeft: hunter* While it turns out nothing. neznaju as it is possible to restore partitsiju on the screw. Here it is interesting, what for and HOW to restore section on one screw which was in zero rejde? You though about storoenie rejdov esteem: Oh yes I it already know all for a long time. Here the situation such that RAID Reconstructor does not see live partitsiju on the second screw, and accordingly cannot begin restoration. The same is told also by other utilities. Therefore I also wish to understand that it is possible to make with this screw. And as rapolagaetsja the information in raid0 to tell to me it is not necessary Addition from 9/16/2005 07:56: The citation: vels: I will take advantage of already created theme. Prompt, pliz how to restore a Raid-file 0+1. Integrated controller SilImage 3114. 4 screws on 80гб obedeneny in Raid 0+1. One of screws has dropped out Of a file. Have connected another. Means Windows and means bios rebilding do not possible to make the controller. Can eat any features at restoration 0+1? Had no operational experience with this file. By the way and how to spend rebilding raid? In biose I have some, only to create new, to remove and all. In general if raid breaks up as then to be |
| 16. FormatCeft, 9/16/2005 18:12 |
| hunter*
The citation: Oh yes I it already know all for a long time. And here it sonitelno RAID Reconstructor also should not see anything, he needs to specify physically 2 screws rejda, to define the size of the block and to specify the screw where to copy, ostanoe it will make all. And any live partitsy he also should not see – because on nuloevom rejde they simply are not present on screws separately |
| 17. hunter *, 9/16/2005 22:27 |
| The citation:
FormatCeft: hunter* The citation: Oh yes I it already know all for a long time. And here it sonitelno RAID Reconstructor also should not see anything, he needs to specify physically 2 screws rejda, to define the size of the block and to specify the screw where to copy, ostanoe it will make all. And any live partitsy he also should not see – because on nuloevom rejde they simply are not present on screws separately If it so it after all simply fine we Will nadejatsja on the best so to say To me the screw 200 Gb to merge mine 160 Gb raid is simply necessary. As I will find again I will try Thanks |
| 18. SD, 11/23/2005 22:32 |
| To a question on falling РЕЙД0 – the same situation now I suffer with attempts to return one of screws in normal state – all was normal, and then as has gone heads after bank to knock – from what?, and in biose it is not correctly defined and РАЙД0 has fallen…
FAQ = RAID in house conditions., #59 (http://forum.ixbt.com/topic.cgi?id=11:31765:59#59) |
| 19. hunter *, 11/23/2005 23:29 |
| Well I already otmuchalsja, have killed some days and have solved that it of that is not necessary.
By the way it was possible to make destripping and to copy all data in one image by means of RAID Reconstructor. But at a stage of restoration of the data from an image it has appeared that the data is damaged, files there is less than size of the block at all will not open. Has probably set the wrong sizes or still something. As though there was eksperementirovat further there were nikaogo desires as on one attempt destrippinga days leave almost, then on scanning of an image some hours, as a result that porobovat one of variants of options is lost some days. The screw at me 160 Gb, attempts I such have fairly made three Then have thrown everything, have formatted and have put screws on a shelf If at you nevertheless it will turn out to restore that write about it, it will be interesting to learn. |
| 20. doomer, 11/24/2005 09:09 |
Regularly I restore infu from RAID different levels  Here experience is necessary, as to you and spoke earlier |
| 21. SD, 11/24/2005 19:26 |
| And unless theoretically probably to restore infu with РАЙД0 if one of screws has died? |
| 22. sergol2, 11/24/2005 22:25 |
| SD And unless theoretically probably to restore infu with РАЙД0 if one of screws has died? Certainly it is possible if this screw to recover. |
| 23. SD, 11/27/2005 14:09 |
| It was possible to restore the data with fallen RAID0 – as has correctly noticed sergol2 the primary goal it is reduced to restoration of functionality of the refused screw (though quickly).
Here the instruction: Vua-lja – infa it is rescued. The most ambiguous here – item 1. 1. To start the personal computer of times 30, to change position of the screw/case of the personal computer (the probability is small, but happens it is started) That’s all. Whether only after each step it is necessary to make sure has earned the screw. And РАЙД0 – a remarkable thing all the same, only it is necessary to adjust a policy of archiving and all SUPER! |
| 24. sergol2, 11/27/2005 16:44 |
| SD And in end it is anew created РАЙД0. And from peresohdanija rejda it is lost infa. In this case ngado to separate flies from cutlets. And to divide restoration of working capacity of the screw and rejda. 6. To put ON a refrigerator or ON a washing machine (it is necessary to look that it has not fallen down spontaneously from vibration) And also not to forget to invite the sorcerer and a black cat. 7. Accurately to tap on screw corners serially on or against chasovoi to an arrow (will help if heads have fallen) And at once to prepare not 8-10 t.r. For restoration infy and 20-25. 8. To turn in a tight cellophane package and to put In a refrigerator of minutes on 10, then quickly to connect to the personal computer (basically the way is good if the disk fell down though helps and in a number of other cases) Sm point 7. 9. To heat up the hair dryer the screw controller (speak helps, itself did not try) Helps. Fudzhikam MPG. 10. To find the same screw and to change payments on screws in places. Here only not uvseh screws kanaet. Try fudzhikov to change at the same. |
| 25. doomer, 11/27/2005 22:06 |
| The citation:
Here the instruction: … I cried The badge © is forgotten only |
| 26. Lelik, 11/27/2005 22:22 |
| 27. shishimor, 11/27/2005 23:04 |
| Powerfully! An instruction hybrid “how to catch a lion in desert” http://bagrov.spb.ru/homepage/catch_lion.asp And “bad advice” |
| 28. SD, 11/27/2005 23:13 |
| sergol2 Certainly with mind it is necessary to do all – force the fool to pray it and a forehead rasshibet. Here and I thought that РЕЙД0 after recreation will crash down and it will be necessary to use something of type RAID Reconstructor, |
| 29. sergol2, 11/27/2005 23:15 |
| SD And rejdy happen different. And by the way the size of the block at them too. So it is necessary to think before to do, to you has carried and whether will carry another? |
| 30. hunter *, 11/28/2005 08:05 |
| The citation:
SD: It was possible to restore the data with fallen RAID0 – as has correctly noticed sergol2 the primary goal it is reduced to restoration of functionality of the refused screw (though quickly). Here the instruction: Vua-lja – infa it is rescued. The most ambiguous here – item 1. 1. To start the personal computer of times 30, to change position of the screw/case of the personal computer (the probability is small, but happens it is started) That’s all. Whether only after each step it is necessary to make sure has earned the screw. And РАЙД0 – a remarkable thing all the same, only it is necessary to adjust a policy of archiving and all SUPER! It is all clearly certainly, the screw at me was basically live, has revived. But how to understand point: 4. And in end it is anew created РАЙД0. At creation rejda in biose, all leaves also you receive clean rejd, vujalja at us anything is not present from infy |
| 31. SD, 11/29/2005 22:47 |
| hunter*
I have already answered this question In my case IMHO all infa about rajde has been written down on SCREWS and at replacement of one of them, with carrying over on a new same exact bit-by-bit copy infy, the controller of simply it has not noticed. |
| 32. Arjy Yu, 1/13/2006 18:04 |
| The situation at me not absolutely corresponds to a theme but not to produce superfluous, I will describe it here.
At me was РЭЙД0 from two disks on 60Гб on built in in mat.platu the controller. At unsuccessful attempt of an upgrade mat.plata has failed. The controller on it was exotic so with rejda it was not possible to rescue the data. Now I have a screw on 250Гб, and mobajl rek. From here I try to make a plan of action on partial rescue of the data with old rejda (first of all some images, music and sejvy). 1) By turns to insert old screws in rek and to make their images. Here I have a question – the image turns out the same size, what the screw, or is more? Simply my new screw is now broken into three sections – 50, 100 and 100 – so I plan to write down images on the big sections. 2) Any program to pick up the received images, and to pull out from them that is necessary. I doubt a little, whether it will be possible to keep therein the rescued data on the same sections on which images will lie. On the first point like all it is more or less clear. It is necessary to create images, probably, Norton Ghostom. I am right? And here than it is possible to cling images and to pull out from them the data? While at me on sign R-Studio. Whether the best is a variant? |
| 33. hunter *, 1/13/2006 22:25 |
| The image turns out in the size in the screw so be reserved by a place. R-Studio it was not pleasant to me. In general some tens programs have touched, but became on Raid Reconstructor and GetDataBack. At other forums the people too basically mention them. Well as though there was all the same left anything to restore, too much time leaves on process, not hunting was after three attempts and loss of a heap of time to continue. Therefore nafik music nafik sejvy? Same all a hogwash if so to think Therefore I is simple formatnul disks and I live further |
| 37. scanter, 7/25/2007 03:47 |
| Help. The power unit on a server has departed. Has removed one disk, has connected on other sistemnike. After again on a server with a new power unit and this disk that removed, non-RAID. Whether it is possible to restore RAID0 and to obtain the data? |
| 38. gss, 7/25/2007 12:18 |
| You do not confuse рэйд0 (strajp) рэйд1 (mirror)? If the first write the application on own while you have not expelled under article, with the full bases on that more likely. Basically different rstudijami likely it is possible to try vykovyrjat the information. If will carry. |
| 39. noiii, 8/13/2007 20:07 |
| Zdrastvujte, help council, situyovina such, RAID 0 file worked on mum ASUS P4P800, mother has broken, does not start, takojzhe to find I can not yet, but has bought controller RAID 3114, has connected has created a file, but the Windows do not see info, the naked disk displays, while it is more than nothing pridprinimal, infa there very necessary on work, advise what to make is possible and in general I could not sdelet irreversible actions any more??? |
| 40. Guybrush Threepwood, 8/14/2007 03:06 |
| noiii To look Linux LiveCD, to esteem about softovye spot-checks, man md mdadm, to create spot-check, to mount sections, to rejoice lives |
| 41. Antech, 8/14/2007 09:09 |
| noiii There very necessary on work Try to address in good firm on restoration of the data. Judging by your attempts, you can zaporot infu absolutely. Advise what to make |
| 42. sergol2, 8/14/2007 10:18 |
| noiii And in general I could not sdelet irreversible any more Well MBRа there already is not present. We wait for the further clever actions. |
| 43. Guybrush Threepwood, 8/14/2007 11:59 |
| Antech They paid so or money, or to search kraki Under linuhom all free The kernel itself creates spot-checks from screws/sections/images, only regular mdadm it is necessary to smoke And tama and signatures of file systems to look, and it is possible to mount Here a script for search of signatures. It was written from make-shifts Code: #!/bin/bash source = "/dev/hda" pos = "0"; while [true]; do dd if = $ source bs=512 count=1 skip = $ pos 2>/dev/null | file - | grep boot | sed "s/\/dev\/stdin/sector $pos /" echo-en "$pos\r" let pos = $ pos+1 done; Gives out at me: sector 0: x86 boot sector, code offset 0×48 The truth works slowly, for the nature scripting As have found file system – we cut off a slice through creation of the virtual device (losetup), yes we try zamontirovat, mbr here and it is not necessary And all regular means and all is absolutely free |
| 44. Antech, 8/14/2007 13:31 |
| Guybrush Threepwood x86 boot sector, extended partition table It is interesting, as it is defined. There after all except standard 55 AA (which and in other places uses) no bindings are present. And the loader in Abstract MBR too is not present… I am intrigued. |
| 45. Guybrush Threepwood, 8/14/2007 13:45 |
| Antech There after all except standard 55 AA Take libmagic yes look, same Opened ON! To prompt? |
| 46. Antech, 8/14/2007 15:16 |
| Guybrush Threepwood To prompt? Yes, it is desirable. I so suspect that libmagic is a huge heap of source codes where it is necessary to satisfy the curiosity all the day. |
| 47. Guybrush Threepwood, 8/14/2007 22:11 |
| Antech In vain! It is library + huge base of signatures. Works very simply that sometimes generates also errors, as in my case. But works Here a slice about file systems and loaders, here all is clear: Code: #------------------------------------------------------------------------------ # filesystems: file (1) magic for different filesystems # 0 string \366\366\366\366 PC formatted floppy with no filesystem # Sun disk labels # From/usr/include/sun/dklabel.h: 0774 beshort 0xdabe Sun disk label > 0 string x ' %s >> 31 string > \0 \b%s >>> 63 string > \0 \b%s >>>> 95 string > \0 \b%s > 0 string x \b' > 0734 short > 0 %d rpm, > 0736 short > 0 %d phys cys, > 0740 short > 0 %d alts/cyl, > 0746 short > 0 %d interleave, > 0750 short > 0 %d data cyls, > 0752 short > 0 %d alt cyls, > 0754 short > 0 %d heads/partition, > 0756 short > 0 %d sectors/track, > 0764 long > 0 start cyl %ld, > 0770 long x %ld blocks # Is there a boot block written 1 sector in? > 512 belong&077777777 0600407 \b, boot block present # DOS Emulator image is 128 byte header + harddisc image 0 string DOSEMU\0 > 0x27E leshort 0xAA55 DOS Emulator image 0x1FE leshort 0xAA55 x86 boot sector > 2 string OSBS \b, OS/BS MBR # J\xf6rg Jenderek <joerg.jenderek@gmx.net> > 0x8C string Invalid\partition\table \b, MS-DOS MBR # dr-dos with some UPPER - lowercase variants > 0x9D string Invalid\partition\table$ >> 181 string No\Operating\System$ >>> 201 string Operating\System\load\error$ \b, DR-DOS MBR, Version 7.01 to 7.03 > 0x9D string Invalid\partition\table$ >> 181 string No\operating\system$ >>> 201 string Operating\system\load\error$ \b, DR-DOS MBR, Version 7.01 to 7.03 > 342 string Invalid\partition\table$ >> 366 string No\operating\system$ >>> 386 string Operating\system\load\error$ \b, DR-DOS MBR, version 7.01 to 7.03 > 295 string NEWLDR\0 >> 302 string Bad\PT\$ >>> 310 string No\OS\$ >>>> 317 string OS\load\err$ >>>>> 329 string Moved\or\missing\IBMBIO.LDR\n\r >>>>>> 358 string Press\any\key\to\continue.\n\r$ >>>>>>> 387 string Copyright\(c) \1984,1998 >>>>>>>> 411 string Caldera\Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) > 0x10F string Ung\201ltige\Partitionstabelle \b, MS-DOS MBR, german version 10/4/1998, 10/4/2222 > 0x8B string Ung\201ltige\Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 > 300 string Invalid\partition\table\0 >> 324 string Error\loading\operating\system\0 >>> 355 string Missing\operating\system\0 \b, Microsoft Windows XP MBR #??>>> 389 string Invalid\system\disk > 300 string Ung\201ltige\Partitionstabelle #split string to avoid error: String too long >> 328 string Fehler\beim\Laden\ >>> 346 string des\Betriebssystems >>>> 366 string Betriebssystem\nicht\vorhanden \b, Microsoft Windows XP MBR (german) > 0x145 string Default:\F \b, FREE-DOS MBR > 64 string no\active\partition\found >> 96 string read\error\while\reading\drive \b, FREE-DOS Beta9 MBR # bootloader, bootmanager > 43 string SMART\BTMGRFAT12\\\ >> 430 string SBMK\Bad! \r >>> 3 string SBM \b, Smart Boot Manager >>>> 6 string > \0 \b, version %s > 382 string XOSLLOADXCF \b, EXtended Operating System Loader > 6 string LILO \b, LInux i386 boot LOader >> 120 string LILO \b, version 22.3.4 SuSe >> 172 string LILO \b, version 22.5.8 Debian > 402 string Geom\0Hard\Disk\0Read\0\Error\0 >> 394 string stage1 \b, GRand Unified Bootloader (0.5.95) > 380 string Geom\0Hard\Disk\0Read\0\Error\0 >> 374 string GRUB\\0 \b, GRand Unified Bootloader > 382 string Geom\0Hard\Disk\0Read\0\Error\0 >> 376 string GRUB\\0 \b, GRand Unified Bootloader (0.93) > 383 string Geom\0Hard\Disk\0Read\0\Error\0 >> 377 string GRUB\\0 \b, GRand Unified Bootloader (0.94) > 480 string Boot\failed\r >> 495 string LDLINUX\SYS \b, SYSLINUX bootloader (2.06) > 395 string chksum\0\ERROR! \0 \b, Gujin bootloader > 185 string FDBOOT\Version\ >> 204 string \rNo\Systemdisk.\ >>> 220 string Booting\from\harddisk.\n\r >>> 245 string Cannot\load\from\harddisk.\n\r >>>> 273 string Insert\Systemdisk\ >>>>> 291 string and\press\any\key.\n\r \b, FDBOOT harddisk Bootloader >>>>>> 200 string > \0 \b, version %-3s > 242 string Bootsector\from\C.H.\Hochst\204 >> 278 string No\Systemdisk.\ >>> 293 string Booting\from\harddisk.\n\r >>> 441 string Cannot\load\from\harddisk.\n\r >>>> 469 string Insert\Systemdisk\ >>>>> 487 string and\press\any\key.\n\r \b, WinImage harddisk Bootloader >>>>>> 209 string > \0 \b, version %-4.4s > (1.b+2) ubyte 0xe >> (1.b+3) ubyte 0x1f >>> (1.b+4) ubyte 0xbe >>>> (1.b+5) ubyte 0x77 >>>> (1.b+6) ubyte 0x7c >>>>> (1.b+7) ubyte 0xac >>>>>> (1.b+8) ubyte 0x22 >>>>>>> (1.b+9) ubyte 0xc0 >>>>>>>> (1.b+10) ubyte 0x74 >>>>>>>>> (1.b+11) ubyte 0xb >>>>>>>>>> (1.b+12) ubyte 0x56 >>>>>>>>>> (1.b+13) ubyte 0xb4 \b, mkdosfs boot message display # XP > 430 string NTLDR\is\missing\xFF\r\n >> 449 string Disk\error\xFF\r\n >>> 462 string Press\any\key\to\restart\r \b, Microsoft Windows XP Bootloader # DOS names like NTLDR, CMLDR, $LDR $ are 8 right space padded bytes+3 bytes >>>> 417 ubyte <0x7E >>>>> 417 string > \ %-.5s >>>>>> 422 ubyte <0x7E >>>>>>> 422 string > \ \b %-.3s >>>>>> 425 string > \ \b. %-.3s # >>>> 368 ubyte <0x7E >>>>> 368 string > \ %-.5s >>>>>> 373 ubyte <0x7E >>>>>>> 373 string > \ \b %-.3s >>>>>> 376 string > \ \b. %-.3s # > 430 string NTLDR\nicht\gefunden\xFF\r\n >> 453 string Datentr\204gerfehler\xFF\r\n >>> 473 string Neustart\mit\beliebiger\Taste\r \b, Microsoft Windows XP Bootloader (german) >>>> 417 ubyte <0x7E >>>>> 417 string > \ %-.5s >>>>>> 422 ubyte <0x7E >>>>>>> 422 string > \ \b %-.3s >>>>>> 425 string > \ \b. %-.3s # >>>> 368 ubyte <0x7E >>>>> 368 string > \ %-.5s >>>>>> 373 ubyte <0x7E >>>>>>> 373 string > \ \b %-.3s >>>>>> 376 string > \ \b. %-.3s # > 430 string NTLDR\fehlt\xFF\r\n >> 444 string Datentr\204gerfehler\xFF\r\n >>> 464 string Neustart\mit\beliebiger\Taste\r \b, Microsoft Windows XP Bootloader (2.german) >>>> 417 ubyte <0x7E >>>>> 417 string > \ %-.5s >>>>>> 422 ubyte <0x7E >>>>>>> 422 string > \ \b %-.3s >>>>>> 425 string > \ \b. %-.3s # > 430 string NTLDR\fehlt\xFF\r\n >> 444 string Medienfehler\xFF\r\n >>> 459 string Neustart:\Taste\dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) >>>> 368 ubyte <0x7E >>>>> 368 string > \ %-.5s >>>>>> 373 ubyte <0x7E >>>>>>> 373 string > \ \b %-.3s >>>>>> 376 string > \ \b. %-.3s >>>> 417 ubyte <0x7E >>>>> 417 string > \ %-.5s >>>>>> 422 ubyte <0x7E >>>>>>> 422 string > \ \b %-.3s >>>>>> 425 string > \ \b. %-.3s # > 430 string Datentr\204ger\entfernen\xFF\r\n >> 454 string Medienfehler\xFF\r\n >>> 469 string Neustart:\Taste\dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) >>>> 368 ubyte <0x7E >>>>> 368 string > \ %-.5s >>>>>> 373 ubyte <0x7E >>>>>>> 373 string > \ \b %-.3s >>>>>> 376 string > \ \b. %-.3s #> 3 string NTFS\\\\ > 389 string Fehler\beim\Lesen\ >> 407 string des\Datentr\204gers >>> 426 string NTLDR\fehlt >>>> 440 string NTLDR\ist\komprimiert >>>>> 464 string Neustart\mit\Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) #> 3 string NTFS\\\\ > 313 string A\disk\read\error\occurred.\r >> 345 string A\kernel\file\is\missing\ >>> 370 string from\the\disk.\r >>>> 484 string NTLDR\is\compressed >>>>> 429 string Insert\a\system\diskette\ >>>>>> 454 string and\restart\r\nthe\system.\r \b, Microsoft Windows XP Bootloader NTFS # DOS loader variants different languages, offsets > 472 string IO\\\\\\SYSMSDOS\\\SYS >> 497 string WINBOOT\SYS >> 389 string Invalid\system\disk\xFF\r\n >>> 411 string Disk\I/O\error >>>> 428 string Replace\the\disk, \and\ >>>>> 455 string press\any\key \b, Microsoft Windows 98 Bootloader # >> 390 string Invalid\system\disk\xFF\r\n >>> 412 string Disk\I/O\error\xFF\r\n >>>> 429 string Replace\the\disk, \and\ >>>>> 451 string then\press\any\key\r \b, Microsoft Windows 98 Bootloader >> 388 string Ungueltiges\System\\xFF\r\n >>> 410 string E/A-Fehler\\\\\xFF\r\n >>>> 427 string Datentraeger\wechseln\und\ >>>>> 453 string Taste\druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) # >> 390 string Ungueltiges\System\\xFF\r\n >>> 412 string E/A-Fehler\\\\\xFF\r\n >>>> 429 string Datentraeger\wechseln\und\ >>>>> 455 string Taste\druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) # >> 389 string Ungueltiges\System\\xFF\r\n >>> 411 string E/A-Fehler\\\\\xFF\r\n >>>> 428 string Datentraeger\wechseln\und\ >>>>> 454 string Taste\druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) > 479 string IO\\\\\\SYSMSDOS\\\SYS >> 416 string Kein\System\oder\ >>> 433 string Laufwerksfehler >>>> 450 string Wechseln\und\Taste\dr\201cken \b, Microsoft DOS Bootloader (german) > 486 string IO\\\\\\SYSMSDOS\\\SYS >> 416 string Non-System\disk\or\ >>> 435 string disk\error\r >>>> 447 string Replace\and\press\any\key\ >>>>> 473 string when\ready\r \b, Microsoft DOS Bootloader > 480 string IO\\\\\\SYSMSDOS\\\SYS >> 393 string Non-System\disk\or\ >>> 412 string disk\error\r >>>> 424 string Replace\and\press\any\key\ >>>>> 450 string when\ready\r \b, Microsoft DOS bootloader #> 43 string \224R-LOADER\\SYS =label > 54 string SYS >> 324 string VASKK >>> 495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) # > 70 string IBMBIO\\COM >> 472 string Cannot\load\DOS! \ >>> 489 string Any\key\to\retry \b, DR-DOS Bootloader >> 471 string Cannot\load\DOS\ >> 487 string press\key\to\retry \b, Open-DOS Bootloader > 444 string KERNEL\\SYS >> 314 string BOOT\error! \b, FREE-DOS Bootloader > 499 string KERNEL\\SYS >> 305 string BOOT\err! \0 \b, Free-DOS Bootloader > 449 string KERNEL\\SYS >> 319 string BOOT\error! \b, FREE-DOS 5.0 Bootloader > 124 string FreeDOS\0 >> 331 string \err\0 \b, FREE-DOS BETa 9 Bootloader # DOS names like KERNEL.SYS, KERNEL16.SYS, KERNEL32.SYS, METAKERN.SYS are 8 right space padded bytes+3 bytes >>> 497 string > \ %-.6s >>>> 503 string > \ \b %-.1s >>>> 504 string > \ \b %-.1s >>> 505 string > \ \b. %-.3s >> 333 string \err\0 \b, FREE-DOS BEta 9 Bootloader >>> 497 string > \ %-.6s >>>> 503 string > \ \b %-.1s >>>> 504 string > \ \b %-.1s >>> 505 string > \ \b. %-.3s >> 334 string \err\0 \b, FREE-DOS Beta 9 Bootloader >>> 497 string > \ %-.6s >>>> 503 string > \ \b %-.1s >>>> 504 string > \ \b %-.1s >>> 505 string > \ \b. %-.3s # loader end > 0 string \0\0\0\0 \b, extended partition table # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # older drives may use E9 xx xx > 0 lelong&0x009000EB 0x009000EB > 0 lelong&0x000000E9 0x000000E9 >> 1 ubyte > 37 \b, code offset 0x%x # mtools-3.9.8/msdos.h # usual values are marked with comments to get only informations of strange FAT systems # valid sectorsize are from 32 to 2048 >>> 11 uleshort <2049 >>>> 11 uleshort > 31 >>>>> 3 string > \0 \b, OEM-ID "%8.8s" >>>>> 11 uleshort > 512 \b, Bytes/sector %u #>>>>> 11 uleshort =512 \b, Bytes/sector %u=512 (usual) >>>>> 11 uleshort <512 \b, Bytes/sector %u >>>>> 13 ubyte > 1 \b, sectors/cluster %u #>>>>> 13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) >>>>> 14 uleshort > 32 \b, reserved sectors %u #>>>>> 14 uleshort =32 \b, reserved sectors %u (usual Fat32) #>>>>> 14 uleshort > 1 \b, reserved sectors %u #>>>>> 14 uleshort =1 \b, reserved sectors %u (usual FAT12, FAT16) >>>>> 14 uleshort <1 \b, reserved sectors %u >>>>> 16 ubyte > 2 \b, FATs %u #>>>>> 16 ubyte =2 \b, FATs %u (usual) >>>>> 16 ubyte =1 \b, FAT %u >>>>> 16 ubyte > 0 >>>>> 17 uleshort > 0 \b, root entries %u #>>>>> 17 uleshort =0 \b, root entries %u=0 (usual Fat32) >>>>> 19 uleshort > 0 \b, sectors %u (volumes <=32 MB) #>>>>> 19 uleshort =0 \b, sectors %u=0 (usual Fat32) >>>>> 21 ubyte > 0xF0 \b, Media descriptor 0x%x #>>>>> 21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) >>>>> 21 ubyte <0xF0 \b, Media descriptor 0x%x >>>>> 22 uleshort > 0 \b, sectors/FAT %u #>>>>> 22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) >>>>> 26 ubyte > 2 \b, heads %u #>>>>> 26 ubyte =2 \b, heads %u (usual floppy) >>>>> 26 ubyte =1 \b, heads %u >>>>> 28 ulelong > 0 \b, hidden sectors %u #>>>>> 28 ulelong =0 \b, hidden sectors %u (usual floppy) >>>>> 32 ulelong > 0 \b, sectors %u (volumes> 32 MB) #>>>>> 32 ulelong =0 \b, sectors %u (volumes> 32 MB) # FAT <32 specific # NOT le FAT3=NOT 3TAF=0xCCABBEB9 >>>>> 82 ulelong&0xCCABBEB9 > 0 >>>>>> 36 ubyte > 0x80 \b, physical drive 0x%x #>>>>>> 36 ubyte =0x80 \b, physical drive 0x%x=0x80 (usual harddisk) >>>>>> 36 ubyte&0x7F > 0 \b, physical drive 0x%x #>>>>>> 36 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>> 37 ubyte > 0 \b, reserved 0x%x #>>>>>> 37 ubyte =0 \b, reserved 0x%x >>>>>> 38 ubyte > 0x29 \b, dos <4.0 BootSector (0x%x) >>>>>> 38 ubyte <0x29 \b, dos <4.0 BootSector (0x%x) >>>>>> 38 ubyte =0x29 >>>>>>> 39 ulelong x \b, serial number 0x%x >>>>>>> 43 string <NO\NAME \b, label: "%11.11s" >>>>>>> 43 string > NO\NAME \b, label: "%11.11s" >>>>>>> 43 string =NO\NAME \b, unlabeled >>>>>> 54 string FAT1 \b, FAT >>>>>>> 54 string FAT12 \b (12 bit) >>>>>>> 54 string FAT16 \b (16 bit) # FAT32 specific >>>>> 82 string FAT32 \b, FAT (32 bit) >>>>>> 36 ulelong x \b, sectors/FAT %u >>>>>> 40 uleshort > 0 \b, extension flags %u #>>>>>> 40 uleshort =0 \b, extension flags %u >>>>>> 42 uleshort > 0 \b, fsVersion %u #>>>>>> 42 uleshort =0 \b, fsVersion %u (usual) >>>>>> 44 ulelong > 2 \b, rootdir cluster %u #>>>>>> 44 ulelong =2 \b, rootdir cluster %u #>>>>>> 44 ulelong =1 \b, rootdir cluster %u >>>>>> 48 uleshort > 1 \b, infoSector %u #>>>>>> 48 uleshort =1 \b, infoSector %u (usual) >>>>>> 48 uleshort <1 \b, infoSector %u >>>>>> 50 uleshort > 6 \b, Backup boot sector %u #>>>>>> 50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>> 50 uleshort <6 \b, Backup boot sector %u >>>>>> 54 ulelong > 0 \b, reserved1 0x%x >>>>>> 58 ulelong > 0 \b, reserved2 0x%x >>>>>> 62 ulelong > 0 \b, reserved3 0x%x # same structure as FAT1X >>>>>> 64 ubyte > 0x80 \b, physical drive 0x%x #>>>>>> 64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) >>>>>> 64 ubyte&0x7F > 0 \b, physical drive 0x%x #>>>>>> 64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>> 65 ubyte > 0 \b, reserved 0x%x >>>>>> 66 ubyte > 0x29 \b, dos <4.0 BootSector (0x%x) >>>>>> 66 ubyte <0x29 \b, dos <4.0 BootSector (0x%x) >>>>>> 66 ubyte =0x29 >>>>>>> 67 ulelong x \b, serial number 0x%x >>>>>>> 71 string <NO\NAME \b, label: "%11.11s" >>>>>> 71 string > NO\NAME \b, label: "%11.11s" >>>>>> 71 string =NO\NAME \b, unlabeled ### FATs end > 0x200 lelong 0x82564557 \b, BSD disklabel # FATX 0 string FATX FATX filesystem data # Minix filesystems - Juan Cespedes <cespedes@debian.org> 0x410 leshort 0x137f Minix filesystem 0x410 beshort 0x137f Minix filesystem (big endian), > 0x402 beshort ! 0 \b, %d zones > 0x1e string minix \b, bootable 0x410 leshort 0x138f Minix filesystem, 30 char names 0x410 leshort 0x2468 Minix filesystem, version 2 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names # romfs filesystems - Juan Cespedes <cespedes@debian.org> 0 string -rom1fs-\0 romfs filesystem, version 1 > 8 belong x %d bytes, > 16 string x named %s. # netboot image - Juan Cespedes <cespedes@debian.org> 0 lelong 0x1b031336L Netboot image, > 4 lelong&0xFFFFFF00 0 >> 4 lelong&0x100 0x000 mode 2 >> 4 lelong&0x100 0x100 mode 3 > 4 lelong&0xFFFFFF00 ! 0 unknown mode 0x18b string OS/2 OS/2 Boot Manager 9564 lelong 0x00011954 Unix Fast File system (little-endian), > 8404 string x last mounted on %s, #> 9504 ledate x last checked at %s, > 8224 ledate x last written at %s, > 8401 byte x clean flag %d, > 8228 lelong x number of blocks %d, > 8232 lelong x number of data blocks %d, > 8236 lelong x number of cylinder groups %d, > 8240 lelong x block size %d, > 8244 lelong x fragment size %d, > 8252 lelong x minimum percentage of free blocks %d, > 8256 lelong x rotational delay %dms, > 8260 lelong x disk rotational speed %drps, > 8320 lelong 0 TIME optimisation > 8320 lelong 1 SPACE optimisation 9564 belong 0x00011954 Unix Fast File system (big-endian), > 7168 long 0x4c41424c Apple UFS Volume >> 7186 string x named %s, >> 7176 belong x volume label version %d, >> 7180 bedate x created on %s, > 8404 string x last mounted on %s, #> 9504 bedate x last checked at %s, > 8224 bedate x last written at %s, > 8401 byte x clean flag %d, > 8228 belong x number of blocks %d, > 8232 belong x number of data blocks %d, > 8236 belong x number of cylinder groups %d, > 8240 belong x block size %d, > 8244 belong x fragment size %d, > 8252 belong x minimum percentage of free blocks %d, > 8256 belong x rotational delay %dms, > 8260 belong x disk rotational speed %drps, > 8320 belong 0 TIME optimisation > 8320 belong 1 SPACE optimisation # ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com> 0x438 leshort 0xEF53 Linux > 0x44c lelong x rev %d > 0x43e leshort x \b. % d > 0x45c lelong ^0x0000004 ext2 filesystem data >> 0x43a leshort ^0x0000001 (mounted or unclean) > 0x45c lelong &0x0000004 ext3 filesystem data >> 0x460 lelong &0x0000004 (needs journal recovery) > 0x43a leshort &0x0000002 (errors) > 0x460 lelong &0x0000001 (compressed) #> 0x460 lelong &0x0000002 (filetype) #> 0x464 lelong &0x0000001 (sparse_super) > 0x464 lelong &0x0000002 (large files) # SGI disk labels - Nathan Scott <nathans@debian.org> 0 belong 0x0BE5A941 SGI disk label (volume header) # SGI XFS filesystem - Nathan Scott <nathans@debian.org> 0 belong 0x58465342 SGI XFS filesystem data > 0x4 belong x (blksz %d, > 0x68 beshort x inosz %d, > 0x64 beshort ^0x2004 v1 dirs) > 0x64 beshort &0x2004 v2 dirs) ############################################################################ # Minix-ST kernel floppy 0x800 belong 0x46fc2700 Atari-ST Minix kernel image > 19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy > 19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy ############################################################################ # Hmmm, is this a better way of detecting _standard_ floppy images? 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k > 0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k > 0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k > 0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM > 0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs > 0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k # Valid media descriptor bytes for MS-DOS: # # Byte Capacity Media Size and Type # ------------------------------------------------- # # F0 2.88 MB 3.5-inch, 2-sided, 36-sector # F0 1.44 MB 3.5-inch, 2-sided, 18-sector # F9 720K 3.5-inch, 2-sided, 9-sector # F9 1.2 MB 5.25-inch, 2-sided, 15-sector # FD 360K 5.25-inch, 2-sided, 9-sector # FF 320K 5.25-inch, 2-sided, 8-sector # FC 180K 5.25-inch, 1-sided, 9-sector # FE 160K 5.25-inch, 1-sided, 8-sector # FE 250K 8-inch, 1-sided, single-density # FD 500K 8-inch, 2-sided, single-density # FE 1.2 MB 8-inch, 2-sided, double-density # F8---- Fixed disk # # FC xxxK Apricot 70x1x9 boot disk. # # Originally a bitmap: # xxxxxxx0 Not two sided # xxxxxxx1 Double sided # xxxxxx0x Not 8 SPT # xxxxxx1x 8 SPT # xxxxx0xx Not Removable drive # xxxxx1xx Removable drive # 11111xxx Must be one. # # But now it's rather random: # 111111xx Low density disk # 00 SS, Not 8 SPT # 01 DS, Not 8 SPT # 10 SS, 8 SPT # 11 DS, 8 SPT # # 11111001 Double density 3 ˝ floppy disk, high density 5 Ľ # 11110000 High density 3 ˝ floppy disk # 11111000 Hard disk any format # # CDROM Filesystems 32769 string CD001 ISO 9660 CDS-ROM filesystem data # "application id" which appears to be used as a volume label > 32808 string> \0 ' %s' > 34816 string \000CD001\001EL\TORITO\SPECIFICATION (bootable) 37633 string CD001 ISO 9660 CDS-ROM filesystem data (raw 2352 byte sectors) 32776 string CDROM High Sierra CD-ROM filesystem data # cramfs filesystem - russell@coker.com.au 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian > 4 lelong x size %d > 8 lelong &1 version #2 > 8 lelong &2 sorted_dirs > 8 lelong &4 hole_support > 32 lelong x CRC 0x%x, > 36 lelong x edition %d, > 40 lelong x %d blocks, > 44 lelong x %d files 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian > 4 belong x size %d > 8 belong &1 version #2 > 8 belong &2 sorted_dirs > 8 belong &4 hole_support > 32 belong x CRC 0x%x, > 36 belong x edition %d, > 40 belong x %d blocks, > 44 belong x %d files # reiserfs - russell@coker.com.au 0x10034 string ReIsErFs ReiserFS V3.5 0x10034 string ReIsEr2Fs ReiserFS V3.6 > 0x1002c leshort x block size %d > 0x10032 leshort &2 (mounted or unclean) > 0x10000 lelong x num blocks %d > 0x10040 lelong 1 tea hash > 0x10040 lelong 2 yura hash > 0x10040 lelong 3 r5 hash # JFFS - russell@coker.com.au 0 lelong 0x34383931 Linux Journalled Flash File system, little endian 0 belong 0x34383931 Linux Journalled Flash File system, big endian # EST flat binary format (which isn't, but anyway) # From: Mark Brown <broonie@sirena.org.uk> 0 string ESTFBINR EST flat binary # Aculab VoIP firmware # From: Mark Brown <broonie@sirena.org.uk> 0 string VoIP\Startup\and Aculab VoIP firmware > 35 string x format %s # PPCBoot image file # From: Mark Brown <broonie@sirena.org.uk> 0 belong 0x27051956 PPCBoot image > 4 string PPCBoot >> 12 string x version %s # JFFS2 file system 0 leshort 0x1984 Linux old jffs2 filesystem data little endian 0 lelong 0xe0011985 Linux jffs2 filesystem data little endian # Squashfs 0 string sqsh Squashfs filesystem, big endian, > 28 beshort x version %d. > 30 beshort x \b%d, > 8 belong x %d bytes, > 4 belong x %d inodes, > 28 beshort <2 >> 32 beshort x blocksize: %d bytes, > 28 beshort> 1 >> 51 belong x blocksize: %d bytes, > 39 bedate x created: %s 0 string hsqs Squashfs filesystem, little endian, > 28 leshort x version %d. > 30 leshort x \b%d, > 8 lelong x %d bytes, > 4 lelong x %d inodes, > 28 leshort <2 >> 32 leshort x blocksize: %d bytes, > 28 leshort> 1 >> 51 lelong x blocksize: %d bytes, > 39 ledate x created: %s # # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> # this can be overridden by the DOS executable (COM) entry 2 string LILO Linux/i386 LILO boot/chain loader # # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 0 leshort 0x0436 Linux/i386 PC Screen Font data, > 2 byte 0 256 characters, no directory, > 2 byte 1 512 characters, no directory, > 2 byte 2 256 characters, Unicode directory, > 2 byte 3 512 characters, Unicode directory, > 3 byte > 0 8x%d # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 4086 string SWAP-SPACE Linux/i386 swap file # From: Jeff Bailey <jbailey@ubuntu.com> # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image # according to man page of mkswap (8) March 1999 4086 string SWAPSPACE2 Linux/i386 swap file (new style) > 0x400 long x %d (4K pages) > 0x404 long x size %d pages # ECOFF magic for OSF/1 and Linux (only tested under Linux though) # # from Erik Troan (ewt@redhat.com) examining od dumps, so this # could be wrong # updated by David Mosberger (davidm@azstarnet.com) based on # GNU BFD and MIPS info found below. # 0 leshort 0x0183 ECOFF alpha > 24 leshort 0407 executable > 24 leshort 0410 pure > 24 leshort 0413 demand paged > 8 long > 0 not stripped > 8 long 0 stripped > 23 leshort > 0 - version %ld. |
| 48. Antech, 8/15/2007 09:43 |
Guybrush Threepwood
> 0 string \0\0\0\0 \b, extended partition table And what it means? It is any script? |
| 49. Guybrush Threepwood, 8/15/2007 13:59 |
| Antech It is base of signatures Mixture, тип_данных, ожидаемые_данные, чего_значат In this case it means that if it has found “x86 boot sector” on displacement “0″ (to the beginning of this sector) should be “line” from 4 zero, here and all magic Here the inquiry, I hope, it is not too strong offtopim: MAGIC MAGIC NAME ———————————————— magic − file command’s magic number file DESCRIPTION This manual page documents the format of the magic file as used by the file (1) command, version 4.14. The file command identifies the type of a file using, among other tests, a test for whether the file begins with a certain magic number. The file/usr/share/misc/magic specifies what magic numbers are to be tested for, what message to print if a particular magic number is found, and additional information to extract from the file. Each line of the file specifies a test to be performed. A test compares the data starting at a particular offset in the file with a 1-byte, 2-byte, or 4-byte numeric value or a string. If the test succeeds, a message is printed. The line consists of the following fields: offset A number specifying the offset, in bytes, into the file of the data which is to be tested. type The type of the data to be tested. The possible values are: byte A one-byte value. short A two-byte value (on most systems) in this machine’s native byte order. long A four-byte value (on most systems) in this machine’s native byte order. string A string of bytes. The string type specification can be optionally followed by / [Bbc] *. The “B” flag compacts whitespace in the target, which must contain at least one whitespace character. If the magic has n consecutive blanks, the target needs at least n consecutive blanks to match. The “b” flag treats every blank in the target as an optional blank. Finally the “c” flag, specifies case insensitive matching: lowercase characters in the magic match both lower and upper case characters in the targer, whereas upper case characters in the magic, only much uppercase characters in the target. date A four-byte value interpreted as an UNIX date. ldate A four-byte value interpreted as an UNIX-style date, but interpreted as local time rather than UTC. beshort A two-byte value (on most systems) in big-endian byte order. belong A four-byte value (on most systems) in big-endian byte order. bedate A four-byte value (on most systems) in big-endian byte order, interpreted as an Unix date. leshort A two-byte value (on most systems) in little-endian byte order. lelong A four-byte value (on most systems) in little-endian byte order. ledate A four-byte value (on most systems) in little-endian byte order, interpreted as an UNIX date. leldate A four-byte value (on most systems) in little-endian byte order, interpreted as an UNIX-style date, but interpreted as local time rather than UTC. regex A regular expression match in extended POSIX regular expression syntax (much like egrep). The type specification can be optionally followed by/c for case-insensitive matches. The regular expression is always tested against the first N lines, where N is the given offset, thus it is only useful for (single-byte encoded) text. ^ and $ will match the beginning and end of individual lines, respectively, not beginning and end of file. search A literal string search starting at the given offset. It must be followed by / <number> which specifies how many matches shall be attempted (the range). This is suitable for searching larger binary expressions with variable offsets, using \escapes for special characters. The numeric types may optionally be followed by AND and a numeric value, to specify that the value is to be AND’ed with the numeric value before any comparisons are done. Prepending an u to the type indicates that ordered comparisons should be unsigned. test The value to be compared with the value from the file. If the type is numeric, this value is specified in C form; if it is a string, it is specified as a C string with the usual escapes permitted (e.g. \n for new-line). Numeric values may be preceded by a character indicating the operation to be performed. It may be =, to specify that the value from the file must equal the specified value, <to specify that the value from the file must be less than the specified value,>, to specify that the value from the file must be greater than the specified value, AND, to specify that the value from the file must have set all of the bits that are set in the specified value, ^, to specify that the value from the file must have clear any of the bits that are set in the specified value, or x, to specify that any value will match. If the character is omitted, it is assumed to be =. For all tests except string and regex, operation! specifies that the line matches if the test does not succeed. Numeric values are specified in C form; e.g. 13 is decimal, 013 is octal, and 0×13 is hexadecimal. For string values, the byte string from the file must match the specified byte string. The operators =, <and> (but not) can be applied to strings. The length used for matching is that of the string argument in the magic file. This means that a line can match any string, and then presumably print that string, by doing> \0 (because all strings are greater than the null string). message The message to be printed if the comparison succeeds. If the string contains a printf (3) format specification, the value from the file (with any specified masking performed) is printed using the message as the format string. Some file formats contain additional information which is to be printed along with the file type or need additional tests to determine the true file type. These additional tests are introduced by one or more> characters preceding the offset. The number of> on the line indicates the level of the test; a line with no> at the beginning is considered to be at level 0. Tests are arranged in a tree-like hierarchy: If a the test on a line at level n succeeds, all following tests at level n+1 are performed, and the messages printed if the tests succeed, untile a line with level n (or less) appears. For more complex files, one can use empty messages to get just the “if/then” effect, in the following way: 0 string MZ > 0x18 leshort <0x40 MS-DOS executable > 0x18 leshort> 0x3f extended PC executable (e.g., MS Windows) Offsets do not need to be constant, but can also be read from the file being examined. If the first character following the last> is a (then the string after the parenthesis is interpreted as an indirect offset. That means that the number after the parenthesis is used as an offset in the file. The value at that offset is read, and is used again as an offset in the file. Indirect offsets are of the form: ((x [. [bslBSL]] [+ −] [y]). The value of x is used as an offset in the file. A byte, short or long is read at that offset depending on the [bslBSL] type specifier. The capitalised types interpret the number as a big endian value, whereas the small letter versions interpret the number as a little endian value. To that number the value of y is added and the result is used as an offset in the file. The default type if one is not specified is long. That way variable length structures can be examined: # MS Windows executables are also valid MS-DOS executables 0 string MZ > 0x18 leshort <0x40 MZ executable (MS-DOS) # skip the whole block below if it is not an extended executable > 0x18 leshort> 0x3f >> (0x3c.l) string PE\0\0 PE executable (MS-Windows) >> (0x3c.l) string LX\0\0 LX executable (OS/2) This strategy of examining has one drawback: You must make sure that you eventually print something, or users may get empty output (like, when there is neither PE\0\0 nor LE\0\0 in the above example) If this indirect offset cannot be used as-is, there are simple calculations possible: appending [+-* / % AND | ^] <number> inside parentheses allows one to modify the value read from the file before it is used as an offset: # MS Windows executables are also valid MS-DOS executables 0 string MZ # sometimes, the value at 0x18 is less that 0x40 but there’s still an # extended executable, simply appended to the file > 0x18 leshort <0x40 >> (4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP) >> (4.s*512) leshort! 0x014c MZ executable (MS-DOS) Sometimes you do not know the exact offset as this depends on the length or position (when indirection was used before) of preceding fields. You can specify an offset relative to the end of the last uplevel field using AND as a prefix to the offset: 0 string MZ > 0x18 leshort> 0x3f >> (0x3c.l) string PE\0\0 PE executable (MS-Windows) # immediately following the PE signature is the CPU type >>> &0 leshort 0x14c for Intel 80386 >>> &0 leshort 0x184 for DEC Alpha Indirect and relative offsets can be combined: 0 string MZ > 0x18 leshort <0x40 >> (4.s*512) leshort! 0x014c MZ executable (MS-DOS) # if it’s not COFF, go back 512 bytes and add the offset taken # from byte 2/3, which is yet another way of finding the start # of the extended executable >>> AND (2.s-514) string LE LE executable (MS Windows VxD driver) Or the other way around: 0 string MZ > 0x18 leshort> 0x3f >> (0x3c.l) string LE\0\0 LE executable (MS-Windows) # at offset 0x80 (-4, since relative offsets start at the end # of the uplevel match) inside the LE header, we find the absolute # offset to the code area, where we look for a specific signature >>> (&0x7c.l+0x26) string UPX \b, UPX compressed Or even leshort> 0×3f Finally, if you have to deal with offset/length pairs in your file, even the second value in a parenthesed expression can be taken from the file itself, using another set of parentheses. Note that this additional indirect offset is always relative to the start of the main indirect offset. 0 string MZ > 0x18 leshort> 0x3f >> (0x3c.l) string PE\0\0 PE executable (MS-Windows) # search for the PE section called ".idata"... >>> &0xf4 search/0x140.idata # ... and go to the end of it, calculated from start+length; # these are located 14 and 10 bytes after the section name >>>> (&0xe.l + (-4)) string PK\3\4 \b, ZIP self-extracting archive BUGS The formats long, belong, lelong, short, beshort, leshort, date, bedate, and ledate are system-dependent; perhaps they should be specified as a number of bytes (2B, 4B, etc), since the files being recognised typically come from a system on which the lengths are invariant. There is (currently) no support for specified-endian data to be used in indirect offsets. SEE ALSO file (1) − the command that reads this file. |
| 50. Antech, 8/15/2007 15:33 |
| Guybrush Threepwood Thanks for the help. On displacement “0″ (to the beginning of this sector) should be “line” from 4 zero |
| 51. Guybrush Threepwood, 8/15/2007 17:06 |
| Antech It turns out that AMBR it is described by one condition: 4 zero in the beginning. And “>” in the beginning what for? At first there should be a boot-sector definition (in this case it is 2 bytes in the end of sector), but only then all the rest It agree, on it it is a lot of candidates, and my example – shows nesovsem a correct conclusion. |
| 52. Stuk2k, 9/11/2007 22:44 |
| TO ALL Help, than can… Situation: Asus A8N-E + 3*80Gb Samsung (1 in itself with Windows and 2 in raid0 with a database). There was a following (under stories of eyewitnesses): On Friday a computer have cut down normally On Monday have come – вместo Windows disk boot failure Then have thrown off bios in a default Windows it was loaded All ok like, BUT Instead of b/d one file without expansion with the name “a black small square” in weight in all b/d How to treat? Thankful in advance |
| 53. Guybrush Threepwood, 9/12/2007 00:52 |
| Stuk2k What for base? If something is restored not can check up it on integrity? Whose bios? And how screws – as a file, or how separate disks are now visible? On idea, mazdajka could find “half”, and try it zamontirovat “as is”, probably “having treated”. It is bad. Steps such: |
| 54. Stuk2k, 9/12/2007 01:19 |
| Guybrush Threepwood Accounts department dbf Whose bios? Is to what? bios sees 3 hards Windows 1 and raid Check of screws in MHDD/Victoria, vyklayvanie a smart here is what for? Tomorrow otpishu with smesta events. Addition from 9/12/2007 01:19: Thanks |
| 55. Mate, 11/16/2007 17:08 |
| 2all: Please, help. Iron: Asus P5KR (bios 0201, chip ICH9R) + 2*320Gb SATA2 Seagate Barracuda ES ST3320620NS It seems that malfunction only in one screw. Physical or program I do not know. I am in Novosibirsk. In one office have offered only for restoration infy 7,6 t.r., even if there will be a simple operation… What to do? What variants will be? 1. Tried pereproshit bios – has not helped. ps if it will turn out to restore, I will pass on raid1 since infa and time is more important (and than I thought earlier) |
| 56. Antech, 11/16/2007 17:25 |
| Mate Test the problem screw in MHDD/Victoria about SMART and skana surfaces. If defects are not present, create a virtual strajp-file in R-Stusio and restore infu. If defety is, it is necessary to make in the beginning posektornuju a copy and in R-Studio to make a file of a real disk (serviceable) and a file of an image, it is not difficult. The first screw is visible as a non-working file, and the second is visible as the empty not marked disk Whist has suggested an empty disk to add as MBR, on what I have agreed Not zapisyvate anything on daski the former file. Hint: at creation/removal of file BIS of the controller too can write down infu on disks. |
| 57. Leo, 11/16/2007 18:56 |
| The citation:
Antech: At creation/removal of file BIOS of the controller too can write down infu on disks. And on some controllers – on 100000 sectors from the beginning can jam. |
| 58. Mate, 11/16/2007 23:17 |
| The citation:
Antech: Test the problem screw in MHDD/Victoria about SMART and skana surfaces. This test to me infu not zaportit? And program R-Studio GetDataBack for NTFS? And in Intel Matrix RAID by default strajp in the size in 128кб, it at creation also chose. The citation: Not zapisyvate anything on daski the former file. Hint: at creation/removal of file BIS of the controller too can write down infu on disks. I.e. in no event it is impossible in biose Intel Matrix’а: to delete spot-check, to dump disks in non-RAID and to create a file anew? There are thoughts that Whist could add on the empty screw? |
| 59. Antech, 11/17/2007 14:38 |
| Mate This test to me infu not zaportit? I, of course, the fool, but not on so much that in theme about restoration to advise frankly destructive methods. Usually I suggest to write down only the disk editor, and with indispensable preliminary bekapom. The offered tests and rekaverilki – only reading from the problem device. How to create a spot-check copy in a virtual strajp-file strajp in the size in 128кб In no event it is impossible in biose Intel Matrix’а: to delete spot-check, to dump disks in non-RAID and to create a file anew? What Whist could add on the empty screw? |
| 60. Zx12, 11/23/2007 14:55 |
| Prompt, pliz. Was RAID-0 (Seagete SATA 300Gb x 2) more than 2th years has fulfilled problems were not. Yesterday has solved defragmentirovat (O&O Defrag v.10).zadal a defragmentation, in 2 hours prishol – defrag 14 % and writes that “the volume is not accessible or there is no one disk porobujte to copy the data”, at copying attempt again an error. Folders on rejde were visible, but open or is empty, or only a part of the data. Window Matrix Storage.Винты in BIOS also has still got out are visible, in Windows it is not visible any. It is a sentence? Or there are chances to rescue infu (the house. A photo and video)? If there is a chance, please, prompt from what to begin? P.S. ASUS P5WD2Premium. RAID it is created by means materinki. |
| 61. Antech, 11/23/2007 15:19 |
| Zx12 1. To forget about storage valuable infy on RARID0. 2. Posektornye copies from screws (on other computer, RAID the controller should not know about it). 3. To forget about storage valuable infy on RARID0. 4. Connection instead of initial screws (if the file has not collapsed) or assemblage of a virtual file in R-Studio (if the file taki has collapsed). In the second case screws konfigurjatsja in biose the controller as separate (not RAID). 5. Vosstanovlnie files through R-Studio. 6. To forget about storage valuable infy on RARID0. 7. Always to do bekap. |
| 62. Zx12, 11/24/2007 10:41 |
| 2. And where to look as it posektorno to copy? And disks in Windows are not visible but only in BIOS how thus it is possible to copy? 5. And it is possible what nibud reference where to esteem as with R-Studio to work (that definitively all not to ruin)? |
| 63. jagger, 11/24/2007 11:09 |
| Here about R-Studio (http://rlab.ru/doc/simple_data_recovery.html) esteem. |
| 64. Zx12, 11/26/2007 16:29 |
| All the Sunday long eksperementiroval with different programs that RAID-0 to restore – any has not helped, and then in BIOS has climbed has changed AHCI on RAID, has rebooted became even worse, then has again changed RAID on AHCI, has rebooted – and so two consecutive times – and RAID-0 suddenly took and was defined. Such here dances with a tambourine!
P.S. Thanks all who has responded! |
| 65. Blackhawk, 12/15/2007 17:22 |
| Has been organised RAID 0 file, and at loading of the file of lines me has pulled to stick fleshku in a computer, well and pipets, right now the utility for work with it writes that it Offline.
Screws whole http://photo.nextrim.ru/main.php?g2_view=core.DownloadItem&g2_itemId=67360&g2_ But here a file simply I think that when the second screw was connected to a file I have thrust fleshku and there was a conflict of the equipment and the second screw was not defined, thereby the utility has created a new file, but with one screw. Reboot and computer deenergizing nepomogaet. http://photo.nextrim.ru/main.php?g2_view=core.DownloadItem&g2_itemId=67365&g2_ Rebild a file does not help It is ready to pay for the real help in restoration of the information from a file. Addition from 12/15/2007 19:03: Still a question: Whether and it is impossible to remove the new created file because of failure and to try to reboot a computer, whether there is a probability of that that after removal of a new file, the old file will pick up that screw which was in a new file? Addition from 12/15/2007 19:42: Simply judging by this picture the second screw on 80 gigov simply is not connected to spot-check to a file http://photo.nextrim.ru/main.php?g2_view=core.DownloadItem&g2_itemId=67417&g2_ |
| 66. andrew_spb, 12/16/2007 00:22 |
| Experience “dostavanija” the data from RAID 0. Suddenly to whom it is useful. Situation: long time 0 file on base 2х120Гб (used controller Ali, PCI). On it various DV-fragments were stored, ispolzuemyev prompts, runs etc. and actually they had value as time spent for their cutting and ordering. The rest that there lay, too has been removed from tapes, therefore the basic criterion of value – too time. So, the file was maintained normally, then its contents have been copied on bolshy the screw, the file is dismounted in Windows (the section is removed), and then dismounted and on the controller. Then these two screws are removed and postponed in stuff. And here to the big screw occurs trabl (a BIOS of mum + I nepodstrahovalsja) and all this soljanka departs in…. Restoration attempts infy on the big screw of special success had no, the Windows have had time to mock at it by own strength. pomuchivshis evening, since the morning has decided to try to glance on screws of an old file in spite of the fact that they have been already formatted as separate 120. The controller collecting rajd, fairly having warned that all infa that…, the file has collected. Then, WITHOUT INITIALIZING a file (a disk on 240) in Windows, I has filled on it with program GetDataBack for NTFS. And after a while (disk scanning) has received there all structure of directories. Has copied all this economy further. Behind an exception of pair especially long (10 Gb) the files, all the rest has got out back. The note: during scanning STRONGLY razgrevajutsja, the fan it was necessary to put disks “on live” as screws have been connected out of the case, on wires. Total: economy of pair-three days and a notch from nonsense. |
| 67. Blackhawk, 12/16/2007 16:21 |
| andrew_spb
There is no your experience unfortunately does not help, or I not that do something, in general GetDataBack for NTFS sees files, but incorrectly restores, likely most likely at first it will be necessary to collect an image RAID Reconstructor’om and then to take advantage GetDataBack for NTFS. |
| 68. Antech, 12/16/2007 16:46 |
| If the controller silently initialized screws, would be the priest. Therefore so do not do. Instead create a virtual file in R-Studio and the same R-Studio restore infu from a file. It is possible zajuzat RAID Reconstructor, it sozast a copy of a virtual file in a file with which have then a good time any evristikom, understanding files of images (GetDataBack, R-Studio). |
| 69. Blackhawk, 12/16/2007 17:37 |
| Antech
Question, whether and to create a virtual image R-Studio the empty physical disk is necessary for this purpose? |
| 70. Antech, 12/17/2007 09:45 |
| Blackhawk Whether to create a virtual image R-Studio the empty physical disk is necessary for this purpose? No. The screw with Windows and established R-Studio is necessary only. But when the studio will finish scanning and (if) there will be a possibility to restore files, for them the place, naturally already is required. RAID Reconstructor – other business. He creates an image on which are then filled heuristics (well authors, naturally, busily advise the GetDataBack). The image can be made not only on a disk as you tried, but also in a file (it was necessary to read help). Certainly, this intermediate stage needs a place. Advantage in comparison with a variant “a-lja R-Studio” – possibility to analyze the received image the disk editor, a lack – for an image is necessary a lot of place. |
| 71. Blackhawk, 12/17/2007 19:00 |
| Antech
And which R-Studio is necessary? Addition from 12/18/2007 03:47: All many thanks has restored 100 % infy, has thrust 2 screws in a computer (which were in a file) and used RAID Reconstructor in it has created an image of a file and has kept on the third screw and by means of GetDataBack has pulled out from an image all lost infu. |
| 72. Antech, 12/18/2007 09:43 |
| Blackhawk And which R-Studio is necessary? I do not know. At me version 4.0 (Demo), with files is able to work. But this feature was and in earlier versions. |
| 73. akerka, 3/21/2008 17:43 |
| And I do not manage to make image of a disk. When I do by its means Raid reconstructor or R-Studio on 48th percent there is a computer restart (Windows XP SP2 pure, only established). I need to make image – electronics of one of disks has refused, I should change controllers. Who or why the computer can reboot knows? |
| 74. Hamann07, 6/4/2008 11:02 |
| I such problem on a server have 5 disks Compaq 0 and 2 vaabshe are not loaded. Jumps out ssobshchenie <Non-System disk or disk error> Replace and strike any key when ready> What to do? Help!!! |
| 75. Marryhorse, 6/4/2008 12:04 |
| And disks in what file? |
| 76. Hamann07, 6/4/2008 12:28 |
| Marryhorse Raid |
| 77. Marryhorse, 6/4/2008 12:34 |
| Hamann07
1. Mine to you council: if want will keep the data urgently address in specialised offices. Anything do not touch. Simply switch off a server and in firm on restoration danyh. There as it is possible explain more in detail as well as where the data was stored. |
| 78. Hamann07, 6/4/2008 12:38 |
| Marryhorse
Bakapy bases is. Only here there very important documentation. How it it is possible therefrom izvlech? Addition from 6/4/2008 12:42: Marryhorse Can eat a way to start working disks to connect to something? I do not know |
| 79. Marryhorse, 6/4/2008 12:44 |
| Hamann07
Time not zniaete also it is not necessary most to climb there! Will make even worse. A direct way to spetsam! |
| 80. Hamann07, 6/4/2008 12:49 |
| Marryhorse
Last question as it is possible to restore Raid a file having put new 2 disks? Addition from 6/4/2008 12:49: Marryhorse I never faced such problem |
| 81. Marryhorse, 6/4/2008 13:11 |
| Hamann07
What level RAID of a file at you? |
| 82. Tatsuro, 7/13/2008 12:14 |
| Prompt please that it is possible to make to do… pochemuto from file RAID 0 all sections and naturally Windows ter have disappeared is not loaded referring to absence of any file. Both screws WD on 300 gb work normally… materinka Gigabyte GA-M61SME-S2 chipsets Nvidia How to return sections??? |
| 83. Antech, 7/13/2008 17:58 |
| Tatsuro From file RAID 0 all sections and naturally Windows ter have disappeared is not loaded referring to absence of any file And whence the Windows are loaded? From other screw? It is possible to try to return sections TestDisk’ом (any guarantees that it will spoil nothing, I do not give). |
| 84. Dimitry_I, 9/23/2008 05:03 |
| In the evening there was such “trouble”: there were some dissonances with the equipment, it is not known – memory, percents, materinka… But at hand there was a newcomer mamka, I have rearranged the RAID0 (500+500) on it, pojuzal BIOS, but it has appeared that new unlike mine, does not support Rajdy. However, at a computer was to steam of attempts to be loaded: has missed few times by adjustment of Biosa…
When has returned screws back on the platform, in the Bios-utility (from Asus) has shown that one disk – “Disk0 from RAID”, and the second – “Non-RAID Disk”. The data precisely any was not written, anywhere did not rearrange more, has simply switched off and has decided to esteem-ask at first. As the information on disks the extremely important, unequivocally I wish to restore. Perhaps someone will prompt variants of the decision of the given problem? How much I understand, it is necessary “to return any utility the deserter in a system”, having specified it “the place”… But there are not enough knowledge. |
| 85. Antech, 9/23/2008 08:40 |
| Dimitry_I Data precisely any was not written And here it is not known. For example, a BIOS could cut off silently a little megov in the end of a disk and to write down there the copy. And there can be COD rejda. The information on disks the extremely important Having specified it “the place” |
| 86. Dimitry_I, 9/23/2008 12:05 |
| I think that hardly a BIOS did a copy as as mine materinka (Asus Commando), and new trial (Gigabyte GA-EP45-DS3L) have function rezernogo storages biosa (?), therefore according to the logic of things to throw off a BIOS on the screw there is no need.
Of itself unequivocally it is not assured. Moreover, from descriptions has received representation and a kind these both utilities (and one more, but has forgotten the name), but because of importance of the information I will invite the competent person. But that not meee many thanks for the information and council. |
| 87. Antech, 9/23/2008 13:33 |
| Dimitry_I New trial (Gigabyte GA-EP45-DS3L) B…! Gigabajty it very much love! Can esteem that they do, when gljuchat on 1 TB screws (cut off to 32 MB). When not gljuchat, simply pinch off a little in the end of the screw so the user does not notice. You can try and is independent, R-Studio writes down nothing on the patient. And it is possible to be picked the editor, but changing/keeping nothing. |
| 88. SLee, 9/23/2008 14:00 |
| Dimitry_I Perhaps someone will prompt variants of the decision of the given problem? Now I torment myself and the disks therefore here mine (gained and recommended) a way… By the way, Rekonstruktor can keep the created image rejda in GetDataBack or something to make by means of Nemo. |
| 90. Dimitry_I, 9/24/2008 04:37 |
| Has decided to share drudgeries…
Practically days it was taken in R-Studio, RaidConstructor and GetDataBack… Has reached folders, but files from above approximately kilobyte turn out zaporchennymi, the correct version and has not received In a word, LOW BOW to developers. By the way, they from Donetsk (has how much understood). |
| 91. Antech, 9/24/2008 08:47 |
| Dimitry_I Files from above approximately kilobyte turn out zaporchennymi It is less approximately than half-kilobyte – resident (NTFS), it is more – non-resident. You have incorrectly entered parametres into Studio, the file has been interpreted incorrectly. UFS Explorer On restoration of ALL FILES of the first section (the first – 100Гб, the second under 900Гб) has left minutes 2 |
| 92. Dimitry_I, 9/24/2008 14:02 |
| Not, for 2 days I so have read that already which what I understand… If in biose I put IDE configuration as RAID Intel Matrix at once shows the utilitku at loading, and there it is accurately visible that the size of the strajp-block (?) 128Кб. Besides, I accurately know, what disk at me Disk0 and what should be Disk1. There so there are not enough parametres what to be mistaken in them it is very difficult. Concerning copying: I have not told that I have copied ALL disk. If to consider that there was decently an empty seat that I did not copy system folders but only took the information necessary to me and it has turned out. But, by the way, he writes really bright, Far it does more slowly: as, I do not know. Still it is necessary not to forget my morale during that moment… I also wrote on pleasure. Thanks for the information and comments. |
| 93. Antech, 9/24/2008 17:46 |
| Dimitry_I Already which what I understand Something else means has been made not so. RAID0 on chipsetnom the controller – too simple thing that the Studio has not restored. If the file and in Sutdii it is not necessary to scan only has collapsed, should help Open Drive Files. |
| To this theme of 10/13/2008 14:14 moderator-Ing has glued a theme “the disk from RAID0″ (the author Has dropped out: Pheezrook) |
| 95. Pheezrook, 10/11/2008 11:58 |
| In advance I apologise if the question already was, I have fairly re-read all themes on RAID0, but such have not found. Situation following: There is a computer with Vista x64 and RAID0 from two Seagate 500GB 7200.11 on controller Intel ICH9R. On the computer dump CMOS after which controller has been made switched from mode RAID in SATA. With such options the computer has tried to be loaded, but certainly unsuccessfully. After that RAID the mode has been included in a normal state, but in RAID BIOSе now one of hard disks is defined as Non-Raid, is visible that with which it tried to be loaded. In Intel Matrix has not found any points apropos vovrashchenija a disk in a file. Can be probably surgical way to register on the dropped out disk an accessory label to a file? I will be grateful for any councils and helps http://www.ii4.ru/images/886339Snimok.JPG (704×373, 64,6Kb) (http://www.ii4.ru/) |
| 96. Iljasla, 10/11/2008 12:29 |
| Pheezrook If you did not store on a file of the crucial information, that idle time – to remove RAID and to create again same as was. Without initialization! If such infa was – on other computer by means of R-Studio softovo to collect a file and to extend infu with record on the third screw. And on the future not to forget regularly bekapit. |
| 97. Pheezrook, 10/11/2008 12:55 |
| That’s just the point that stored, presozdat a file not a problem, it would be desirable to restore all in a former condition. Intel Matrix is able to create a file without initialization? At removal of last member from a file on it infa will not get into? |
| 98. Iljasla, 10/11/2008 17:34 |
| Pheezrook The way of removal and the subsequent reconstruction without inita should restore a file normally. But to hell unnecessary risk, you not plunder bank. Will extend infu then will experiment with Matriksom. And now – a variant with R-Studio, time bekapov is not present. Restoration RAID 0 files (one of screws has fallen) (http://forum.ixbt.com/topic.cgi?id=11:32645) |
| 99. Pheezrook, 10/11/2008 18:24 |
| Thanks. Too has come to such conclusion. |
| 100. okzo, 10/21/2008 14:16 |
| The citation:
Antech: RAID0 On chipsetnom the controller – too simple thing, toby the Studio has not restored. Not absolutely so (intel matrix n.p), for example on one aray RAID 0 we create a quantity of volumes RAID 0> 1, and here simple RAID kovyrjalka the weak assistant! |
| 101. gss, 10/21/2008 14:23 |
| okzo Here simple RAID kovyrjalka the weak assistant! In that case the best assistant – the psychiatrist. |
| 102. okzo, 10/21/2008 14:32 |
| The citation:
gss: okzo Here simple RAID kovyrjalka the weak assistant! In that case the best assistant – the psychiatrist. Well what for so it is rough!-> http://forum.idg.pl/index.php? s = and showtopic=13919 … ost&p=1164721 I will not translate! http://edp.net.pl/!plk/idg/139199/foto.jpg (1436×854, 137,2Kb) Compare http://obrazki.elektroda.net/89_1224585169.jpg (800×600, 237,9Kb) And the matter is that offset between last block of 1 volume and the first block of 2 volumes. For this message thanks have told: Antech |
| 103. SLee, 10/22/2008 08:26 |
| okzo Compare It is similar that a lot of time (if not to press in the trifles, that type that photos in general different) prevents to sleep easy to me already Between last block of 1 volume and the first block of 2 volumes And how this displacement to define? Will not help? Means quantitatively and in a direction. Or, can, displacement between disks is simple? In any case it is necessary to define displacement. How? It is not necessary to translate – hotjaby the key moments. In advance I thank. |
| 104. okzo, 10/22/2008 09:56 |
| http://translate.google.com/translate? u=http%3A%2F%2 … p; sl=pl&tl=ru |
| 105. SLee, 10/22/2008 12:20 |
| Has fairly tried to understand |
| 106. AleSoft, 11/13/2008 00:34 |
| There is such problem: server HP Prolian, is created a file raid0 from two 300Гб SCSI320 screws. There were Windows 2003 serser. It has been created two sections NTFS – on one system, on the second – the data. All excellently worked and at once the server has left on an overload. At loading writes has not found a logic disk because of an error on one of screws and a heap of preventions of possible loss of the data. Will stand, will wait and after a while leaves on an overload and so on a circle…. Question: how to rescue most without serious consequences given with the second section раид0 a file??? In advance thanks for the help! |
| 107. GRAYGS, 12/17/2008 19:52 |
| People help, mamka ASUS P5Q-E And RAID 0 OF 2Х identical 500 seagate, 1 from screws it has ceased to be defined, if I on it throw the controller from the same screw what to turn out? infa ostanetsja? |
| 108. Leo, 12/18/2008 11:42 |
| GRAYGS: Infa remains. Only not the fact that will be read. The faulty controller is only ~10 % of cases. |
| 109. Ing. Syst, 12/19/2008 10:19 |
| AleSoft How to rescue most without serious consequences given with the second section раид0 a file? On a server the data lay on RAID 0??? Actually? |
| 110. michm, 5/24/2009 04:08 |
| Physically disconnected screws (participants RAID0) and when has connected back, on zaparke has forgotten to expose in BIOS for ICH9 mode RAID and one disk from RAID0 there were NON-RAID after loading Whists from other screw (not participant RAID of a file). Prompt, please, the name of programs (if the such exist) which can try to restore RAID0 from two screws. That is, for example, in advertising “RAID Reconstructor – will not try” to repair ”yours RAID but only will create a copy of yours RAID in other place”, and I need just the return – not a copy to create, and to repair to try (infu it is not so a pity – simply films, and to buy the new screw for a copy of desire is not present, but if it will be possible to repair, I will be glad)! |
| 111. Iljasla, 5/24/2009 04:12 |
| michm And nafiga then to repair? Remove yes create anew. |
| 112. michm, 5/24/2009 04:23 |
| The citation:
Iljasla: michm And nafiga then to repair? Remove yes create anew. ——– There HR stood adjusted and films in volume of 1,2 Tb from two Tb on REJDe (almost has had time to look nothing) anew to pull a reluctance with torrentov – all the same it will occupy time much…. |
| 113. gss, 5/24/2009 10:17 |
| File it is possible peresozdat anew from biosa the controller, the data it poteret should not. But here MBR it will be jammed and the utility dljaego restoration is required is not to me. Such experiments riskovany. Do only if the data not too is important. |
| 114. spenc, 6/11/2009 11:49 |
| Help with raidom. After replacement BP. Became the message the raid 1 array needs to be duplicated to ensure data consistancy is deduced. As it can be restored without OS reinstallation. Screws whole. |
| 115. nazyura, 6/11/2009 12:33 |
| spenc …Screws whole. It says to you that a pier, “bekap the data tovarishch…” Can all the same “screws not whole”? |
| 116. spenc, 6/13/2009 04:29 |
| I tested them, a surface normal |
| 117. Iljasla, 6/13/2009 12:59 |
| spenc You not in a theme, here RAID0 it is discussed. And in general apparently a controller glitch: one of winchesters has seen the controller as “new”, and file RAID1 now does not exist. Controller Promajz? |
| 118. starostakm2, 7/24/2009 00:56 |
| Hello! Has faced the following problem: at me on a computer two hard disks MAXTOR STM 3500320AS (500 Gb) are united in RAID a file (the truth what – I do not know, whether RAID 0, whether whether 1то 5). RAID the controller on the basis of Silicon Image 3132. Parent payment ASUS P5Q. One month ago all it began to work very astably, and OS (Windows XP 64 bit) now is not started. At first there was any error, and the offer to press Ctrl+S or F4, that something to make with the driver (? I still understand not all in these rejdah)). Now in general writes NTLDR is missing. People, users and administrators! Help the lamer, please! What to do? How to learn file type (0. 1, 5, 10)? What it is necessary to make, that all worked?
Addition from 7/24/2009 01:00: Version biosa. If memory to me will not change 7.04.05 Addition from 7/24/2009 01:20: And in general, unreliable it is a thing (raid). |
| 119. Antech, 7/24/2009 09:50 |
| starostakm2 Unreliable it is a thing (raid) It very much nadezhneaja a thing when professionals do. Certainly, on nabortnom the controller, moreover and RAID-0, and in the usual personal computer with a cloud of possible problems is in general reliability zero… How to learn file type (0. 1, 5, 10)? Now depending on that is necessary: 1. Restoration of the data. 2. Restoration only working capacity of Windows. |
| 120. starostakm2, 7/24/2009 18:05 |
| Antech, thanks for the answer. Unfortunately, there is no possibility to connect a file to other computer (. The Fellow worker says, what it ostensibly incompatibility of a payment of the controller with zhestikmi disks (????). Such for the first time I hear. I will try, as you spoke, to check up each disk. Then otpishus.
Addition from 7/24/2009 18:07: Here still the question – whether is version МНDD which can be loaded from CD? A diskette simply to create not nachem. Now with nouta I sit, and at acquaintances flopakov is not present. Addition from 7/24/2009 21:57: On my computer the parent payment asus p5q – on it like too is raid. Then what for to me the controller connected to PCI-E1? Addition from 7/25/2009 03:46: Has removed raid the controller, has connected hard disks to plugs SATA E1 and SATA E2. Has reinstalled Windows. When has started to establish drivers has noticed that all system brakes. Then at the next reboot the following has started to appear for a long time: Marvell 88SE61xx Adapter – BIOS Version 1.1.0.L70. Addition from 7/25/2009 03:51: BIOS it was loaded, but something not so. Disks does not see – writes RAID. Addition from 7/25/2009 03:51: breddd Addition from 7/25/2009 03:51: What for I it have made all? |
| 121. starostakm2, 7/28/2009 21:19 |
| Gives out the following error: Not enough single drives to create Raid set |
| 122. Antech, 7/28/2009 21:58 |
| starostakm2 At me too P5Q, and all three screws are normally accessible. Dump a BIOS a crosspiece… I so have understood, any RAID actually it is not necessary to you, and the data too is not necessary… Then, after dump biosa, be loaded with Magic Boot Disk (ihdd.ru) and make CLRMBR to both screws (screws to connect to chipsetnomu to the controller better, and in biose to put SATA Compatible mode). Also snmiite the SMART (SMART ATT) also scan screws (SCAN). Show results. Further you take a copy of an original disk of Windows (not “assemblage”) and establish Windows. A marking and a format – only a fitter (NTFS), not system sections: to Execute – diskmgmt.msc (XP/Vista/7). Also it is not forgotten about a mode of compatibility for SATA in biose, that not zamorachivatsja with SATA drivers. |
| 123. starostakm2, 7/29/2009 00:02 |
| Check did not do. Has found out that one hard disk is not visible in biose.
Addition from 7/29/2009 00:03: Antech, you could not tell more in detail about a configuration of the computer? I at all do not know, on what to be guided. |
| 124. Antech, 7/29/2009 09:15 |
| starostakm2 The config of my computer can be looked in Info. But matter is not in it. P5Q – very popular payment and a problem not in it (if, of course, it is serviceable). If to dump options biosa by a crosspiece (the manual to mum see) and to connect screws to ports chipsetnogo the controller, screws should viditsja in biose. Otherwise a problem either with mum, or with screws. At you ST3500320AS – for certain with insertion SD15 (or as they name on STM, MX15). If normally starts (it is untwisted, there are no extraneous sounds), and in biose is not visible, it means for certain has caught TSTS and to you – in a theme about 7200.11 and ES.2 (continuation), there will find the instruction on repair. Given to you are not necessary, so safely try. Or simply address in a guarantee if it is. |
| 125. Serge102, 8/4/2009 20:58 |
| SLee It is not necessary to translate – hotjaby the key moments. In advance I thank. Has faced a problem, has found this theme search – otpishus, including for itself – not to forget. |