Data Recovery and Forensic Research
Data Recovery and Forensic Research
Friday 24 May 2013
Thursday 17 March 2011
Special RAID Type
1. RAID from Adaptec 3805
It has a data stripe size of 512 sectors and two rows as one data unit (5 data stripes) cycle. The data structure is:
P1= D5 XOR D2
P2= D1 XOR D3
P3= D2 XOR D4
P4= D3 XOR D5
P5= D4 XOR D1
For example, if Drive 1 and Drive 3 are failed, data on them can be regenerated by:
D1= D4 XOR P5;
D3= D5 XOR P4;
Due to the parity bits are not on the same row as the data bits, there is no software available in the market supports the regeneration of the missing data strips from crossed-row data and parity. The parity has to be on the same row as the data to regenerate the missing data by R-studio. Special script needs to be written to regenerate the content of the failed drives, so as to use conventional software to retrieve the data in the final step.
To regenerate the D1 on the first row of each data unit cycle, as in the example above, the script will calculate the XOR result between D4 on the first row and P5 on the second row and store the result on the first row of the missing drive. After running the script, the data structure will look like:
Now, we can use the R-Studio to retrieve the data. Build a virtual RAID using all the working drives and the drives regenerated. Set the RAID type as customized:
2. The second special type of RAID allows maximum two failed drives. It uses the redundancy of the original data, playing the same role as the parity. The data structure is:
Within a data unit cycle, it also has two rows as the first type. There is no parity at all. The green colored set of data is the redundancy. As can be seen from the data structure, even though it supports up to two failed drives, these two failed drives can NOT be 1+3, 1+4, 2+4, 2+5, 3+5. Any other failed drives combinations will be tolerated. For example, Drive 1 and Drive 2 are failed.
Using R-Studio, we can construct a customized virtual RIAD to retrieve the data as:
Thursday 24 February 2011
Script to attach MDF without LDF under SQL2000
Seagate 7200.12 ‘SIM ERROR’ Firmware Fault
The symptoms of ‘SIM Error’ firmware fault from hard drives belong to Seagate 7200.12 family are:
1. Hard drive status keeps BUSY forever after switching on;
2. In the serial command line, it outputs (when PCB is attached to hard drive):
SIM Error 3005
No HOST FIS-ReadyStatusFlags 2002A1A5
ASCII Diag mode
3. In the serial command line, it outputs (when PCB is detached from hard drive):
No HOST FIS-ReadyStatusFlags 2002A1A5
To use the conventional method of fixing a ‘BUSY and LBA=0’ 7200.11 hard drive, it outputs:
No HOST FIS-ReadyStatusFlags 2002A1A5
ASCII Diag mode
F3 T>/2
F3 2>Z
Spin Down Complete
Elapsed Time 6.015 secs
F3 2>
ASCII Diag mode
F3 T>/2
F3 2>U
HighPowerMode
ExecuteSpinRequest
Spin Up Complete
Elapsed Time 3.624 secs
F3 2>/1
F3 1>N1
Init SMART Fail
(P) SATA Reset
SIM Error 3005
No HOST FIS-ReadyStatusFlags 2002A1A5
ASCII Diag mode
F3 T>/2
F3 2>Z
Spin Down Complete
Elapsed Time 6.035 secs
F3 2>U
HighPowerMode
ExecuteSpinRequest
Spin Up Complete
Elapsed Time 3.573 secs
F3 2>/
F3 T>m0,2,2,,,,,22
Max Wr Retries = 00, Max Rd Retries = 00, Max ECC T-Level = 16, Max Certify Rewr
ite Retries = not supported
User Partition Format Successful - Elapsed Time 0 mins 00 secs
F3 T>/1
F3 1>N1
Clear SMART is completed.
F3 1>
Rst 0x08M
(P) SATA Reset
Written by: Zijian Xie (R&D Manager, MSc,BEng)