Case study of HP-EVA4100 data recovery in a hospital

Preface

I have been working for more than two months without knowing how to update my blog because I have to learn many things at work. Recently, my BOSS gave me a very difficult task, which puts a lot of pressure on me! That is a hospital's HP-EVA4100 data recovery. Although BOSS told me all EVA's internal algorithms, it is still very tricky. However, we finally made unremitting efforts to restore the EVA4100 data. After two days, the user is satisfied with the recovered data. The following describes the entire data recovery process.

I. Causes of EVA faults

Because the BOSS directly contacted the other party, I don't know what the situation is, but the BOSS told me when I gave me the task because a certain RSS has dropped two disks at the same time, the used Vdisk is unavailable, and the Vdisk is the created RAID 5. After finding data loss, the user did not use EVA4100, but directly obtained the data from our company for data recovery. In this case, the user can preliminarily determine that the data is not covered and the recovery is highly likely.

Ii. Check the EVA controller and Hard Disk

1. No fault was found during EVA4100 and cabinet check.

2. Use optical fiber cables to connect the cabinet to the server and use Winhex to open all disks.

650) this. length = 650; "src =" http://www.bkjia.com/uploads/allimg/140103/0026044C2-0.png "title =" 7.png" width = "498" height = "300" border = "0" hspace = "0" vspace = "0" style = "width: 498px; height: 300px; "alt =" 120005839.png"/>

3. When you use Winhex to open a disk, two disks cannot be opened. The hardware engineer detected that the disk was physically faulty.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/140103/0026045103-1.png "title =" 4.png" alt = "112015113.png"/>

4. It was preliminarily determined that EVA was not available due to two Disk Physical faults, resulting in data loss. Two faulty hard disks are handed over to the hardware group for detection and repair. If no fault occurs, the disks are scratched and cannot be recovered.

3. Prepare a preliminary solution

I have known the cause of the fault. Because the data on the two disks cannot be recovered, you can only restore the Vraid5 data if two disks are missing.

1. Shut down the controller and Cabinet of the EVA4100 and make the disk number a full image.

2. Use Winhex to open disks one by one and analyze disk information.

3. When analyzing each disk, it is found that RAID records exist in 1 TB and GB disks. In addition, there are 10 Luns in the entire EVA4100.

4. Analyze the RSS and find that the first few RSS disks correspond to exactly 1 TB, while the two dropped RSS disks are located in 4th groups of RSS. Therefore, we can conclude that the data on a 1 TB disk is complete. For data lost in RSS4, you can generate a part based on XOR, but it will still lose a part.

Now the entire analysis process is complete.

4. Data is successfully restored.

Based on the above analysis results, reorganize the LUN and data storage MAP, and extract the LUN data according to the internal algorithm of EVA. Eventually, more than 99% of data is restored, and only a small amount of data is completely lost. I am very satisfied with the restored data. It took two days to copy the data.

The article is from the North Asia data recovery center. reprinted by the original author.

Author: Deng Qi

TEL: 18911808630

This article is from the "Deng Qi" blog, please be sure to keep this source http://dengqi.blog.51cto.com/5685776/1347102