EMC CX4-480 data recovery case

EMC CX4-480 data recovery case

As a leading brand in the storage industry, EMC's storage products are well known! In addition, EMC's own storage system and its own hardware are leading in the storage field. However, this still cannot guarantee the absolute security of user data, because users' Misoperation and hardware aging will lead to important data loss. After these failures, you can only find a professional data recovery company to save data. The author has recently dealt with a case where EMC CX4-480 causes storage unavailability due to disk faults, as shown below.

 

A customer in Shanghai described that they had an EMC cx4 storage server and the entire storage array was paralyzed due to a hard drive failure. The entire Lun is a RAID 5 consisting of 7 1 TB hard disks. Because the customer is in Shanghai and it is not convenient to mail the server, he had to call the customer to instruct the customer to shut down the storage server normally and take out the hard disk to mark it. Then pack all hard disks and send an email to Beijing for data recovery. After receiving the package from the customer, we found that the customer sent 10 1 TB hard disks. I was surprised at the time! Isn't it 7 disks? 3 more. After calling the customer, I learned that three of them are hard disks that have been dropped from storage. Okay! It is estimated that there was a hard disk disconnection in the previous storage, but the customer only added a new hard disk for rebuild, and did not unplug the offline hard disk, so there were three more disks. Because the customer said that some hard disks on the storage server were faulty, the storage server was unavailable. Therefore, it was preliminarily determined that the raid had a hard disk disconnection. Hand over all hard disks to hardware engineers to check for hardware faults on the hard disks. After the detection is completed, no physical faults are found, which may be caused by a logical bad track on the hard disk or other causes of RAID unavailability. Then, make a full image of all hard disks to ensure the security of the customer's existing data. It takes a long time to mirror all disks!

After completing the image, I began to analyze the raid structure. But when I opened the image disk with winhex, I was shocked! Because the EMC hard drive adds an 8-byte verification per 512 bytes, that is, it is changed to 520 bytes per sector. In this way, although the raid structure can be analyzed, restructuring raid is now difficult! To improve work efficiency, I decided to write a small program to remove the 8-byte verification! In this way, the subsequent work is much easier. In this case, the code ......

 

After a long coding and debugging process, I finally got it okay. Start the conversion of a disk and a disk! Oh, it's a very time-consuming project. Wait!

 

After all the disks are converted, the raid structure is analyzed. Because three old disks are added, you need to find these three old disks first. This is easy to do. You can compare each disk. The two disks have the same part in front of them, and one of the two disks is old, and the old data volume should be less than new ones, the old disk can be excluded. There will be three pairs of such disks, so you can exclude all old disks. Next, let's look at the raid structure. The NTFS file system used by the customer makes it easy to find the raid structure with MFT. After knowing the raid structure, we find that this is not a normal RAID 5, but a dual loop. Raid cannot be reorganized using winhex. Finally, I found that UFS can reorganize raid. Use it to reorganize raid to see what the situation is! After the raid is reorganized, the data is not up-to-date. I think it may be that RAID 5 first dropped a hard disk, but the Administrator did not find it in time and did not add a new hard disk for rebuild in time. After running for a period of time, another hard disk is offline, causing the entire raid to be unavailable. Therefore, you still need to find an old disk to generate the latest data. Find it! But how can I find it? You can only try to kill one hard disk in sequence and then reorganize the raid. Check whether the latest data is available. Until the latest data is available, you can export the data and verify the data.

The entire restoration process, including image creation, sector conversion, and final data copy, took 5 days. The data recovery rate exceeds 99%. Although the entire process is long, the user is very happy with the final result, because it brings unnecessary losses to them.

 

Deng Qi (North Asia server data recovery Engineer)

Email: [email protected]

Contact info: 010-4006505808-801

 

This article is from "Deng Qi's blog" blog, please be sure to keep this source http://dengqi.blog.51cto.com/5685776/1535178