Data recovery ---- restructuring resolve raid5

Restructuring Raid5

Step: Analyzing RAID5 stripe size

1. Winhex opened simultaneously using each physical member 6 in mirrored disks $ MFT file record (hexadecimal search "46494c45"), and is guaranteed to find the same file is recorded in each physical disk sectors (each mirror in the search again and found that the number of sectors is inconsistent first pass of the file where the search of the records, and to find the file record number in the same sector, it is necessary to find the maximum number of sectors in search of the first pass of the file where the record ( 4112), and then let the other five mirrors are 4122 Skip sector, find the file record);
2. This six members disk file number 4112 in the sector numbers are recorded 256,0,64,192,128,256, the difference between the file record number 64, indicating that the stripe size is RAID5 file records 64 the size of each file record into two sectors so that a sector size of 128 bands.
3. The first step in the analysis of the stripe size of 128 sectors, sector basis in 4112, a jump 128 back sectors, to record the image file record number 1-6, and then further jump 128 sectors is recorded after the image file record number of 1-6, a total of 4-5 times the recording, the recording is completed in order of size adjustment arrangement

Step: Preliminary determination sequence and the check plate members direction of the disc

 

Number of sectors \ image sequence / record number	2	3	5	4	1	6
4112	0	64	128	192	256	256  P
4240	384	448	512	576	320  P	320
4368	768	832	896	896  P	640	704
4496	1152	1216	960  P	960	1024	1088
4624	1536	1536 P	1280	1344	1408	1472
4752	1600  P	1600	1664	1728	1792	1856

 

2. The file record number is in ascending order from the block immediately check block, that is the first data block in each stripe group member is first written next member of the disc tray where the check block , remaining data blocks are sequentially written, it can be determined to the left of this synchronization RAID5 configuration.

The final determination sequence start sector and the disc plate members Third step:

1. In each member of the disc search searches MBR i.e. hexadecimal "55AA" 3616 results in four sector numbers found MBR, jump to the other sectors of the sector 3616, as a DBR No. 1, No. 2 , No. 3, No. 6 No. 0,5 are similar disk MBR. inferred

 RAID-5 is the start position (start sector) the sector No. 3616

1. I.e., the final sequence plate member disks 4 Number of number à6 à1 number à2 number à3 number à5

Step four: Recombinant RAID

The RAID configuration parameter prior to determination of the start position of a sector number 3616, the stripe size is 128 sectors, left synchronization structure. Specialist-ReconstructRAIDSystem using the function set corresponding to the parameter, as in FIG.

 

Step five: to restore the target file to calculate MD5 values

RAID restructuring is completed, you can see a 1.5G partition size, double-click to open the partition, to find RAID-3-1 / 1.txt file, copied to the specified directory, open the restored file 1.txt

To the specified directory, open the restored file 1.txt