intel

Buffalo Terastation Raid Recovery (PPC) under Linux (i386)

Buffalo Terastation Raid Recovery (PPC) under Linux (i386)

First off, a caveat, the data I had on my Terastation was not life or death, if this had failed the world would not have ended, in fact this had sat for 6 months un-attempted, that’s how un-important it was. Getting the data back was a ‘nice to have’, so this is not a safe or guaranteed process. If in doubt investigate using dd to backup partitions before atttempting – Don’t blame me! – But in essence Buffalo Terastation raid recovery is possible using an i386 generation donor box.

So, history, I had a Buffalo Terastation (model TS-1.0GL/R5) which is a Power PC (PPC) based NAS, fitted with 4x 250GB Western Digital drives. It went Pop 🙁

In my case it was configured to use all the drives as one large pot, although that’s not really important, underlying I knew it was basically software raid (mdraid) and the XFS file system.

First attempt was using a Centos 6 (32bit) box I had to hand, guess what, no XFS support under 32 bit, try again. So I used the Openfiler 2.3 install CD I had (intention was to present the recovered data as a NAS again – but never quite got that far). Importantly Openfiler supports XFS and software raid, and is in essence a minimised Linux distro with a web front end.

Once booted up (hasten to add boot / OS drive was another drive, I’ve literally added the Terastation drives as additional SATA drives and done nothing with them), I ran fdisk on the first Terastation drive and saw;

fdisk /dev/sda: 250.0 GB, 250059350016 bytes
 255 heads, 63 sectors/track, 30401 cylinders
 Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
 /dev/sda1 1 48 385528+ 83 Linux
 /dev/sda2 49 65 136552+ 82 Linux swap / Solaris
 /dev/sda3 66 30378 243481141 83 Linux
 /dev/sda4 30378 30401 192779 83 Linux

Which was promising, in fact all 4 drives had identical partition structures. The first partition (/dev/sda1) is actually a raw xfs partition and is the / partition of the Terastation if you want to be nosy.

/dev/sda2 is swap, if I’m honest I have no idea what /dev/sda4 is (/boot maybe? I didn’t look), but /dev/sda3 (and /dev/sdb3, /dev/sdc3, and /dev/sds3 are the big ones with my data, and the software raid). There was lots of poking, prodding, reading, giving up as a lost cause at this point. I’m more than comfortable hacking about in Linux, it’s part of my day job, but Software Raid and mdadm are not my regular toys, and whilst a Mac fan my indoctrination didn’t come till the Intel days, so am not a Power PC expert. But, end result was discovering that in essence a software raid array, created on a PPC (Big Endian) device was not going to ‘appear’ under an i386 Linux (Little Endian) appliance, so give up … or google a little more.

At this point mdadm –examine was seeing nothing, there was no hint of a software raid, it might as well have been not there, but I knew it was. Turns out that you can change the byte order (Big Endian vs Little Endian – google it if you want), you need to do this on all components of the array, so basically;

 mdadm -A /dev/md0 --update=byteorder /dev/sda3
 mdadm -A /dev/md0 --update=byteorder /dev/sdb3
 mdadm -A /dev/md0 --update=byteorder /dev/sdc3
 mdadm -A /dev/md0 --update=byteorder /dev/sdd3

At this point we can ask mdadm to have a look, and you should get something similar to;

mdadm --examine /dev/sdb3
 /dev/sdb3:
 Magic : a92b4efc
 Version : 00.90.02
 UUID : 39b220be:f9b75e99:849a28e5:f10c758f
 Creation Time : Sat Aug 29 11:09:31 2009
 Raid Level : linear
 Raid Devices : 4
 Total Devices : 4
 Preferred Minor : 1
Update Time : Sun Mar 6 17:05:45 2011
 State : active
 Active Devices : 4
 Working Devices : 4
 Failed Devices : 0
 Spare Devices : 0
 Checksum : f8cc653a - correct
 Events : 0.8
Rounding : 64K
Number Major Minor RaidDevice State
 this 3 8 51 3 active sync /dev/sdd3
 0 0 8 3 0 active sync /dev/sda3
 1 1 8 19 1 active sync /dev/sdb3
 2 2 8 35 2 active sync /dev/sdc3
 3 3 8 51 3 active sync /dev/sdd3

Bingo, we’re now acknowledging the raid array components, so stich back together with;

mdadm --assemble /dev/md0 /dev/sda3 /dev/sdb3 /dev/sdc3 /dev/sdd3
 mdadm: /dev/md0 has been started with 4 drives.

Then give it somewhere to mount (but read only for now, to be safe);

mkdir /mount/md0
 mount -o ro -t xfs /dev/md0 /mount/md0
 mount: /dev/md0: can't read superblock

Cock 🙁 At this point you may be laughing and busy copying off your data, but not for me. Am not an XFS filesystem expert, but some more googling suggested some options, and lots of warnings that this may further corrupt your data remember, I wasn’t too concerned if it ended badly, so you’ve been warned, at least twice!

xfs_repair /dev/md0
 Phase 1 - find and verify superblock...
 Phase 2 - using internal log
 - zero log...
 ERROR: The filesystem has valuable metadata changes in a log which needs to
 be replayed. Mount the filesystem to replay the log, and unmount it before
 re-running xfs_repair. If you are unable to mount the filesystem, then use
 the -L option to destroy the log and attempt a repair.
 Note that destroying the log may cause corruption -- please attempt a mount
 of the filesystem before doing this.

You have now been warned three times! Pressing on …

xfs_repair -L /dev/md0

… followed by similar output to above, confirming that the log had been zapped and recreated, but nothing else fatal, then to be sure;

xfs_check /dev/md0

Again nothing, so, try again;

mount -o ro -t xfs /dev/md0 /mount/md0

Bingo!

Openfiler saw the software raid array we’ve just re-created, but I’m assuming that because it relies mostly on LVM volume groups on top of physical disks / arrays it couldn’t do anything for me with an array of existing data, so I just fired up an SFTP client and copied everything off.

Hope this helps, please heed my warnings if your data is critical, but then if it were critical you’d have a backup, right?

Andy Flisher is a Software Developer based in the North East of England specialising in cross platform development. Mobile Development experience includes Windows Phone, Android, and iPhone Apps. Desktop Software Development includes bespoke Windows, Linux, and Mac Applications. Web Development Skills include PHP, Perl, Python, ASP (Classic and .NET) – Andy Flisher on Google+