Buffalo Terastation Raid Recovery (PPC) under Linux (i386)
Buffalo Terastation Raid Recovery (PPC) under Linux (i386)
First off, a caveat, the data I had on my Terastation was not life or death, if this had failed the world would not have ended, in fact this had sat for 6 months un-attempted, that’s how un-important it was. Getting the data back was a ‘nice to have’, so this is not a safe or guaranteed process. If in doubt investigate using dd to backup partitions before atttempting – Don’t blame me! – But in essence Buffalo Terastation raid recovery is possible using an i386 generation donor box.
So, history, I had a Buffalo Terastation (model TS-1.0GL/R5) which is a Power PC (PPC) based NAS, fitted with 4x 250GB Western Digital drives. It went Pop 🙁
In my case it was configured to use all the drives as one large pot, although that’s not really important, underlying I knew it was basically software raid (mdraid) and the XFS file system.
First attempt was using a Centos 6 (32bit) box I had to hand, guess what, no XFS support under 32 bit, try again. So I used the Openfiler 2.3 install CD I had (intention was to present the recovered data as a NAS again – but never quite got that far). Importantly Openfiler supports XFS and software raid, and is in essence a minimised Linux distro with a web front end.
Once booted up (hasten to add boot / OS drive was another drive, I’ve literally added the Terastation drives as additional SATA drives and done nothing with them), I ran fdisk on the first Terastation drive and saw;
fdisk /dev/sda: 250.0 GB, 250059350016 bytes 255 heads, 63 sectors/track, 30401 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sda1 1 48 385528+ 83 Linux /dev/sda2 49 65 136552+ 82 Linux swap / Solaris /dev/sda3 66 30378 243481141 83 Linux /dev/sda4 30378 30401 192779 83 Linux
Which was promising, in fact all 4 drives had identical partition structures. The first partition (/dev/sda1) is actually a raw xfs partition and is the / partition of the Terastation if you want to be nosy.
/dev/sda2 is swap, if I’m honest I have no idea what /dev/sda4 is (/boot maybe? I didn’t look), but /dev/sda3 (and /dev/sdb3, /dev/sdc3, and /dev/sds3 are the big ones with my data, and the software raid). There was lots of poking, prodding, reading, giving up as a lost cause at this point. I’m more than comfortable hacking about in Linux, it’s part of my day job, but Software Raid and mdadm are not my regular toys, and whilst a Mac fan my indoctrination didn’t come till the Intel days, so am not a Power PC expert. But, end result was discovering that in essence a software raid array, created on a PPC (Big Endian) device was not going to ‘appear’ under an i386 Linux (Little Endian) appliance, so give up … or google a little more.
At this point mdadm –examine was seeing nothing, there was no hint of a software raid, it might as well have been not there, but I knew it was. Turns out that you can change the byte order (Big Endian vs Little Endian – google it if you want), you need to do this on all components of the array, so basically;
mdadm -A /dev/md0 --update=byteorder /dev/sda3 mdadm -A /dev/md0 --update=byteorder /dev/sdb3 mdadm -A /dev/md0 --update=byteorder /dev/sdc3 mdadm -A /dev/md0 --update=byteorder /dev/sdd3
At this point we can ask mdadm to have a look, and you should get something similar to;
mdadm --examine /dev/sdb3 /dev/sdb3: Magic : a92b4efc Version : 00.90.02 UUID : 39b220be:f9b75e99:849a28e5:f10c758f Creation Time : Sat Aug 29 11:09:31 2009 Raid Level : linear Raid Devices : 4 Total Devices : 4 Preferred Minor : 1 Update Time : Sun Mar 6 17:05:45 2011 State : active Active Devices : 4 Working Devices : 4 Failed Devices : 0 Spare Devices : 0 Checksum : f8cc653a - correct Events : 0.8 Rounding : 64K Number Major Minor RaidDevice State this 3 8 51 3 active sync /dev/sdd3 0 0 8 3 0 active sync /dev/sda3 1 1 8 19 1 active sync /dev/sdb3 2 2 8 35 2 active sync /dev/sdc3 3 3 8 51 3 active sync /dev/sdd3
Bingo, we’re now acknowledging the raid array components, so stich back together with;
mdadm --assemble /dev/md0 /dev/sda3 /dev/sdb3 /dev/sdc3 /dev/sdd3 mdadm: /dev/md0 has been started with 4 drives.
Then give it somewhere to mount (but read only for now, to be safe);
mkdir /mount/md0 mount -o ro -t xfs /dev/md0 /mount/md0 mount: /dev/md0: can't read superblock
Cock 🙁 At this point you may be laughing and busy copying off your data, but not for me. Am not an XFS filesystem expert, but some more googling suggested some options, and lots of warnings that this may further corrupt your data remember, I wasn’t too concerned if it ended badly, so you’ve been warned, at least twice!
xfs_repair /dev/md0 Phase 1 - find and verify superblock... Phase 2 - using internal log - zero log... ERROR: The filesystem has valuable metadata changes in a log which needs to be replayed. Mount the filesystem to replay the log, and unmount it before re-running xfs_repair. If you are unable to mount the filesystem, then use the -L option to destroy the log and attempt a repair. Note that destroying the log may cause corruption -- please attempt a mount of the filesystem before doing this.
You have now been warned three times! Pressing on …
xfs_repair -L /dev/md0
… followed by similar output to above, confirming that the log had been zapped and recreated, but nothing else fatal, then to be sure;
xfs_check /dev/md0
Again nothing, so, try again;
mount -o ro -t xfs /dev/md0 /mount/md0
Bingo!
Openfiler saw the software raid array we’ve just re-created, but I’m assuming that because it relies mostly on LVM volume groups on top of physical disks / arrays it couldn’t do anything for me with an array of existing data, so I just fired up an SFTP client and copied everything off.
Hope this helps, please heed my warnings if your data is critical, but then if it were critical you’d have a backup, right?
Andy Flisher is a Software Developer based in the North East of England specialising in cross platform development. Mobile Development experience includes Windows Phone, Android, and iPhone Apps. Desktop Software Development includes bespoke Windows, Linux, and Mac Applications. Web Development Skills include PHP, Perl, Python, ASP (Classic and .NET) – Andy Flisher on Google+