HP MediaVault data recovery
|
HP Media Vault is a popular RAID system, with one or two disk drives. The major problem is at times the controller fails, and data can not be accessed by a normal PC.
Versions of HP MediaVault
There are two generations Media Vault. CnW will process generation 1 which is Reiser based. This has model numbers such a MV2010, MV2020. Generation 2 is based on LMV disk structure, with model numbers such as MV2120, MV5140, MV5150. This is not currently supported by CnW software.
Structure of MV Generation 1
The structure of the MediaVault is a Linux processor with data stored under ReiserFS. The configuration can be a single partition, as a RAID-1 or a series of disks, JBODs, with multiple data areas. A simple tutorial on reading the disks is in tutorials section of this manual.
For initial evaluation, the wizard function for 'Corrupted and drive and deleted files' does basic analysis of HP Mediavault disks. It will indicate if the drive looks as if it is one of a pair. Failing that, if recovery is attempted on a single drive, it is likely that an error message that says the Root directory can not be found, may be displayed.
Reiser File System
Reiser FS is a rather different file system to most common file systems. What we are used to in NTFS, FAT and other Unix systems is that a file starts at the beginning of a cluster and fills up clusters. The final cluster though may have between 1 and the actual cluster size of data. Thus there is normally wasted space on the disk. With small files, and a large cluster size (eg 16K) every file will always occupy 16K. NTFS manages slightly better in that a short file, maybe 500 bytes can be stored within an MFT entry, but it still means a file always occupies 1K of data space (the size of the MFT record).
The Reiser approach, although Unix related with iNodes etc is to fill every block(cluster) and normally only 8 bytes may be wasted. The design is such that the file system is very fast. Reiser 3 was the last version of the file system, and Version 4 is currently on hold as Mr Reiser is spending some time in secure accommodation.
Two issues that the Reiser make recovery difficult are data carving and deleted files, and this is described below.
Reiser and Data carving
Data carving works by testing the start of a sector (or cluster) for a recognisable file signature. it then, typically assumes that data will follow sequentially. For Reiser, often the start of a file may be the middle of a cluster, and so to detect it means examining the contents of each cluster. Although possible, this has not been implemented within CnW (yet).
Reiser and deleted files
When a file is deleted in NTFS, and FAT, the directory entry is marked as deleted. If no data has been written to the disk, then the file can normally be found, and often recovered (subject to fragmentation). With Reiser, the iNode associated with main file/directory set to null values, and so the type of file or directory is lost. CnW software though has a recovery routine that will determine the original values of an iNode based on certain remaining parameters. This is not an exact science, and so not all files will be found. However, it scan the disk drive and find many files, and where possible generate correct file names, and often the correct path. Because the basic directory structure is missing, one small problem is that files can be recovered multiple times. It can therefore look as if for instance 100GB of data can be recovered from a 40GB disk. This may be annoying, but data recovery is possible.