HOWTO: Recover files from a RAID 1 (mirrored) drive when the ShareSpace has failed

Lately I’ve been hearing that some of you have read on the Internet where you can take a RAID 1 (mirrored) drive out of a ShareSpace, put it in a computer, and use an Ubuntu Desktop CD to recover your data, but no tutorials exist.  Since you read it on the Internet it must be true, so I decided to write an illustrated tutorial to help out.  Big, huge thanks to WDJeremy for preparing a ShareSpace drive for me to work on.

First things first - RAID gives you redundancy, and is not a backup.  It is okay to use a RAID array as your backup location.  That means if the array fails you still have the original which is stored on an entirely different physical disk.  The second drive in a RAID 1 array does not count as that different disk.  When your RAID array fails, you should restore from your backup.  Sometimes the worst happens, and you need the data from the failed array.  That’s okay, but these instructions are not an excuse to not have backups.  I also can’t guarantee that these instructions will work, and a failure at this stage could damage the RAID array and cause data loss or make it more difficult for a data recovery company to recover data from the drives.

With that out of the way, if you hate data, let’s continue.

Your ShareSpace using a firmware that is Linux-based, and the drives are partitioned and formatted for use in a Linux RAID.  This means putting the drive into a Windows computer will not show any drive letters Windows only understands FAT- and NTFS-formatted drives.  Disk Management will show that the drive has four partitions, but Windows will show the file system as “RAW”.  We’re going to use an operating system called Ubuntu to access the data on a RAID 1 drive.  These instructions are written for Ubuntu 10.04 LTS and higher.

The first thing you’ll need is an Ubuntu Desktop CD.  You can download it for free, and the Ubuntu website gives instructions and software for burning to a CD or creating a bootable USB drive. These CDs can be used to install Ubuntu or to try Ubuntu directly from the CD and that makes them super useful for data recovery, system testing, and so on.  The download and instructions are available here: http://www.ubuntu.com/desktop/get-ubuntu/download

Once you have an Ubuntu CD, shut down your ShareSpace and computer.  Remove one drive from your ShareSpace and connect it to your computer using SATA cables.  Then, turn on your computer and boot from the Ubuntu CD.  Check your BIOS settings to make sure your computer is configured to boot from CD.

Once Ubuntu has loaded, click on the button that says “Try Ubuntu”.  After a moment, you will see the Ubuntu desktop.  Because the ShareSpace drive is formatted for use in a RAID array, Ubuntu will ignore it and we will have to mount it manually.  This is very easy to do the second time, but I’m here to guide you through it the first time.  The first thing to know is that Ubuntu doesn’t use drive letters.  Windows provides a drive letter to access file systems on a disk, and Ubuntu lets you “mount” them to a directory.  So the first thing we need to do is find the name of the data partition on the ShareSpace drive.

Go to the System menu, click on Administration, then click on Disk Utility.  From there, you can find your ShareSpace drive on the left, and when you click on it, the device name will be shown in the title bar and on the right side.  In this case, the drive is called /dev/sdb but it might be different on your computer.  You must get the correct name of the device.  We’re going to add a 4 on the end to refer to the data partition, so we’re going to work on /dev/sdb4 in this tutorial.

Finding the device name was the hard part.  Now comes the scary part.  Ubuntu didn’t mount the drive automatically because the drive was part of a RAID array.  So we need to enter a command that tells Ubuntu what drive to mount, how to mount it, and where to mount it.  To enter this command we’ll need a command prompt, so go to the Applications menu, then click on Accessories, and then click on Terminal.  You’ll get a command prompt that looks like this:

ubuntu@ubuntu:~$

That’s where you’ll type in the following command.  If your drive name earlier was /dev/sdc , you’ll substitute /dev/sdc4 instead of /dev/sdb4.  Once you’ve typed it in, press Enter.

sudo mount -t ext3 -o ro /dev/sdb4 /mnt

This is what it looked like when I did it.  My prompt looks slightly different because Ubuntu is installed on my computer, but the important thing you’ll notice is that the computer pauses for a couple of seconds and then you get another command prompt.  No news is good news!   Ubuntu will display an error if anything goes wrong, but everything worked and it’s ready for the next command.  You can type exit and press Enter or click on the Close button in the title bar to close the Terminal Window.

Now that everything’s mounted, it’s time to take a look at your data.  The contents of the drive are located in /mnt , and to get there we’ll click on the Places menu, then click on Computer.

Once that comes up, you’ll double-click on the Filesystem icon.

You’ll see a lot of different folders, but the one you want is called mnt.  Go ahead and double-click on that one.  From there you’ll see your Shares listed along with some other miscellaneous folders.  Let’s double-click on the Public folder.

Here we can see the Shared Music, Shared Pictures, and Shared Video folders.  It looks like WDJeremy backed up his SmartWare install files.  This is the point where you can start backing things up.  Plug in an external drive and another window should come up listing the contents of the drive.  You can simply drag and drop your files to the external drive.

Maybe you have a My Book World or My Book Live that you would like to transfer your files to.  As long as your computer is plugged into your network with an Ethernet cable, you can do that too.  From any file management window, press Ctrl-L.  This will bring up an address bar.  You can type in a location in the same manner you would on a Mac.  For example, if you had a My Book Live that was named mybooklive , you would type in:

smb://mybooklive.local/Public/

 and press Enter.

After a few seconds, the contents of the drive will appear, and you can drag and drop files from your ShareSpace drive to the network drive.

3 Likes

Need some help.  I am trying to recover data using these set of instructions but am receiving the following error

"wrong fs type, bad option, bad superblock or /dev/sdb4,  missing codepage or helper program, or other error 

This means that the file system wasn’t detected at that location.  This either means that you were not using RAID 1, or that the file system is damaged beyond recognition.  If you were using RAID 1, you might still be able to use data recovery software or professional data recovery services to recover your data from the drive.  As long as we’re in an Ubuntu session, the following documentation from the Ubuntu community may still help, and the instructions should still be applicable to Ubuntu 10.04 LTS or Ubuntu 10.10.

http://help.ubuntu.com/community/DataRecovery

If you were using RAID 5, I hope to have a similar walkthrough soon, but the really short version is to use a Fedora live CD with at least three of the drives and choose “NASRAID” from the Places Menu.

http://fedoraproject.org/get-fedora

If you were using RAID 0, you can try the Fedora CD but if the RAID array was damaged then it is likely that your data are not recoverable.  Best of luck!

Dear Nathan,

I don’t know where to look for help as I read your written about WD Sharespace RAID

My WD drive suddenly “connection failed”, In the computer we can see the network icon WDTONGKI

but we can not login, we can not settings, etc, it is said CONNECTION FAILED

and perhaps your network name is bla bla bla …

We didn’t change anything,

we didn’t upgrade anything,

we tried restarting and changing the router with the same network settings, still did not wor

We could enter WD Sharespace IP address (in browser) and the menu is SYSTEM STARTED … 10% (sometimes 3%, 20% and holds)

It seems that the systems failed to start and freeze when started, don’t know if I put the drive in another unit,

will it be RESET the drive and erase all data or could help retrieve the data

I set it up RAID 0 as I need more space,

I don’t know whether it is stripping or not, I don’t understand that thing,

all I want is to get MY DATA BACK I saw you mentioned about Fedora Project,

I’m downloading it right now but you did not give any clue on how to use it, should I put all 2 drives connected or just 1 drive ?

What command should entered for Fedora Projec

Can you help us with this, I already dissapointed with Western Digital as I am a HUGE FANS of Western Digital,

I have WD Studio, I have 5 units of WD Studio, I thought by using the TOP of the LINE WD products,

it will be a peace of mind now it is all TROUBLE, BIG TROUBLE as I haven’t did any backup for 2011 project

Please help me, Nathan, TQ

Regards,

Anthony Christiaan

The biggest, most important thing I can say here is that you must always backup your important data.  Setting your 2-drive ShareSpace to RAID 0 will double the potential failure rate of the group of drives.

Specifically in your case, burn the Fedora Core 14 CD, then shut your computer down.  Attach both drives (your data are spread across both drives and without both working drives you cannot access or retrieve any data), then power on the computer and boot from the Fedora CD.  Give it some time to boot, and eventually you’ll see a GNOME session running with a blue desktop and panels on the top and bottom of the screen.

If everything works, you should be able to click on the Places menu on the top panel, then choose NASRAID in the list of places and filesystems.  If it mounts, a file manager window will come up and you can double-click on Public or your other shares.  At this point in time you will need to copy _ ALL _ of your data onto another hard drive.  That’s also a great time to copy it it to two hard drives so you have a backup.

Once that’s finished, use the Data Lifeguard Diagnostic tool to run extended tests on the two drives, then if they pass, write zeros to the disks (full erase, not quick erase).  Assuming no errors occured, you can put both drives back into your ShareSpace, at which point your ShareSpace will reinitialize everything and after several hours will be fully operational again.

If you do encounter any errors, simply create an RMA for the failed drives themselves.

Best of luck!

Hi Nathan,

Thanks for your kind help

I already mount Fedora, using 2 hard drive connected using USB docking

I can see the array, I cannot find NASRAID folder like you mentioned,

but I can click on array drive that size 214MB, I can see my folders there, but there is NOTHING INSIDE

My folder is lock into user login account based on WD Sharespace configuration

Are there any way to open the login or something or my files are already missing ???

Thanks for your kind help

Toni

Photobucket Photobucket Photobucket Photobucket Photobucket

I had the same problem with Sharespace under RAID1. Device would not connect to the network.

I took a slightly different approach than the OP. Took out one disk (I had 4 disks, running in 2 sets of RAID1).

Installed Ubuntu 10.10 on USB

installed one disk in USB enclosure

boot with Ubuntu

root@ubuntu:~# sudo -i

Install RAID tool:

root@ubuntu:~# apt-get install mdadm

Install disktype:

root@ubuntu:~# apt-get install disktype

Not sure how I found out that the partition was md5, but it gave me the volume type: LVM2

root@ubuntu:~# disktype /dev/md5

— /dev/md5
Block device, size 930.0 GiB (998549618688 bytes)
Linux LVM2 volume, version 001
  LABELONE label at sector 1
  PV UUID QV5NuF-xTBN-7V7L-C4Fu-5OgB-FWxB-jgAibf
  Volume size 930.0 GiB (998549422080 bytes)
  Meta-data version 1

Install utility to mount LVM2 volumes:

root@ubuntu:~# apt-get install lvm2
root@ubuntu:~# modprobe dm-mod
root@ubuntu:~# vgchange -a y
  1 logical volume(s) in volume group “vg0” now active
root@ubuntu:~#

Am certainly not versed in Linux, but after I pieced it together it seemed quite simple :smiley:

Hi Nathan,

I could really use that tutorial on raid 5 now:)  I accidently deleted some file off a raid 5  8tb sharespace.  I need to undelete those files quick.  So, if you have a method of doing it, please do share.  You can email me directly, or if anyone has a way of recovering these files, please email me.  [Edited]

Jason,

I don’t really know if it’s possible to undelete files from a RAID5 array.  It’s not going to be a simple process at all.  You’d need to use a Fedora Core 14 live CD, as mentioned above, and once you have the NASRAID volume mounted, you would need to run data recovery software to try to recover your files.  ext3fs doesn’t delete files the same way as FAT or NTFS and I’m not sure how easy it would be to recovery any files that were fragmented on disk, for example.

I would power down the ShareSpace as soon as possible and check into data recovery software.  You might even want to talk to a data recovery partner about this one…  It’s probably not going to be easy or cheap, though.  Let us know if you are successful!

I booted up with Fedora, but I can not find the NASRAID uitility in the Places menu.

Ok, I think these are my steps to take:

  1. Take out the disks from Sharespace NAS, connect to PC SATA controllers (4 disks in all).

  2. Load Fedora Live, run NASRAID (which I can not find), mount the array it found.

  3. Run recovery software on it, ie…Photorec, Foremost, …etc…

Does this sums it up?

So my hurdles are:  get Fedora to recognize and mount the RAID 5 disk array.

Get recovery software to work on RAID 5.  I heard good success on EXT4 filesystem, but can find anything on it working with RAID 5.

I hope you can add more comments and directions.

Thanks

Yes, that’s the general idea.  I’m a little surprised that Fedora doesn’t recognize your RAID 5 array at all.  Make sure you don’t have the drives hooked up to a RAID controller on your PC, just normal everyday SATA ports.  For as much as I use Ubuntu, I’ve done very little with RAID or logical volume management aside from adding dropped drives back into arrays.

The GNOME Disk Utility (formerly called Palimpset, but probably listed in the menus as Disk Utility) may shed a little extra light here.  Just be really careful not to change anything on the drives themselves until you can run data recovery software.