How to Recover Data from RAID 5, 1, 0 on Linux (mdadm)

In this article, you will find a detailed tutorial on data recovery from RAID 0, 1 or 5. The array we have been testing was built on Linux, and the methods described here will help you recover your files even if one or several disks break down.

How to Recover Data from RAID 5, 1, 0 on Linux (mdadm)

A Linux -based hardware RAID is hardly a good example of a reliable storage system – if one of the disks within the array gets disconnected, the whole RAID can’t be mounted, and all the information becomes inaccessible in a second. In this case, you will need a special utility to rebuild the array with the remaining (healthy) drives. It will find and display the data which is still there, and restore this information.

We will perform all the tests with Hetman RAID Recovery. Its main purpose is to search and restore information from inoperable drives which used to be a part of the disk array. The program will identify automatically which controller, motherboard or software tool were used to build the array, and will rebuild the RAID with the remaining disks which are still in good condition. The final step is to find all the data you need and save it to healthy drives.

Recover data from damaged RAID arrays inaccessible from a computer.

At the moment, there is no version of Hetman RAID Recovery for Linux, but running the utility on this specific operating system is still possible.

Go to view

To recover information from a damaged Linux-based RAID, connect the hard disks to a Windows computer. If you don’t have access to such a computer, you can install a Windows virtual machine or install this operating system along with Linux.

A Windows 10 virtual machine on a Linux PC

How to recover data from a RAID 1 system

First of all, let’s explore the recovery procedure for a RAID 1 device built on Linux and consisting of two hard disks of the same model.

This RAID type can use an even number of drives (at least two) which are used for ”mirroring” all the data.

A RAID 1 pattern

This disk array type is one of the most popular. It is characterized by high resilience: if one of the drives fails, you can replace it with the ”mirrored” copy, and then add another (new) drive, and the entire storage system will work again as if nothing happened. However, when only one HDD broke down, we couldn’t mount it properly in Linux. It is still available in the disk utility, but there is no button to mount it, and the automount feature can’t be enabled too.

The corrupted RAID-1 array

Hetman RAID Recovery managed to identify all properties at once, built and displayed the disk array automatically.

The program has identified all the properties and rebuilt the array automatically

To start the scan in the Drive Manager, right-click on the device icon and open it.

Starting the scan in the Drive Manager

Run the Fast scan first.

Choosing Fast scan

When the scan is over, the program will display the results in the right side of the window. It finds all data which is still on the disk without effort, and the contents can be previewed.

Select the files you want to restore and click Recovery.

Select the files you want to restore and click “Recovery”

Choose where to save them, then click ”Next” and hit ”Recovery” again.

File saving wizard

Wait until the system recovery process is complete and click ”Finish”.

Check the result

When the process is over, you will find the recovered files in the folder you have chosen.

A hardware Linux-based RAID 1 is designed in such a way that it writes service information on this array type to all of its disks (this information includes the number of disks, their serial numbers, and where each disk begins). That is why if one of the disks is missing, the program reads this data from other disks and adds the data on the missing disk when rebuilding a damaged RAID.

In some cases, this information can be damaged, and while building the array the utility can’t understand where the data on a certain disk is located, and what kind of offset is used for a specific disk. If that’s the case, the utility won’t find any data after the scan. In order to find the information which is still on the disk, you’ll have to use a special tool known as RAID Constructor.

The constructor for manual rebuilding

In addition to all the properties, you have to specify the offset by which you can locate the beginning of the disk.

Specify the properties and the offset to locate the beginning of the disk

Every file system has specific signatures which help us to identify its beginning. When you specify this offset you’ll be able to rebuild the damaged RAID and extract data from there.

To find the offset, use the HEX-editor: right-click on the disk and open HEX, or press the key shortcut Ctrl+H.

Use the HEX editor to find the offset

In Linux, you can find the beginning of the disk by the field with the name like ”/media/lin/”, – where lin stands for the user’s account name.

The phrase to search the offset - <b>”/media/lin/”</b>

As we know, information about the beginning of the disk in this file system is written to the second sector from the beginning, so we need to go two sectors up. After that, use a calculator to convert the HEX value into the decimal system.

Use a calculator to convert the HEX value into the decimal system

In the calculator, open the programmer mode, select HEX and enter the value (8200000). Immediately, you get the value in the decimal system (136 314 880).

The programmer calculator in Windows

Now that we know the offset, specify it in the Constructor.

Specify the offset in the Constructor

Now you should add the device, scan it and recover the found information.

The scan window

Recovering files from RAID 5

In the next example, we’ll explore the recovery procedure for RAID 5 arrays.

RAID 5 in Linux
Go to view
💽 How to Setup Software RAID with MDADM Comand on Linux Ubuntu in 2021 💾

💽 How to Setup Software RAID with MDADM Comand on Linux Ubuntu in 2021 💾

RAID-5 is a hard disk array with redundancy and striping, but without a separate parity drive.

A RAID-5 pattern

It is designed to remain operable even if one of the disks fails. However, in practice it becomes impossible to mount RAID in Linux, when one disk breaks down. Therefore, you can’t copy any data from there. In order to restore the information, you need to connect a new disk or use additional software.

Canceling initialization in Linux

RAID 5 consists of 5 HDDs one of which is damaged. Connect the remaining hard disks to a Windows computer, or add them to a virtual machine. When the program starts, Hetman RAID Recovery identifies the array type and properties without effort.

The main window of Hetman RAID Recovery

One HDD is empty. (Right-click on the array – Properties – the RAID tab)

The Properties window

Right-click on it, then select Open.

Open the necessary device

Analyze the array – select Fast scan.

Your first step in the wizard – Fast scan

The program has found the remaining files easily. Select the ones you need and click Recovery.

Scan results

Choose where to save them, then click Recovery again.

The recovery wizard

In the end, you’ll find all the information in the folder you have specified for saving.

The program will be able to identify the RAID type, all the properties and the file system even if several disks break down at the same time.

Identifying the device type automatically

Two disks are empty (Right-click – Properties – jump to the RAID tab).

The device properties window

Scan the device: right-click on it and select Open.

The drive manager window

For starters, we only run Fast scan.

The wizard window – Fast scan

As a result, the Fast scan couldn’t find any healthy data – all the data it has identified is damaged. After that, we decided to run Full analysis.

Select Full analysis

After full analysis, the utility was able to find the necessary information which remained intact, but some data is damaged.

The scan result

When two or more hard disks break down, this array type becomes completely inoperable and restoring information becomes a challenging task.

That is why such result can be considered quite good as we managed to recover a part of the remaining data. Select and recover it.

The scan result – Save the necessary files

How to recover data from RAID 0

For the last test, we have built a RAID 0 consisting of five hard disks.

If one disk in this array breaks down, the whole storage system becomes inoperable and all the information is actually lost. We can’t mount it in Linuxeither – the disks won’t open.

Linux disk utility – a RAID-0 device

Let’s see if we can extract at least a bit of the information with the help of Hetman RAID Recovery.

RAID-0 is a striped hard disk array with improved performance but without any fault tolerance in terms of the equipment involved. After one of the disks fails or breaks down, the entire device becomes inoperable.

As a matter of fact, RAID-0 is not a RAID array, technically, as it doesn’t provide any data redundancy. The core advantage of this system is the suggested performance boost.

RAID-0 pattern

The program has identified the type and properties of the damaged device.

The utility has identified the type and properties of the device

In the properties, we can see that one disk is empty. (Right-click on the array – Properties – the RAID tab).

The array properties window

In this case the fast scan hasn’t found anything, so we had to use an in-depth analysis.

The wizard window – run Full analysis

After the deep scan, the utility can find the data, but some files are damaged.

Results on display

Hetman RAID Recovery managed to detect a part of the remaining information. Select the files you want to restore and click Recovery,

Saving the necessary files

Specify where to save them, Next, and click Recovery again.

Specify full path for recovery

When the process is over, click Finish.

Finalize the process

All the files will be placed to the folder you have specified

Conclusion

Summing up, we can say that all the data still remaining on the disk can be recovered! In some cases, all you need is to specify the offset to help the utility find the beginning of the disk, and other important properties. In the end, the program will be able to determine where to look for the missing data, display the files, and give the opportunity to recover them. In some cases, data can only be recovered partially, but still it’s better than nothing!

Vladimir Artiukh

Author: , Technical Writer

Vladimir Artiukh is a technical writer for Hetman Software, as well as the voice and face of their English-speaking YouTube channel, Hetman Software: Data Recovery for Windows. He handles tutorials, how-tos, and detailed reviews on how the company’s tools work with all kinds of data storage devices.

Oleg Afonin

Editor: , Technical Writer

Oleg Afonin is an expert in mobile forensics, data recovery and computer systems. He often attends large data security conferences, and writes several blogs for such resources as xaker.ru, Elcomsoft and Habr. In addition to his online activities, Oleg’s articles are also published in professional magazines. Also, Oleg Afonin is the co-author of a well-known book, Mobile Forensics - Advanced Investigative Strategies.

Recommended For You

Hello! This is AI-based Hetman Software virtual assistant, and it will answer any of your questions right away.
Start Chat