Introduction

RAID Reconstructor © 2003-2006 by Runtime Software LLC

1601 Fairview Drive, Suite H, Carson City, NV 89701, USA
Phone (USA): 1-775-884-3922, Fax: 1-818-475-1741
Phone (Germany): +49-30-280 8008
Email: info@runtime.org , Web: http://www.runtime.org

Runtime's RAID Reconstructor will help you to recover data from a broken

  • RAID Level 5 Array consisting of 3 to 14 drives
  • RAID Level 0 Array (Striping) consisting of 2 drives

Even if you do not know the RAID parameters, such as drive order, block size and direction of rotation, RAID Reconstructor will analyze your drives and determine the correct values. You will then be able to create a copy of the reconstructed RAID in an image file or on a physical drive. Once you created an image you can use it for further data recovery processing with Runtime's GetDataBack. If you create the image on another physical drive, you can process it with GetDataBack too or you might even be able to directly boot from it.

RAID Reconstructor is read-only. It will not try to "fix" your RAID. It will merely create a copy of your RAID at another location. It will collect sector by sector from each single drive involved and write these sectors in the correct order to the designated destination. This process is also called "de-striping".

Because one drive is redundant in RAID-5, it is sufficient to have one less than the original number of drives (N) in the array. RAID Reconstructor can recalculate the original data from the N-1 drives. For a RAID-0 (striped) array you will need both drives.

The RAID Reconstructor will recover both, hardware and software RAIDs.

IMPORTANT NOTE: DO NOT WRITE ANYTHING ONTO THE DRIVES YOU ARE RECONSTRUCTING. THIS INCLUDES THIS SOFTWARE, ANY OTHER TOOLS, FILES OR PROGRAMS.

Check out our installation hints.

There are three easy steps to follow:

Specify the RAID array's components

  • Select the RAID type you want recover. Supported are RAID-5 and RAID-0 (striping).

  • Enter the number of drives in the original RAID array. For RAID-5 this number includes the parity drive.

  • Then enter the drives, the array consisted of. You can enter either a physical drive or an image file for each component. Right-click the input field to choose from a list. If you are using physical drive names, these drives must be accessible as individual drives through the BIOS. You can use image files instead of physical drives if you created these images earlier using Runtime's GetDataBack or Runtime's DiskExplorer. NOTE: If there are bad sectors on a physical drive you should always create an image first.

  • The Start sector of the RAID on each individual drive is usually 0 for a hardware RAID. If you want to recover a software RAID you need to specify an appropriate value. For example, if you have a RAID made from Windows' Dynamic Disk" the first 63 sectors of each drive contain administrative information. The RAID area itself begins at sector 63 on each drive. In this case you would enter 63 as the "Start sector". The XOR Test can help you find this number.

  • If you do not know the RAID parameters, leave the values for Block Size and Parity Rotation unchanged. The analysis in the next step should find these numbers

Example: RAID-5 array consisting of 3 drives, hooked up to your computer as individual physical drives HD129:, HD130:, HD131:

Example: RAID-5 array consisting of 3 image files, previously created on your local drive K: as DRIVE1.IMG, DRIVE2.IMG, DRIVE3.IMG.

You can also mix physical drives and image files.

Click "Open drives" and make sure the correct capacities are shown on the right side. Also, the total capacity of the RAID should be shown on the bottom:

NOTE: For RAID-5 it is possible to enter one drive less than the original array size. If you need to do this you would still set the number of drives to 3 in the example above, but leave one drive entry empty.

Analyze the RAID components and determine the correct drive order, block size and direction of rotation.

If you know the correct parameters you can enter them in panel 1) and skip the analysis. Otherwise click "Analyze".

A window will pop up and ask for the combinations you want to probe. Please refer to your RAID controller's manual to see which block sizes are actually supported by the controller. The most common values are already selected by default. If necessary, you can enter more customized block sizes. A block size is always a power of 2 (16, 32, 64,...).

RAID-5 only: The Parity rotation won't be found in any manual. For hardware arrays you should have at least the "Forward" and the "Backward" rotation checked. Windows' "Dynamic Disks" use the "Backward (Dynamic Disk)" rotation, so make sure you have this checked if you have a Windows Dynamic Disk set.

The "Number of sectors to probe" determines how many sectors on your RAID are actually probed. The default of 100000 is usually sufficient, but if you entered a large customized block size you might need to increase this value to, for example, 500000 or 1000000.

Click "Next". Depending on the number of drives, the number of combinations to check and the number of sectors to probe the analysis can last a few seconds or several hours.

When done you will be presented a list of drive parameters with the most probable one on the top:

Usually you will choose the recommended first entry.

Interpretation of the data:

In the example above you can see a 3-line entry for each possible permutation of the following parameters:

  • Drive order, possible are (1-2-3), (1-3-2), (2-1-3), (2-3-1), (3-1-2) or (3-2-1), totaling 6 possible combinations.

  • Block size, possible (chosen before) are 16, 32, 64 or 128, totaling 4 possible combinations.

  • Direction of rotation of the parity block, possible are forward, backward and backward-dynamic, totaling 3 possible combinations (RAID-5 only).

Since .the values above can be individually combined with each other the list contains 72 (6*4*3) possible combinations.

Each combination is checked if the resulting data "make sense". Each evaluation is given a value, called "entropy". The smaller this value is the more likely the entry represents the correct RAID parameters. The value of the best (first) entry should be at least 20% smaller than any other entry. If there is no such entry you will not get the recommendation above, but the warning "THIS RESULT IS NOT SIGNIFICANT!". If you get this message, most likely something is wrong.

Additional information is provided if the file system of the broken RAID was NTFS or FAT. Just below the entropy you can see an "OS:" followed by a number. The RAID Reconstructor tries to parse the boot sector found in sector 63. Depending on the integrity of the file system for the given combination it assigns a number between 0 and 4. Values between 1 and 4 are shown and they have the following meaning:

OS:1) Sector 63 has a boot signature (xAA55).

OS:2) Sector 63 is a valid NTFS, FAT32 or FAT16 boot sector.

OS:3) in NTFS: 1st MFT entry successfully loaded, in FAT: FAT1 found.

OS:4) in NTFS: first 16 MFT entries successfully loaded, in FAT: FAT2 found, and first FAT2 sector is equal to first FAT1 sector.

Note: The information above (OS:1...OS:4) are only provided if the RAID in question is a hardware RAID.

Choose the desired entry (most probably the first one) and click Finish. This copies the selected parameters into the main screen.

If you have a significantly small entropy (compared to others) and an OS:4 as in the example above, there is usually no doubt that this combination is the one you are looking for. If not you must look closer. If there are several combinations with almost the same values you might redo the analysis with a higher number of sample sectors (see above). You might also evaluate the "Start sector of the RAID" and run the XOR test tool. If you still do not get significant results you will have to determine the right ones with try and error: copy the RAID, check if you get your data with Runtime's GetDataBack, try the next combination.

Copy the RAID

Now you are ready to copy the RAID into another image file or another drive. Of course, the destination must be large enough to hold the whole RAID.

IMPORTANT NOTE: DO NOT USE ANY OF THE SOURCE DRIVES AS A "TARGET". IF YOU COPY TO A PHYSICAL DRIVE ALL DATA ON IT WILL BE DESTROYED. BE SURE YOU CHOOSE THE CORRECT DRIVE.

Specify the destination in the field "Target". Right-click to select a drive or file name from a list. Enter a physical drive name, such as "HD132:", or an image file name, such as "K:\raid.img".

If you entered an image file name, the recommended file name extension is ".img", which will create a regular image file. A ".imc" extension will create a compressed image file. If you check the "Multi file" box the created image file be split into several files of 650 MB each. This might be necessary for systems that do not support large file, such as Windows 95/98.

Other options are:

Verify by parity: While copying, the integrity of the RAID is checked by comparing the data blocks against the parity block for each stripe.

Append extra sectors: When checked, after copying to an image file extra sectors are appended to fill up a complete cylinder. This is possibly necessary to mimic an entire drive for later processing with GetDataBack.

Offset Sector: When copying to a physical drive, you can specify an offset sector where the transfer begins. For example, choosing a value of 63 will cause the first sector of the reconstructed image to be copied to sector 63, the second sector to sector 64, etc.

Click "Copy". The RAID now gets reconstructed. This can take a while.

If any errors are encountered messages are written into a file called "<program path>\log<n>.txt", where "<program path>" is the directory the RAID Reconstructor is located in and "<n>" is a number. From the main windows you can later check these messages by clicking Tools->View Log on the menu bar.

What's next?

If you copied the RAID to another drive you might be lucky and this drive can be read from your OS without further problems.

Otherwise, obtain a copy of GetDataBack at http://www.runtime.org/gdb.htm and feed it with the created drive/image. For more information see GetDataBack's documentation.

If you have any questions about this software, contact our support!

If you need information about licensing this software click here.

See also:

  • Example 1 - RAID-5 with 3 drives on a HP 454

  • Example 2 - RAID-5 with 3 drives on a HP 454, 1 drive defect

  • Example 3 - RAID-5 with 4 drives on a Dynamic Disk set

  • Example 4 - RAID-0 (Striping) on a HP 454

  • Example 5 - RAID-0 (Striping) on a Dynamic Disk set


Installation

Do not install the RAID Reconstructor to the drive(s) you want to recover! It is strongly recommended to proceed as follows:

Install the program to a computer, which doesn't have any problems. If you have a choice, choose the computer which has the most RAM and is the fastest. Attach the drives you want to rebuild the RAID from as additional drives to this machine. You will need a special controller card capable of handling several drives. Each drive must be individually accessible.

An alternative is the use of image files. You would have to add one drive at a time, make the image, remove the drive, add the next drive, make the image etc. until you have images for each RAID component. Of course, you will need sufficient space to store these image files.

After downloading the RAID Reconstructor run the setup.exe. The setup wizard will guide you through the installation process.

NT/XP users: You must have Administrator rights to run this program.

See also: System requirements


System Requirements

  • Pentium processor
  • 32-128 MB RAM
  • Windows 95/98/ME, Windows NT, 2000, XP
  • One problem-free hard disk to boot from
  • Disk controller card capable of handling all the drives in your RAID individually
  • Storage space for holding the reconstructed RAID


Create Image

Creating An Image File

Clicking Tools->Create single image file allows you to create an image from a single hard drive. This is recommended if there are bad sectors on the drive.

Select the drive you want to copy from and the file you want to copy to. If you check "Multi file", the image will be split in files of 650 MB.

Click Start to begin creating the image. Once the image is created you can use the image file ("driveimage.img" in the example above) in Runtime's data recovery products like a real drive.

See also: Drives, Image Files


XOR Test

The XOR test verifies the checksum over a drive set. For example, if you have a set of 3 drives it calculates

Drive1_Sector0 XOR Drive2_Sector0 XOR Drive3_Sector0
Drive1_Sector1 XOR Drive2_Sector1 XOR Drive3_Sector1
:
Drive1_SectorLast XOR Drive2_SectorLast XOR Drive3_SectorLast

The checksum must be 0 if the given drive set is a RAID-5.

Clicking Tools->XOR test brings up a window that allows you to perform some tests on a given set of drives.

Click on the Start button and after some seconds you will see a window similar to this:

Interpretation of the data

Each sector is represented by one pixel.

The "Visible area" field tells you the region on the drives you are currently looking at. The first pixel in the top left position represents the checksum of sector 0 over all three drives. The last pixel in the bottom right position represents the checksum of sector 96989 over all three drives. The percentage (0-1%) indicates the location of the visible area within the whole scope of the drives. If you wish to inspect another area you can scroll the window by clicking on the vertical scrollbar.

Each sector is colored in one of three possible ways:

: the checksum of XOR over all drives is not 0 for this sector. This sector does not meet the requirements of RAID-5.

: the checksum of XOR over all drives is 0 for this sector. This sector meets the requirements of RAID-5. In addition, the sectors involved are non-trivial (non-zero), therefore this is a very strong indication that this sector indeed belongs to a RAID-5.

: the checksum of XOR over all drives is 0 for this sector and therefore meets the requirements of RAID-5. However, the sectors involved are trivial, meaning they contain zeros only. The XOR checksums of zero-sectors are zeros. Therefore, sectors marked as ambiguous should be seen in context.

When moving the mouse over the graphic, the field "Current sector" indicates the corresponding sector number and its XOR value.

It is possible to zoom in the picture. Just click on [image]. To zoom out click on [image]. The "Pixel/Sector" value to the right of these icons tell you the current magnification.

The picture above proves that the drive set in question is indeed a RAID-5 array, probably beginning at sector 0. Let's inspect the beginning of the RAID in greater detail. Click on Zoom-in seven times until the pixel/sector ratio is 64:1.

You can see that there is just one sector failing the XOR test, sector 0 that usually contains the partition table. You might be tempted to set the "Start sector of the RAID" (in the main screen) to 1, but there are two reasons to set it to 0: First, it's a hardware RAID we are looking at and hardware RAIDs usually do not store administrative information on the drive but on the controller card. Second, 1 would be an unusual number. In software RAIDs you normally have multiples of 63 which is the number of sectors per track. Windows' "Dynamic Disk" RAIDs begin at sector 63. Other software RAIDs might have a whole partition containing administrative information and the RAID area beginning after that.

Partition tables & boot sectors

This window displays all sectors that have a boot signature (0xAA55) at offset 510. If the sector in question contains a valid partition table or boot sector its content is displayed.

In the example above you see:

A partition table found at sector 0 on image d:\raido\raido2.img. It contains an NTFS partition pointing to sector 63

A NTFS boot record at sector 31 on image d:\raido\raido1.img.

Obviously, the NTFS boot sector is the one described by the partition table. It is found on another drive at sector 31 instead of 63. This is a strong indication that these sectors are already part of a RAID-5, with a block size of 32 sectors or below.

See also:

  • Example 1 - RAID-5 with 3 drives on a HP 454

  • Example 2 - RAID-5 with 3 drives on a HP 454, 1 drive defect

  • Example 3 - RAID-5 with 4 drives on a Dynamic Disk set

  • Example 4 - RAID-0 (Striping) on a HP 454

  • Example 5 - RAID-0 (Striping) on a Dynamic Disk set


Registration

Registering the software will enable you to copy the RAID to a physical drive. It will also lift the 30 days restriction.

Register online on our website http://www.runtime.org and get the registration key immediately.

If you prefer not to order online give us a call at 1-775-884-3922 (USA) or +49-30-280 8008 (Germany).

Entering the License Key

When entering the license make sure you enter both, the name and the license key, exactly as spelled in the registration email Runtime sent to you. Name and key are related and only entering both will successfully register RAID Reconstructor. We recommend to copy and paste the information from the registration email.


Scripting

S cripting (experimental)

Scripting is a powerful extension of RAID Reconstructor's capabilities. Based on the PASCAL programming language, scripts allow you to access your drives and process them with all the elements available in a higher programming language.

In order to take full advantage of this feature, knowledge of PASCAL is required.

NOTE: Scripting is experimental and at this time no integral part of RAID Reconstructor. Use at your own discretion. No support is provided on script writing.

Load and Run a Script

To load a script into the editor, double-click an entry on the left side or click on File->Load. To run a loaded script press F9.

Example Scripts

Please inspect the sample scripts (*.scr) that come with RAID Reconstructor.

Script Name | Purpose
copy_drive_to_image.scr | Demonstrates how to copy a drive to an image file
drive_info.scr | Shortest demo
drive_info_partitiontable.scr | Display a drives partition table
iterate_through_drive.scr | Go through each sector
list_mfts.scr | Extract sector numbers of MFT locations into an external file
raid0_destripe.scr | Reconstruct a 2 drive RAID-0
raid0_3drives_destripe.scr | Reconstruct a 3 drive RAID-0

Reference - Special Functions

Function | Purpose | Example
function Drives(D: string): TDrive; Define a drive Drive := Drives('hd128');
Drive := Drives('c:\myimage.img');
Drive := Drives['D:');
function Drives(i: integer): TDrive; | Define a drive | Drive := Drives(128);
function Drive.InfoCapaciy: string; | Capacity of the drive as string | ShowMessage(Drive.InfoCapacity);
function Drive.TotalSectors: longint; | Capacity of the drive in sectors | ShowMessage(IntToStr(Drive.TotalSectors));
function Drive.ReadAsPointer(LBAStart, Count: integer; Buffer: pointer; var ErrCode: integer): boolean; Read from the drive into a buffer GetMem(Buffer, 512);
if Drive.Read(0, 1, Buffer, ErrCode) then
ShowMessage('Ok')
else
ShowMessage('Error ' + IntToStr(ErrCode));
function Drive.Read(LBAStart, Count, Error): string; Read from the drive into a string Sector := Read(0, 1, ErrCode);
WriteImage(Image, Sector);
procedure Drive.FirstSector; Set drive to the first sector Drive.FirstSector;
while not Drive.EndOfDrive do
begin
ShowStatus(IntToStr(Drive.CurrentSector));
WriteImage(Image, Drive.GetSector);
Drive.NextSector;
end;
procedure Drive.NextSector[(IncBy: integer)]; | Move to the next sector
function Drive.EndOfDrive: boolean; | Test if end of drive is reached
function Drive.GetSector: string; | Read one sector into a string
function Drive.CurrentSector: integer; | Determine the current sector
procedure Drive.LastSector; | Set drive to the last sector | Drive.LastSector;
procedure Drive.GotoSector(Sec: integer); | Move to a sector | Drive.GotoSector(1000);
function Drive.GetSectorAsPointer: pointer | Read one sector into a buffer | P := Drive.GetSectorAsPointer:
function CreateImage(FileName: string; Compressed: boolean): integer; Create a new image file for output Image := CreateImage('c:\newimage.img', false);
Drive.FirstSector;
while not Drive.EndOfDrive do
begin
WriteImage(Image, Drive.GetSector);
Drive.NextSector;
end;
CloseImage(Image);
function WriteImage(Image: integer; Sec: string): integer; | Write a string (sector) to the image file
procedure CloseImage(Image: integer); | Close image file
procedure GetMem(var P: pointer; MemSize: integer); Allocate a buffer GetMem(P, 1024);
//do something with P
FreeMem(P);
procedure FreeMem(P: pointer); | Free a buffer
procedure ShowStatus(Info: string); | Display a message in Scripter's window | ShowStatus('Current Sector' + IntToStr(Drive.CurrentSector));
procedure SetStatusRefreshRate(MS: integer); | Set the refresh rate of the status message in Millie seconds | SetStatusRefreshRate(10);

Reference - System Functions

Abs
AnsiCompareStr
AnsiCompareText
AnsiLowerCase
AnsiUpperCase
Append
ArcTan
Assigned
AssignFile
Beep
Chdir
Chr
CloseFile
CompareStr
CompareText
Copy
Cos
CreateOleObject
Date
DateTimeToStr
DateToStr
DayOfWeek
Dec
DecodeDate
DecodeTime
Delete
EncodeDate
EncodeTime
EOF 		Exp
FilePos
FileSize
FloatToStr
Format
FormatDateTime
FormatFloat
Frac
GetActiveOleObject
High
Inc
IncMonth
InputQuery
Insert
Int
IntToHex
IntToStr
IsLeapYear
IsValidIdent
Length
Ln
Low
LowerCase
Now
Odd
Ord
Pos
Raise
Random
         ShowMessage
Sin
Sqr
Sqrt
StrToDate
StrToDateTime
StrToFloat
StrToInt
StrToIntDef
StrToTime
Time
TimeToStr
Trim
TrimLeft
TrimRight
Trunc
UpperCase
VarArrayCreate
VarArrayHighBound
VarArrayLowBound
VarIsNull
VarToStr
Write
WriteLn
ReadLn
Reset
Rewrite
Round

Reference - Basic PASCAL Syntax

begin .. end
procedure and function declarations
if .. then .. else
for .. to .. do .. step
while .. do
repeat .. until
try .. except and try .. finally blocks
case statements
array constructors (x:=[ 1, 2, 3 ];)
^ , * , / , and , + , - , or , <> , >=, <= , = , > , < , div , mod , xor , shl , shr operators
access to object properties and methods (ObjectName.SubObject.Property)
comments: // or (* *) or {}
variable declarations: var a;


License Agreement

License Agreement and Disclaimer

The following are the conditions under which Runtime Software software is sold, supported and may be used. By using or registering Runtime Software software, you are agreeing to these.
This document may be augmented or superceded by conditions included with specific applications.

Neither the author(s) nor Runtime Software assume responsibility for any expense, damage or loss caused by your use of this software, however it occurs.
All the registered trademarks used herein are registered to whoever it is that owns them. This notification is given in lieu of any specific list of trademarks and their owners.

If you register software by Runtime Software, we will assume that you are doing so having tested the shareware version and ascertained that it's suitable for your hardware and requirements. We cannot provide refunds for shareware registration if you subsequently change your mind.

No portion of the documentation for this software or any of its attendant files may be reproduced in whole or in part in any medium or form of transmission exclusive of the archive file for the software without the express written permission of Runtime Software. You may not modify or patch the software's executable files in any way, including but not limited to decompiling, disassembling, or otherwise reverse engineering the program.

Registering this software buys you a named single-user license to use it in perpetuity, subject to the terms discussed herein. With a named single-user license you are the only user of the license, installed on one computer owned or controlled by you. If you want to have the software installed on more than one computer at the same time, you need to purchase additional licenses. If you want the software to be used by additional users, you need to purchase additional licenses. A single-user license does not permit you to make the registered software available over a network for multiple users to access, to distribute it in any form or to provide it in conjunction with any other product without the express written permission of Runtime Software. The license is not transferable to another party without written permission of Runtime Software. If you have any questions about the software license, feel free to get in touch with us.

If you have downloaded this software or had it given to you on disk to try out, you are allowed to use the limited version of the software for free, in order to use the full version you have to register the software immediately.

You may distribute the software (on CD-ROMs, Books, Catalogs, Internet etc.) as long as you follow each and every one of the following:

1. You distribute only exact, unmodified copies of the original unregistered shareware version of the software incl. the DISCLAIMER.
2. You do not monetarily charge or otherwise request any compensation for any copy, however made, without prior permission from Runtime Software.
3. You include the phrase "Copyright by Runtime Software" with any copy of the software.


Example 1 - RAID-5 with 3 drives on a HP 454

Configuration:

  • 3 drives with 64448 sectors (31 MB) each.

  • Originally configured as a RAID-5 with a total capacity of 128768 sectors (62.9 MB).

  • Hardware RAID-5 on a Highpoint RocketRAID 454 controller card.

  • The 3 drives have been copied to image files:

    C:\img\Raid img\r1.IMG
    C:\img\Raid img\r2.IMG
    C:\img\Raid img\r3.IMG

Instructions:

Start RAID Reconstructor.

Select RAID-5 as the RAID type.

Set #drives to 3.

Enter the names of the image files into the fields labeled Drive1, Drive2 and Drive3.

Leave the Start sector of the RAID at 0 because we have a hardware RAID that is most probably starting at sector 0.

Also, leave the Block size and the Parity rotation unchanged. These values will be determined by the analysis in panel 2).

Click Open drives.

Verify that all 3 drives show the size of 64448 sectors and that the total size shows

(Number_Of_Drives-1) * Size_Of_Smallest_Drive = (3-1) * 64448 = 128896 sectors

Click Analyze.

We want to leave the parameters and the number of sectors that we want to probe unchanged. Click Next.

The entry found is at least 60% smaller than any other entry. This is good. Click Finish.

The found parameters got transferred into the corresponding fields in the main screen:

  • Block size is 128

  • Rotation is backward

  • Drive order is r1.img - r2.img - r3.img

Now we are ready to copy the combined array to an image file. Specify a target file name and click Copy.

When this process completes you will have a file RAID.IMG with a size of 128896 sectors (63 MB).

Process this image file with GetDataBack in order to retrieve the data from it.

See also:

  • Example 1 - RAID-5 with 3 drives on a HP 454

  • Example 2 - RAID-5 with 3 drives on a HP 454, 1 drive defect

  • Example 3 - RAID-5 with 4 drives on a Dynamic Disk set

  • Example 4 - RAID-0 (Striping) on a HP 454

  • Example 5 - RAID-0 (Striping) on a Dynamic Disk set


Example 2 - RAID-5 with 3 drives on a HP 454, 1 drive defect

Configuration:

  • 3 drives with 64448 sectors (31 MB) each, 1 of these drives is non-functioning.

  • Originally configured as a RAID-5 with a total capacity of 128768 sectors (62.9 MB).

  • Hardware RAID-5 on a Highpoint RocketRAID 454 controller card.

  • The remaining 2 drives have been copied to image files:

    C:\img\Raid img\r1.IMG
    C:\img\Raid img\r2.IMG

Instructions:

Start RAID Reconstructor.

Select RAID-5 as the RAID type.

Set #drives to 3.

Enter the names of the image files into the fields labeled Drive1 and Drive2. Leave Drive3 empty.

Leave the Start sector of the RAID at 0 because we have a hardware RAID that is most probably starting at sector 0.

Also, leave the Block size and the Parity rotation unchanged. These values will be determined by the analysis in panel 2).

Click Open drives.

Verify that 2 drives show the size of 64448 sectors and that the total size shows

(Number_Of_Drives-1) * Size_Of_Smallest_Drive = (3-1) * 64448 = 128896 sectors

Click Analyze.

We want to leave the parameters and the number of sectors that we want to probe unchanged. Click Next.

The entry found is at least 60% smaller than any other entry. This is good. Click Finish.

The found parameters got transferred into the corresponding fields in the main screen:

  • Block size is 128

  • Rotation is backward

  • Drive order is r1.img - r2.img - (missing drive)

Now we are ready to copy the combined array to an image file. Specify a target file name and click Copy.

When this process completes you will have a file RAID.IMG with a size of 128896 sectors (63 MB).

Process this image file with GetDataBack in order to retrieve the data from it.

See also:

  • Example 1 - RAID-5 with 3 drives on a HP 454

  • Example 2 - RAID-5 with 3 drives on a HP 454, 1 drive defect

  • Example 3 - RAID-5 with 4 drives on a Dynamic Disk set

  • Example 4 - RAID-0 (Striping) on a HP 454

  • Example 5 - RAID-0 (Striping) on a Dynamic Disk set


Example 3 - RAID-5 with 4 drives on a Dynamic Disk set

Configuration:

  • 4 drives with 103001 sectors (50 MB) each.

  • Originally configured as a RAID-5 with a total capacity of 309003 sectors (151 MB).

  • Software RAID-5 on a Windows 2000 Server Dynamic Disk set.

  • The 4 drives have been copied to image files:

    C:\img\dynr5_four\r5_four_1.img
    C:\img\dynr5_four\r5_four_2.img
    C:\img\dynr5_four\r5_four_3.img
    C:\img\dynr5_four\r5_four_4.img

Instructions:

Start RAID Reconstructor.

Select RAID-5 as the RAID type.

Set #drives to 4.

Enter the names of the image files into the fields labeled Drive1, Drive2, Drive3 and Drive4.

Leave the Start sector of the RAID at 0 at this time. However, this is a software RAID and we will have to set this value later.

Also, leave the Block size and the Parity rotation unchanged. These values will be determined by the analysis in panel 2).

Click Open drives.

Verify that all 4 drives show the size of 103001 sectors and that the total size shows

(Number_Of_Drives-1) * Size_Of_Smallest_Drive = (4-1) * 103001 = 309003 sectors

As stated above, this is a software RAID and we will have to specify a Start sector of the RAID. However, before we do this let's look how the analysis looks like anyways.

Click Analyze.

We want to leave the parameters and the number of sectors that we want to probe unchanged. Click Next.

The entry found is not significant. It has almost the same entropy as the 2nd entry. Click Cancel.

Click Tools->XOR test, then click Start. Click Zoom-in until you a magnification of 49:1.

You can see that sector 63 is the first sector that definitely belongs to a RAID-5.

When looking at the found partition tables you see a "Secure File System" at sector 63. The "Secure File System" is Windows' container for storing RAIDs.

Therefore, let's go with the 63.

Type the 63 into the field Start sector of the RAID, click Open drives.

Please note that the new total size of the RAID is 3*63 sectors smaller than it was with the Start sector of the RAID set to 0.

Now let's do the analysis again. Click Analyze, then Next.

What we get now is much better. The entropy of 0.06 is significantly smaller than the entroy of the next entry, 0.11. Click Finish to move these values to the main screen.

The found parameters got transferred into the corresponding fields in the main screen:

  • Block size is 128

  • Rotation is backward (dyn. disk)

  • Drive order is r5_four_1.img - r5_four_2.img - r5_four_3.img - r5_four_4.img

Now we are ready to copy the combined array to an image file. Specify a target file name and click Copy.

When this process completes you will have a file RAID.IMG with a size of 308814 sectors (151 MB).

Process this image file with GetDataBack in order to retrieve the data from it.

See also:

  • Example 1 - RAID-5 with 3 drives on a HP 454

  • Example 2 - RAID-5 with 3 drives on a HP 454, 1 drive defect

  • Example 3 - RAID-5 with 4 drives on a Dynamic Disk set

  • Example 4 - RAID-0 (Striping) on a HP 454

  • Example 5 - RAID-0 (Striping) on a Dynamic Disk set


Example 4 - RAID-0 (Striping) on a HP 454

Configuration:

  • 2 drives with 50000 sectors (24 MB) each.

  • Originally configured as a RAID-0 (Striping) with a total capacity of 100000 sectors (48.8 MB).

  • Hardware RAID-0 (Striping) on a Highpoint RocketRAID 454 controller card.

  • The 2 drives have been copied to image files:

    C:\img\raid0\r0_1.IMG
    C:\img\raid0\r0_2.IMG

Instructions:

Start RAID Reconstructor.

Select RAID-0 (Striping) as the RAID type.

Enter the names of the image files into the fields labeled Drive1 and Drive2.

Leave the Start sector of the RAID at 0 because we have a hardware RAID that is most probably starting at sector 0.

Also, leave the Block size unchanged. This value will be determined by the analysis in panel 2).

Click Open drives.

Verify that the 2 drives show the size of 50000 sectors and that the total size shows

Number_Of_Drives * Size_Of_Smallest_Drive = 2 * 50000 = 100000 sectors

Click Analyze.

We want to leave the parameters and the number of sectors that we want to probe unchanged. Click Next.

The entry found is around 60% smaller than any other entry. This is good. Click Finish.

The found parameters got transferred into the corresponding fields in the main screen:

  • Block size is 128

  • Drive order is r0_1.img - r0_2.img

Now we are ready to copy the combined array to an image file. Specify a target file name and click Copy.

When this process completes you will have a file RAID.IMG with a size of 100000 sectors (48.8 MB).

Process this image file with GetDataBack in order to retrieve the data from it.

See also:

  • Example 1 - RAID-5 with 3 drives on a HP 454

  • Example 2 - RAID-5 with 3 drives on a HP 454, 1 drive defect

  • Example 3 - RAID-5 with 4 drives on a Dynamic Disk set

  • Example 4 - RAID-0 (Striping) on a HP 454

  • Example 5 - RAID-0 (Striping) on a Dynamic Disk set


Example 5 - RAID-0 (Striping) on a Dynamic Disk set

Configuration:

  • 2 drives with 50000 sectors (24 MB) each.

  • Originally configured as a RAID-0 (Striping) with a total capacity of 100000 sectors (48.8 MB).

  • Software RAID-0 (Striping) on a Windows 2000 Server Dynamic Disk set.

  • The 2 drives have been copied to image files:

    C:\img\dyn raid0\dynr1.IMG
    C:\img\dyn raid0\dynr2.IMG

Instructions:

Start RAID Reconstructor.

Select RAID-0 (Striping) as the RAID type.

Enter the names of the image files into the fields labeled Drive1 and Drive2.

Leave the Start sector of the RAID at 0 at this time. However, this is a software RAID and we will have to set this value later.

Also, leave the Block size unchanged. This value will be determined by the analysis in panel 2).

Click Open drives.

Verify that the 2 drives show the size of 50000 sectors and that the total size shows

Number_Of_Drives * Size_Of_Smallest_Drive = 2 * 50000 = 100000 sectors

Click Analyze.

We want to leave the parameters and the number of sectors that we want to probe unchanged. Click Next.

The entry found is not significant. It has almost the same entropy as the 2nd entry. Click Cancel.

Click Tools->XOR test, then click Start. The XOR test itself is of no value because we cannot build the checksum in a RAID-0 array. However, let's have a look at the found partition tables.

When looking at the found partition tables you see a "Secure File System" at sector 63. The "Secure File System" is Windows' container for storing RAIDs.

Therefore, let's go with the 63.

Type the 63 into the field Start sector of the RAID, click Open drives.

Please note that the new total size of the RAID is 2*63 sectors smaller than it was with the Start sector of the RAID set to 0.

Now let's do the analysis again. Click Analyze, then Next.

What we get now is much better. The entropy of 0.02 is significantly smaller (33 %) than the entroy of the next entry, 0.03. Click Finish to move these values to the main screen.

The found parameters got transferred into the corresponding fields in the main screen:

  • Block size is 128

  • Drive order is dynr1.img - dynr2.img

Now we are ready to copy the combined array to an image file. Specify a target file name and click Copy.

When this process completes you will have a file RAID.IMG with a size of 99874 sectors (48.8 MB).

Process this image file with GetDataBack in order to retrieve the data from it.

See also:

  • Example 1 - RAID-5 with 3 drives on a HP 454

  • Example 2 - RAID-5 with 3 drives on a HP 454, 1 drive defect

  • Example 3 - RAID-5 with 4 drives on a Dynamic Disk set

  • Example 4 - RAID-0 (Striping) on a HP 454

  • Example 5 - RAID-0 (Striping) on a Dynamic Disk set


Troubleshooting

These are the most common warnings or errors you might run into:

Access denied

COMCTRL32 outdated

Could not lock drive

DRV16 not found

Bad sector handling

License required

If you get a runtime error, please submit a screenshot to: support@runtime.org.


Access Denied

Error: Access Denied

This message is displayed if you are trying to

  • open a file that is already in exclusive use by another process or
  • open a file in read/write mode that is write-protected.

See also: Image files


Outdated COMCTRL32

Outdated COMCTRL32.DLL

Your Windows version is using an outdated version of 'COMCTL32.DLL'. This component is an extension of the Windows operating system and comes usually with the MS Internet Explorer.

You will most probably have problems with this program's visual controls (you won't see the buttons). But you should still be able run this software.

It is recommended to download a new version at http://www.microsoft.com/msdownload/ieplatform/ie/comctrlx86.asp or to install a recent version of MS Internet Explorer.


Drive Locking Failed

Warning: Could Not Lock Drive

Locking a drive is a low-level feature for preventing several processes from accessing a physical or logical drive at the same time. You should verify no other processes are accessing the drive. If you Ignore the warning your process will possibly continue, but may cause damage to the data on the drive. Therefore, ignoring is not recommended.

See also: Drives


DRV16.DLL not found

Warning: DRV16.DLL not Found

This message is displayed on startup if the program runs on a Windows95/98/ME system and does not find the file DRV16.DLL.

This component provides physical drive access and is required by this program. You should quit the program and re-install this software.

See also: Physical drives


Bad sector

Bad Sectors Handling

An error was encountered during a sector block read operation.

Sectors are read in chunks of 16 sectors. If this operation fails this might be because of a single bad sector or of several bad sectors. You have the choice:

Skip sector block

All 16 sectors are considered bad. No attempt is made to retrieve possibly good sectors.

Retry accessing single sectors

The program retries reading the sectors one by one. This gives the chance to retrieve possibly good sectors in the neighborhood of a bad one. However, this can be very time consuming, especially if there are not good sectors at all.


Support

You can contact us for support:

USA

Phone | 1-775-884-3922
Fax | 1-818-475-1741
Email | support@runtime.org
Website | http://www.runtime.org

Europe (Germany)

Phone | +49-30-280 8008
Fax | +49-30-690 88 444
Email | support_europe@runtime.org
Website | http://www.runtime.org

If you have any questions related to the use of this software, please call us or send us an email.

See also: Troubleshooting, License agreement


Drives

Besides physical drives, Runtime's data recovery programs accept image files as a data source:

  • Physical drives
  • Image files


Image Files

Image files are files containing raw images of a drive. With programs like Runtime's RAID Reconstructor and GetDataBack you can process these image files like real physical drives.

Multiple Files

Image files can consist of:

  • one file (e.g. 'drive128.img')

  • multiple files (e.g. 'drive128.img', 'drive128.001', 'drive128.002', ...)

This is helpful when imaging a drive larger than the maximum file size (2GB or 4GB, depending on the operating system). Fragments of a multiple file image are about 656MB in size. A smaller size indicated the end of the file set.

Compression

You can use compressed image files (e.g. 'drive128.imc') by selecting 'Compressed image data files (*.imc)' as file type in the file open dialog. This feature enables you to create drive images much smaller than the original.

Compressed files can be multiple file images too.

See also: Drives, Physical Drives, Creating an Image File


Physical drives

Physical drives are tangible media like hard drives and diskettes. They have specific names:

FD0 | 1st diskette drive
FD1 | 2nd diskette drive
HD128 | 1st hard drive
HD129 | 2nd hard drive

See also: Drives, Image Files