Skip to main content

Maxtor Shared Storage (how I recovered all the data)

Maxtor Shared Storage NAS 300 GB

Summary of long adventure: TL;DR.

ONE DISK IS NOT AN OPTION FOR A NAS

- Audience : advanced users
- linux skill required : yes
- strong opinion : yes
- frustration : yes

It looks so nice in the picture : storing data on a NAS, not on the local system.
You can access it from anywhere in the network, all is fine.
Until.. The NAS breaks down and you forgot the backups..

I had this NAS for a long time (several years), somewhere safe in the house, in a dry and protected and cool place, nobody would be able to find it, a digital safe, connected to my local network.

It seems a smart idea, but it really was not.



Here is my summary of trouble to get my data back.
1) The NAS did not appear in my network anymore
2) Checked power supply, switches, cables
3) conclusion, NAS is bad
4) reboot, does not come online again
5) open it up, take out harddisk, how hard can it be? Right?

I connected the disk to my machine with one of those PATA/SATA-to-USB things (20 euro things)


I was expecting to see the disk on my standard linux machine, but it did not appear.
The device was recognized and connected, but the partition table was not OK.


[3031402.984558] usb 3-1.4.1: USB disconnect, device number 19

[3031412.046165] usb 3-1.4.1: new high-speed USB device number 20 using xhci_hcd
[3031412.203698] usb 3-1.4.1: New USB device found, idVendor=152d, idProduct=2338
[3031412.203703] usb 3-1.4.1: New USB device strings: Mfr=1, Product=2, SerialNumber=5
[3031412.203706] usb 3-1.4.1: Product: USB to ATA/ATAPI Bridge
[3031412.203709] usb 3-1.4.1: Manufacturer: JMicron
[3031412.203711] usb 3-1.4.1: SerialNumber: 222222222222
[3031412.205482] usb-storage 3-1.4.1:1.0: USB Mass Storage device detected
[3031412.205695] scsi host11: usb-storage 3-1.4.1:1.0
[3031413.231124] scsi 11:0:0:0: Direct-Access     Maxtor 6 SNCH 1E00 PQ: 0 ANSI: 2 CCS
[3031413.231676] sd 11:0:0:0: Attached scsi generic sg9 type 0
[3031413.231936] sd 11:0:0:0: [sdi] 586114704 512-byte logical blocks: (300 GB/279 GiB)
[3031413.232403] sd 11:0:0:0: [sdi] Write Protect is off
[3031413.232407] sd 11:0:0:0: [sdi] Mode Sense: 00 38 00 00
[3031413.232927] sd 11:0:0:0: [sdi] Asking for cache data failed
[3031413.232936] sd 11:0:0:0: [sdi] Assuming drive cache: write through
[3031413.259767] sd 11:0:0:0: [sdi] Attached SCSI disk

The old disk is on device /dev/sdi

I googled around and found that Maxtor/Broadcom made up their own table format.
Here is the code to read it :
http://www.k0lee.com/hpmediavault/diskformat/disk_configuration.c

But it comes down to this : reading the first sector of the disk (with dd or some hex editor)

/*
 *          Broadcom Disk Header Format
 *
 *    Offset          Meaning
 *     0-  33    Magic: ``Broadcom NAS Version 1.0 MBR Tag/0/0''
 *    34-  39    NAS ID: 6 bytes of binary data to uniquely identify the NAS
 *               that owns the disk.  This can be the ethernet hardware
 *               address, but need not be.
 *    40-  80    Disk Name: A zero-terminated ASCII string.  After the
 *               string-terminating zero byte the rest of the bytes are padded
 *               out to zero.  The zero terminator must be included -- i.e.
 *               byte 80 must be zero.
 *    84-  99    Disk Unique ID: 16 bytes of binary data that uniquely identify
 *               the disk.
 *   100- 100    A flag indicating which of the two partition table regions to
 *               use: 0 means the first one and any other value means the
 *               second one.
 *   104- 104    The current disk spin-down value.  For IDE and SATA disks,
 *               this represents the value programmed by the 0xe3 command of
 *               the ATA spec, on disks that support this feature.  The spin-
 *               down value is an 8-bit write-only value that specifies how
 *               much idle time should pass before the disk automatically spins
 *               down.  The ATA spec specifies how the 256 values map to times,
 *               and Western Digital implements an alternate mapping in many of
 *               its drives.
 *   512-1535    The first partition table region.
 *  1536-2559    The second partition table region.
 */

/*
 *          Broadcom Partition Spec Block Format
 *
 *   Offset         Meaning
 *    0- 79    Name of disk.  Each byte must be an ASCII upper- or lower-case
 *             letter, ASCII digit, ASCII dash, ASCII underscore, ASCII space,
 *             or zero.  The first byte must not be zero.  After a zero byte,
 *             all subsequent bytes must be zero.
 *   80- 81    Zero.
 *   82- 87    NAS ID of the NAS that claimed the disk.
 *   88-103    Disk unique tag.
 *  104-107    Partition number.
 */

/*
 *          Broadcom Pool Info Block Format
 *
 *   Offset         Meaning
 *    0- 79    Name of pool.  Each byte must be an ASCII upper- or lower-case
 *             letter, ASCII digit, ASCII dash, ASCII underscore, ASCII space,
 *             or zero.  The first byte must not be zero.  After a zero byte,
 *             all subsequent bytes must be zero.
 *   80- 83    Zero.
 *   84- 99    Unique tag of pool.
 *  100-105    Unique tag of NAS that created pool.
 *  106-107    Zero.
 *  108-116    Creation time/date stamp of pool.  This stamp is created based
 *             on the date and time (in universal time) that the pool was
 *             created.  The first 4 bytes are the year, the next byte the
 *             month, the next byte the day, the next byte the hour, the next
 *             byte the minute, and the final byte is the second.
 *  117-118    Zero.
 *  119-119 RAID 5 Tag. 0 => non RAID 5 partition, 5 => RAID 5 Partition
 *  120-123    Number of stripes in pool.
 *  124-127    Number of mirrors in pool.
 *  128-131    Number of spares in pool.
 *  132-135    Number of this pane.
 *  136-139    Number of chunks in this pane.
 *  140-143    Number of this chunk in this pane.
 *  144-147    Chunk size.
 *  148-255    Partition spec of the start of the next pane.
 *  256-363    Partition spec of the next chunk in this pane.
 *  364-367    Resize operation in progress.  A zero means there is no resize
 *             operation currently in progress and a one means there is
 *             currently a resize operation in progress.  Any other value is
 *             illegal.
 *  368-375    Resize move backward bytes complete.  If there is no resize
 *             operation in progress, this should be zero.  If there is a
 *             resize operation in progress, this should hold a count of the
 *             number of bytes completed in the backward movement pass of the
 *             data movement for the resizing.
 *  376-383    Resize move forward bytes complete.  If there is no resize
 *             operation in progress, this should be zero.  If there is a
 *             resize operation in progress, this should hold a count of the
 *             number of bytes completed in the forward movement pass of the
 *             data movement for the resizing.
 *  384-391    Resize old kilobytes in this partition.
 *  392-399    Resize new kilobytes in this partition.
 *  400-495    Zero.
 *  496-511    Block validity marker: 0x5f9817820ea0bc335f9817820ea0bc33.
 */


Long story, but somewhere on the disk is a REISER-FS (version 3.6) but the partition table was corrupted so the thing could not boot up anymore. (doc here : http://jcoppens.com/univ/data/pdf/fs/reiserfs.pdf )

I tried making a full backup of the disk with the normal dd command, but it failed every time.
(disk ticking, taking forever and failing completely as seen in kernel logs, using dmesg)

I found a way to make a complete image with ddrescue command (you need to install this)
(https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html)
This is a very smart program that records which sectors were copied without errors and can be restarted without reading known data again, very good!!

I copied the whole disk: (ignoring partitions)


oetel@i7-pc:~$ sudo ddrescue /dev/sdi maxtor_disk.img mapfile
GNU ddrescue 1.22
Press Ctrl-C to interrupt
Initial status (read from mapfile)
rescued: 375521 kB, tried: 65536 B, bad-sector: 0 B, bad areas: 0


    ipos:  375586 kB, non-trimmed:        0 B, current rate: 65536 B/s
    opos:  375586 kB, non-scraped:        0 B, average rate: 25350 kB/s
non-tried:        0 B, bad-sector:       0 B, error rate: 0 B/s
 rescued:  300090 MB,   bad areas:     0, run time:  3h 17m 2s
pct rescued:  100.00%, read errors:        0, remaining time: n/a
                             time since last successful read:         n/a

Finished   


The trick is to find the start of the ReiserFS partion in this large Blob.
We can search the Blob with some tools, I used midnight commander text search.
(to find the offset of the signature : ReIsEr2Fs\0\0\0: yes this is case sensitive)

https://www.forensicswiki.org/wiki/Reiserfs

00000000 66 00 01 00 93 18 00 00 82 40 00 00 12 00 00 00  f........@......
00000010 00 00 00 00 00 20 00 00 00 04 00 00 ac 34 11 57  ..... ......¬4.W
00000020 84 03 00 00 1e 00 00 00 00 00 00 00 00 10 cc 03  ..............Ì.
00000030 08 00 02 00 52 65 49 73 45 72 32 46 73 00 00 00  ....ReIsEr2Fs...
00000040 03 00 00 00 04 00 03 00 02 00 00 00 dc 52 00 00  ............ÜR..

When you find the block that looks like this you are lucky.
To find the start of the real offset of the partition you need to go back exactly 64Kbyte.
First part of reiser partition 64k is empty…

From that point you can mount the partition using a loopback mount.

eg: (you need to specify the reiserfs filesystem or it will not work!)
You also need to install :  reiserfsprogs


$ sudo mount -t reiserfs -o loop,offset=528785408 maxtor_disk.img /mnt




[3031412.205482] usb-storage 3-1.4.1:1.0: USB Mass Storage device detected
[3031412.205695] scsi host11: usb-storage 3-1.4.1:1.0
[3031413.231124] scsi 11:0:0:0: Direct-Access     Maxtor 6 SNCH 1E00 PQ: 0 ANSI: 2 CCS
[3031413.231676] sd 11:0:0:0: Attached scsi generic sg9 type 0
[3031413.231936] sd 11:0:0:0: [sdi] 586114704 512-byte logical blocks: (300 GB/279 GiB)
[3031413.232403] sd 11:0:0:0: [sdi] Write Protect is off
[3031413.232407] sd 11:0:0:0: [sdi] Mode Sense: 00 38 00 00
[3031413.232927] sd 11:0:0:0: [sdi] Asking for cache data failed
[3031413.232936] sd 11:0:0:0: [sdi] Assuming drive cache: write through
[3031413.259767] sd 11:0:0:0: [sdi] Attached SCSI disk
[3037317.028554] REISERFS (device loop0): found reiserfs format "3.6" with standard journal
[3037317.028570] REISERFS (device loop0): using ordered data mode
[3037317.028570] reiserfs: using flush barriers
[3037317.039738] REISERFS (device loop0): journal params: device loop0, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30
[3037317.039922] REISERFS (device loop0): checking transaction log (loop0)
[3037317.047940] REISERFS warning (device loop0): clm-2076 journal_read_transaction: device is readonly, unable to replay log
[3037317.047941] REISERFS warning (device loop0): reiserfs-2006 journal_init: Replay Failure, unable to mount
[3037317.048068] REISERFS warning (device loop0): sh-2022 reiserfs_fill_super: unable to initialize journal space



Success !! start celebration now !!
- chown all data so we can read it, (uid not matching, so we take ownership)
Copy the stuff from /mnt directory to some safe place




To unmount again:

$ sudo umount /mnt

- remove image file (300 GB)

- throw old disk in trash for recycling

Finally we can sleep again.
Hope this helps you out!

Comments

Popular posts from this blog

Denon DHT T100 DESIGNED TO FAIL : bad caps (ceramic caps this time)

A friend gave me a Denon DHT-T100 to look at.
Do not spend much time on it.. ok.


It had a problem, it started clicking and ticking after power on, and after some time.
(a so called intermittent problem)

Sometimes it did not tick or click, but it was basically not usable.
The clicking had a sharp click in one channel and repeated after about a second, then sound recovered and it would click and drop out again.

He told me, do not spend any time on it, yeah, right. ;-) like I would give up after 15 minutes.
I wanted to know what was going on with this thing, I found some schematic online and started measuring the usual things.

The power supply, 24V did it drop down when a tick occurred ? Difficult to find out because sometimes the thing would play for hours without a glitch.

I eventually found out the 24 V PSU, the step down SMPS on board and the LDO's were all ok, all power rails remained within spec, but it still glitched sometimes. (while power was ok)

I investigated methodically,…

Raspberry Pi, PyFace Digital, the lost documentation, I found it finally

The Raspberry PI or R-pi from http://www.raspberrypi.org/ is well known these days.
It is not an accident that I have one, I have been doing Linux stuff since 1991, and professionally since 1996 I can not skip over these developments, have to keep up with the new kids. :-)
Times have changed, hardware has become very affordable, everybody knows the Arduino, Raspberry Pi and Beagle-Bone-Black (BBB). Not everybody knows the stuff that http://www.acmesystems.it/ aka Acme-Systems and https://github.com/OLIMEX/OLINUXINO aka Olimex make, so I will endorse them here.
Since I am an engineer I expect to connect switches and relays to the boards and some documentation with products, not so with the "PiFace Digital" board, it comes without serious documentation, not a even the schematic. All links on their blog point nowhere. People asked them many times, yet nowhere is the schematic to be found.

I finally found some info after hours of google-work, someone made a copy!
https://github.c…

Nederland van het aardgas af, dat schiet lekker op (NOT!)

Om dingen even in perspectief te plaatsen moet je gewoon even wat berekeningen maken.
We gaan Nederland van het aardgas afhalen (de burgers) omdat?

https://www.ad.nl/wonen/nederland-heeft-nog-lange-weg-te-gaan-gasverbruik-stijgt~aaf1527e/

In USA fakkelen ze 2123763,4944 m3 aardgas af per UUR
(bij winning van olie, gas is ongewenst daar, opslag niet handig, goedkoper om te fakkelen)


1.8 miljard cubic feet per dag...

Ons Nederlandse gasverbruik (huishoudens) is : 1500 m3 per jaar per huishouden

Even rekenen 2.1 miljoen m3 per uur, dat is

24 * 365 * 2.100.000,00 = 18.400.000.000,00 m3 aardgas affakkelen per jaar

(even de rekenmachine pakken)

18.400.000.000 / 1500 => aantal huishoudens Nederland

dat is voor 12.3 miljoen huishoudens (met gasverbruik van 1550 m3/jr)

Naast het opbranden lozen ze ook nog gewoon aardgas direct in de atmosfeer. (genaamd Venting)

Waarom moet ik ook alweer van het aardgas af?

Niet voor het milieu en de toekomst van onze kinderen, daarvoor helpt het helemaal…

ESP32 IDF master update troubles (and fix)

I am using ESP32 IDF for some private experiments. (more info later)

I really like it, not like some Arduino hobby IDE, that is a  half done, non-professional project.
I see a lot of people writing stuff like "do ESP32 in Arduino" this is completely backwards, you should avoid anything Arduino-related. You can not use Arduino in a real project, it can not be controlled, it is doing "magic" things and breaks everytime. You guessed it: I do not like it. ;-)

The ESP-IDF works really well uses cmake, is well documented, I use visual studio code insiders or clion van jetbrains to coordinate my coding and GIT to store my stuff.

I am really impressed with how well it works. Including flash-upload, debugging all works fine.

A few days ago I updated the IDF to the latest version and got errors:


$ git checkout master
$ git pull

remote: Enumerating objects: 1492, done.
remote: Counting objects: 100% (1492/1492), done.
remote: Compressing objects: 100% (213/213), done.
remote: Total…

DPS5005 power supply, remote control using python serial port modbus

Just a short one.
I bought one of these things.
It can do 50 volt 5 Amp, I have not looked at the quality of the output (noise, overshoot all unknown to me)  but should be alright to control a lamp, a battery or a strip of LED's is my guess.


You can easily control the current and voltage output using a serial port. (a usb-serial-rs485 was provided)

I seems to talk modbus protocol.

To change the baud rate and modbus-slave-address, keep POWER button pressed during power on, this will enter you into the configuration menu.

register list here :
Register Map for this device.
Function Description Number of bytes Decimal places UNIT Read/Write Register address U-SETVoltage setting2 2 V R/W 0000H I-SETCurrent setting2 3 A R/W 0001H UOUTOutput voltage display value2 2 V

Aircon Repair on Hyundai Getz (on the hottest day of the year)

Yesterday was the hottest day of the year 2013 to date. Temperatures reached 36 degrees C. Normal value for this time of year is about 24 degrees (according to KNMI).

My wife's car, a Hyundai Getz had a broken AC unit and I decided to fix it.  The AC light lit up just like normal but the clutch to the compressor did not kick in. After spending hours googling for schematics and diagrams, reading forums I found out why. The system is protected by a clever pressure switch, (conveniently located behind the glove compartment) It disables the clutch when pressure is too high or too low. After checking all things electrical, fuses, sensors, the clutch, the fans and switches I was out of options, I could not measure the pressure in the system.

I visited a local car repair shop specialized in Airco systems, Rene van de Louw, st. Oedenrodeseweg 40, and he quickly noticed that I had a leak in my condenser. How? He put some pressure on the system with nitrogen and I could hear a hissing sound…

Grinder and paint make me the welder I ain't.

Flux core.

It is not going anywhere soon!

Speaker modification for Old Timer Mercedes

Fixed voltage on cheap buck converter (MP1584) conversion with single 0805 resistor

Everywhere I look on the Ali and Ebays I see these step down converters based on MP1584. I bought a couple and actually they are not bad at all.

The output voltage is set by the trimming-resistor in the left top corner of the picture. This works OK, but.. it is dangerous because it is rather sensitive to the touch.
I decided that I wanted fixed output, so I had to figure out how this thing worked. The datasheet looks like this :
R1 in the datasheet is what I call "R feedback" in my image. The value of R2 is mostly 8.2K Ohm in the boards I have seen. 


So to set some common values for output voltage:
change R1 to 27K for 3V3 output (actually 3.4 volt, but 27K is a standard value)
or
change R1 to 43K0 for 5.0 Volt output. (43 K is a standard value)
A standard 0805 size resistor fits precisely, how convenient ;-).

Make sure the other resistor is really 8.2K because that determines the feedback ratio.

This way you can not burn up your circuits by accident (or some funny clown tu…