00:05Welcome to the Hetman Software Channel.
00:08Data on a Linux server can become inaccessible for various reasons.
00:13Accidental file deletion, file system corruption, RAID-R failure, or the failure of one or multiple drives, the RAID controller,
00:22or the server itself.
00:23The situation becomes even more complicated if the data is stored on an encrypted LUKS partition or inside directories protected
00:32by fccrypt.
00:34Hetman RAID Recovery helps reconstruct damaged or incomplete RAID arrays, find lost partitions, decrypt LUKS and fccrypt when you have
00:44the password, and recover both existing and deleted files.
00:48In this video, we will show the entire recovery process on a Windows 11 computer.
00:54At the same time, the program can analyze drives, RAID arrays, and file systems created in Linux and macOS, so
01:02you do not necessarily need a working original system to recover your data.
01:07Setting up RAID, LUKS2, and fccrypt.
01:12To test Hetman RAID Recovery 3.1, we prepared a Dell PowerEdge R710 server with a PERC-H700 RAID controller
01:21and Ubuntu Server 24.04 LTS installed.
01:26Using four 60 GB HDD drives and MD-ADM, we created a software Linux MD RAID 6 with a total
01:35capacity of about 120 GB.
01:38The chunk size was 512 KB.
01:41In Hetman RAID Recovery, this parameter is displayed as block size.
01:45On the array, we configured an encrypted LUKS2 volume and created an EXT4 file system inside it.
01:54A separate folder on this partition was additionally encrypted with fccrypt using its own passphrase.
02:01After preparing the storage, we wrote test files to it and then deleted some regular data from EXT4 along with
02:08some files from the fccrypt protected directory.
02:12Connecting Physical Drives
02:14You can connect the RAID Array's drives via SATA, SAS, fiber channel, an HBA, or a RAID controller, but it's
02:22important that the controller gives the program access to each physical drive individually.
02:28You can also use USB adapters, docking stations, or external enclosures.
02:33For a long analysis, it's better to use a direct connection via SATA, SAS, HBA, or a suitable controller.
02:41It's usually faster and more stable.
02:44Connecting all drives of the array is not always necessary.
02:48Hetman RAID Recovery will account for missing drives and reconstruct their data if the RAID level allows and the remaining
02:55healthy drives are sufficient to rebuild the array.
02:58For example, RAID 5 allows for one missing drive, while RAID 6 allows for two.
03:04After connecting the drives, Windows may prompt you to initialize or format them.
03:10Do not agree.
03:11Close this message to avoid altering the data and the RAID service information.
03:15Working with disk images
03:17Working with disk images is useful if you do not have enough ports to connect all drives at the same
03:23time or if the drives have poor smart values, read errors, or unstable performance.
03:28To create an image in Hetman RAID Recovery, select the required physical drive in the main program window and click
03:35Save Disk.
03:36In the saving wizard, choose to create an image of the entire disk, specify the folder and file name, and
03:42then start copying.
03:43It is advisable to save the image to another healthy drive with enough free space.
03:49For further work, click Mount Disk, Raw Disk Images, select the created image files, and add them to the program.
03:56After that, Hetman RAID Recovery will work with them just like regular physical drives and will be able to use
04:02them for automatic or manual RAID reconstruction.
04:06Connecting drives via SSH
04:08If the Linux server remains accessible over the network, the drives can be added remotely via tools slash connect via
04:16SSH.
04:17Specify the server address, port, and authentication details, and then select the required physical drives or volumes.
04:24They will be added to Hetman RAID Recovery and become available for analysis and RAID reconstruction without a physical connection
04:31to the computer.
04:33Automatic RAID Array Detection
04:35After launching Hetman RAID Recovery, the program automatically analyzes the available drives and searches for signs of RAID arrays on
04:43them.
04:43If the necessary drives are already connected to the computer, the detected array is displayed in the RAID arrays section
04:50right after launch.
04:51If the drives are added later, connected physically, mounted from images, or added via SSH, the program reanalyzes the available
04:59RAID members and, if there is enough information, automatically reconstructs the array.
05:05For the detected array, Hetman RAID Recovery shows its main parameters, the array type and capacity, sector and block size,
05:13data layout scheme, RAID status, as well as the list of member drives, their order, and offset.
05:18In our case, the program automatically detected the Linux MD RAID 6 with a capacity of about 118 GB and
05:27displayed it as ready for further analysis and data recovery.
05:31We will examine the detailed parameters of the array later during manual reconstruction.
05:36If some drives are missing, the program shows them as empty disk and determines whether there is enough available drives
05:42for reconstruction.
05:43In our test, even with two out of four drives missing, the RAID 6 array has the recoverable status and
05:51remains available for analysis and data recovery.
05:53RAID Analysis and Data Decryption
05:56To start searching for data, double-click on the detected RAID array or partition.
06:01If Hetman RAID Recovery detects that the volume is encrypted with LUX, the program will immediately prompt you to enter
06:08the password or specify a key file.
06:12Decryption requires the correct password or key as well as intact LUX service data.
06:18After unlocking LUX, select the analysis type.
06:22First, you can run a fast scan.
06:24This is often enough if the partition structure and file system were not damaged and you only need to find
06:30recently deleted files.
06:31However, if any destructive operations were performed on the drive, such as deleting or creating partitions, formatting, changing the file
06:39system, corrupting the partition table, or other operations that could have altered the data structure, it is recommended to use
06:46full analysis.
06:48During a full analysis, specify the file system that was used on the array.
06:52In our case, it is EXT 2, 3, 4.
06:57If the program detects data encrypted with FC script during the analysis, it will prompt you to enter the corresponding
07:04passphrase.
07:05After decryption, you can proceed to search for both existing and deleted files.
07:11Previewing and saving recovered files
07:13Once the analysis is complete, review the found files.
07:17Use the thumbnail view, preview feature, as well as search and filters to quickly find the needed data and check
07:24its contents.
07:25The program marks deleted files with a red cross.
07:28Select the files and folders you want to save and click Recovery.
07:32Do not save recovered data to the drives that are members of the RAID array.
07:37Writing to them may overwrite information that has not yet been recovered.
07:41Use a separate physical drive for saving.
07:43In the wizard, specify the destination location and start saving the files.
07:49Manual RAID Reconstruction
07:51Automatic RAID detection may be impossible if the array's service information is damaged, overwritten, missing, or inconsistent across the drives.
08:01This can happen after operations performed directly on the array member drives that may have damaged or overwritten the RAID
08:07metadata,
08:08initializing drives in Windows, running MDADM-0 superblock, creating a new RAID over the old one, modifying the partition table,
08:18partially overwriting the drives, or a failed rebuild.
08:22Manual reconstruction may also be needed if some drives are missing or damaged, if metadata from different RAID arrays remains
08:29on the drives, if the drive order or offset was changed, or if the image of one of the drives
08:35is incomplete.
08:35If Hetman RAID Recovery could not automatically detect the array configuration, you can rebuild it manually using the RAID constructor.
08:44Open the RAID constructor, select Manual mode, and specify the known parameters of the array.
08:50For the Linux MDRAID 6 created with MDADM using the standard layout in our test, the left synchronous P plus
08:58Q scheme is used in the RAID constructor.
09:01In our case, the block size was 512 kilobytes.
09:05For most drives, use the value of 512 bytes in the bytes-per-sector field.
09:10If the drive uses a 4K logical sector, select 4096 bytes.
09:16For a standard Linux MDRAID, leave the byte order parameter set to standard unless the array was created with other
09:23specific settings.
09:25Next, set the correct drive sequence and specify the data offset for each of them.
09:31In our case, it was 34,603,008 bytes for each drive.
09:37If one or more drives are unavailable, add an empty disk in their place.
09:42Once the configuration is assembled, add the reconstructed RAID to the main program window by clicking Add.
09:49After that, you can work with it in the same way as with an automatically detected array.
09:54Unlock LUX, perform a file system analysis, and recover the needed files.
09:59How to determine unknown RAID parameters?
10:02If some RAID parameters are unknown, they can be determined by the structure of the data stored on the array.
10:08In our case, we know that Linux MDRAID 6 was used, and an encrypted LUKS2 volume was located directly on
10:17it.
10:18Let's start by determining the data offset.
10:21Offset.
10:22Open each drive of the array in the hex editor.
10:25Start a search by hex value and enter the LUX signature, 4C534458BABE.
10:34In the search parameters, set the direction to down, the position to begin of sector, and start the search.
10:42In our test array, the LUX signature was found at the address of 34,603,008 bytes from the beginning
10:50of the drive.
10:50This is the exact value we use as the offset for all drives in our array.
10:56The drive where the signature is found contains the beginning of the LUX logical volume.
11:01This allows us to determine the data offset and identify the reference drive,
11:05but the signature itself does not show the full sequence of all drives.
11:10Therefore, if the drive order is unknown, leave it for automatic detection using detect the disk order automatically.
11:16Next, set the parameters that are already known.
11:20If the array was created using MDADM with default settings, the typical scheme for RAID 5 is left synchronous,
11:28and for RAID 6 is left synchronous P plus Q.
11:32In our case, the block size is 512 kilobytes.
11:35If this parameter was changed during RAID creation, it may have a different value such as 64, 128, 256, or
11:451 megabyte.
11:46For the parameters that you managed to determine, specify their exact values.
11:51Leave detect automatically only for the unknown parameters.
11:55This significantly reduces the number of possible configurations and speeds up the search.
12:00After that, click Next and wait for the check of possible options to complete.
12:06During the search, Hetman RAID Recovery shows the progress, elapsed time, and the number of found configurations.
12:13Once the search is complete, select the most suitable configuration and add the reconstructed RAID to the main program window.
12:20You can verify the correctness of the parameters by the structure of the obtained data.
12:25In our case, Hetman RAID Recovery should see a LUX2 volume of the expected size.
12:30If it unlocks successfully with the correct password and the ext4 file system is detected inside,
12:37the RAID configuration has been selected correctly.
12:40Conclusion
12:41Hetman RAID Recovery automatically detected the Test Linux MDRAID 6,
12:47unlocked LUX2 with the known password, and found both existing and deleted files during a fast scan.
12:53After entering the FSCRP passphrase, the program also gained access to both existing and deleted files in the additionally encrypted
13:02directory.
13:03If the RAID metadata is insufficient, the array can be reconstructed manually in the RAID constructor using the known parameters
13:11or by using automatic detection for the unknown values.
13:16Searching for the LUX2 signature in the hex editor helps determine the data offset,
13:21and the correctness of the configuration can be verified by successfully unlocking LUX and detecting the ext4 file system.
13:29If this video was helpful to you, subscribe to our channel, like this video, and leave a comment.
13:34Let us know what encryption, RAID, or data recovery issues you have encountered.
13:39We'll see you soon, bye!
13:39We'll see you soon, bye-bye!
13:39I'll see you next time.
