Unknown filesystems on RAID5 partitions

Question

I am trying to retrieve data from NAS (Acer Altos EasyStore M2) with dead mainboard. System in the NAS is based on CentOS 5 and some software from Falcon (FalconStore) is used.

I removed disks from NAS and connected to other computer. After starting linux from live media (ubuntu) I see all 4 disks and system detected the RAID partitions and reassembled two RAID devices. But I cannot mount any partition from RAID devices.

Partitions on disk /dev/sda (sdb, sdc and sdd are the same):

Disk /dev/sda: 931.53 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: ST1000DM010-2EP1
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot   Start        End    Sectors   Size Id Type
/dev/sda1             1    6297479    6297479     3G 83 Linux
/dev/sda2       6297480    7357769    1060290 517.7M 82 Linux swap / Solaris
/dev/sda3       7357770 1953525167 1946167398   928G 89 unknown

Assembled RAID devices:

Disk /dev/md127: 3 GiB, 3224240128 bytes, 6297344 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Alignment offset: 3584 bytes

Disk /dev/md126: 1.83 TiB, 1992875180032 bytes, 3892334336 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 65536 bytes / 131072 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device       Boot Start        End    Sectors  Size Id Type
/dev/md126p1          1      16064      16064  7.9M 77 unknown
/dev/md126p2      16065 3892334335 3892318271  1.8T 88 Linux plaintext

RAID status from /proc/mdstat:

Personalities : [raid1] [raid6] [raid5] [raid4] [linear] [multipath] [raid0] [raid10] 
md126 : active (auto-read-only) raid5 sdd3[0] sdb3[1] sda3[3](S) sdc3[2]
      1946167168 blocks level 5, 64k chunk, algorithm 2 [3/3] [UUU]
  
md127 : active (auto-read-only) raid1 sdc1[1] sdd1[2] sdb1[0] sda1[3]
      3148672 blocks [4/4] [UUUU]
  
unused devices: <none>

md127 seems like the system disk (all 4 partitions are mirrored).

md126p2 seems like data partition.

I am not sure about md126p1 - 8MB only...

I was looking around and found the firmware here. It contains the image altos_256_flash_2052. Probably this is the content of flash memory on the mainboard. So I wrote the image to the USB disk an tried to boot. It is booting but stuck on prompt:

(none) login:

and I cannot continue without credentials.

Can someone help me to identify the filesystem type and mount it to retrieve data? Probably I need only to read the biggest (2TB) data partition..

EDIT: Adding blkid output (now from CentOS 7)

/dev/sdb1: UUID="75835a1d-dfbd-4673-0890-1856f768949d" TYPE="linux_raid_member" 
/dev/sdb2: TYPE="swap" 
/dev/sdb3: UUID="34c90eaa-f409-f278-d0ac-5b088a21cdc7" TYPE="linux_raid_member" 
/dev/sdc1: UUID="75835a1d-dfbd-4673-0890-1856f768949d" TYPE="linux_raid_member" 
/dev/sdc2: TYPE="swap" 
/dev/sdc3: UUID="34c90eaa-f409-f278-d0ac-5b088a21cdc7" TYPE="linux_raid_member" 
/dev/sdd1: UUID="75835a1d-dfbd-4673-0890-1856f768949d" TYPE="linux_raid_member" 
/dev/sdd2: TYPE="swap" 
/dev/sdd3: UUID="34c90eaa-f409-f278-d0ac-5b088a21cdc7" TYPE="linux_raid_member" 
/dev/sda1: UUID="75835a1d-dfbd-4673-0890-1856f768949d" TYPE="linux_raid_member" 
/dev/sda2: TYPE="swap" 
/dev/sda3: UUID="34c90eaa-f409-f278-d0ac-5b088a21cdc7" TYPE="linux_raid_member" 
/dev/sde1: UUID="dc6f13be-2e3b-4deb-bfb1-a143dbce9de8" TYPE="xfs" 
/dev/sde2: UUID="NWRZRS-509E-KNzF-iFL0-WS8r-KIHV-DSdVUa" TYPE="LVM2_member" 
/dev/mapper/centos-root: UUID="608eab84-0b37-4b9f-86c8-da75b5e03dba" TYPE="xfs" 
/dev/mapper/centos-swap: UUID="5599438f-d0b2-428f-93b1-98349df138c4" TYPE="swap" 
/dev/mapper/centos-home: UUID="62d80f29-37a9-4261-89ed-80c4ec75bcc1" TYPE="xfs" 
/dev/md126: UUID="39310d11-dce7-4bd4-b47d-056d9db24a5e" TYPE="ext3" 
/dev/md127: PTTYPE="dos"

/dev/md126 - succesfuly mounted - as expected it is a system partition 3GB.

Still I cannot mount /dev/md127...

Is the used disks geometry the same as was in the NAS? or can be different on the different machine causing the problems? Just wondering why the partition/filesystem types are not recognized... — lucky62, May 13 '21 at 08:56
In Linux MD RAID the exact array geometry is written into superblocks on component devices. So it is extremly unlikely the array was assembled incorrectly. Did you run `blkid` on the live system with assembled RAID? Please run and attach the output. — Nikita Kipriyanov, May 13 '21 at 10:33
blkid output added. Thanks for hint. System partition 3GB is accessible. I am thinking if I will be able to boot from this partition then the NAS will be up again?.. :-) — lucky62, May 13 '21 at 16:49
Did you use lvm on top of raid? Maybe it's an lvm pv, and maybe the partition type is simply marked incorrectly? Try poking it with `pvscan` — rvs, May 13 '21 at 16:55
Also I forgot, `lsblk` also often shows useful info, but I think with 4 drives in raid the output will be somewhat messy. Is `md126` the former NAS root filesystem? Then I'd explore its contents to find out how exactly it initializes. For example, there could be encrypted but key might be somewhere in the root filesystem. Also you can try to mangle it, for example, create an alternate superuser or reset existing root password to be able to enter the system when it is booted. But do backups beforehands! — Nikita Kipriyanov, May 13 '21 at 17:24
can someone tell me what is the difference between TYPE and PTTYPE? (only md127 has PTTYPE...) Another partition table inside?... — lucky62, May 13 '21 at 17:45
Definitely yes - PTTYPE means that this is next level partition table. — lucky62, May 13 '21 at 18:00
As I wrote at the beginning there are md127p1 and md127p2 partitions inside md127. Note that names of raid devices are now switched (md126 was previously md127 and md127 was previously md126). — lucky62, May 13 '21 at 18:11

score 0 · Answer 1 · answered May 14 '21 at 09:44

looking into log file grabbed from system partition - seems that special driver is used to work with data partition:

May  3 10:30:07 NAS-SERVER kernel: kfsnbase: module license 'unspecified' taints kernel.
May  3 10:30:07 NAS-SERVER kernel: FSNBASE init_module, got kfsnbase major 252 for char device
May  3 10:30:07 NAS-SERVER kernel: FSNBASE init_module, kfsnbase will use adaptor 'blkscsi'.
May  3 10:30:07 NAS-SERVER kernel: FSNBASE init_module, min_reserved_outcmds is 8192
May  3 10:30:07 NAS-SERVER kernel: FSNBASE init_module, scsi_buf_len is (2097152)
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 ipstor_scsi_done_startup: ipstor_scsi_done_thread running.
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 Special vendor disk detect
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 ====================
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 Special host type type detect

May  3 10:30:07 NAS-SERVER ipstor: Starting IPStor Server (FSNBase) Module succeeded
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 Cisco iSCSI driver
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 iSCSI Initiator over TCP/IP
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 StorwareRAID  driver
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 iscsi_tcp
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 iscsi_iser
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 MPT SPI Host
May  3 10:30:07 NAS-SERVER kernel: IOCORE1 ====================
May  3 10:30:09 NAS-SERVER kernel: scsi98 : FalconStor BLOCK-SCSI driver v6.00 Build 6086
May  3 10:30:09 NAS-SERVER kernel:   Vendor: FALCON    Model: LVMDISK-M09N01    Rev: v1.0
May  3 10:30:09 NAS-SERVER kernel:   Type:   Direct-Access                      ANSI SCSI revision: 02
May  3 10:30:09 NAS-SERVER kernel: blk_queue_segment_boundary: set to minimum fff
May  3 10:30:09 NAS-SERVER kernel: SCSI device sdf: 3892334336 512-byte hdwr sectors (1992875 MB)
May  3 10:30:09 NAS-SERVER kernel: sdf: Write Protect is off
May  3 10:30:09 NAS-SERVER kernel: SCSI device sdf: drive cache: write through w/ FUA
May  3 10:30:09 NAS-SERVER kernel: SCSI device sdf: 3892334336 512-byte hdwr sectors (1992875 MB)
May  3 10:30:09 NAS-SERVER kernel: sdf: Write Protect is off

So I need to boot compatible kernel and load kfsnbase module, maybe more...

How about asking vendor for help? Also, which architecture does that NAS system based on? At least, is it ARM or x86? Where is its original kernel **and** initramfs? If x86, you can try to unpack initrafms, modify it so it'll allow you to enter system without password, and the pack again and boot. — Nikita Kipriyanov, May 18 '21 at 12:45
Vendor is ACER. I already asked - product is out of life, no support, no replacement parts available. It is x86 based. Thanks for hint. — lucky62, May 19 '21 at 13:25

Unknown filesystems on RAID5 partitions

1 Answers1