Windows 7 Disk Management: spanned volume won't re-integrate missingdisk

[Yousuf Khan]

A friend of mine has a desktop running Windows 7 Ultimate x64. In it,
there is a 1TB spanned volume consisting of 3 disks: (1) 200GB, (2)
300GB, & (3) 500GB. The middle disk, disk #2, suffered a temporary
communications failure, and disappeared from the volume all of a sudden.
After the reboot, the missing disk came back, SMART status shows it as
healthy (according to Hard Disk Sentinel, though it does mention that
there was a large number of communications errors on it, i.e. 64227
times). I went into Disk Management, but the volume still shows failed.
I attempted to reactivate the disks in the volume, but it didn't work. I
then attempted to go into the command-line utility, diskpart, and ran
the following command:

DISKPART> list disk
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 186 GB 0 B *
Disk 1 Online 279 GB 279 GB
Disk 2 Online 465 GB 1024 KB *
Disk 3 Online 931 GB 0 B
Disk 4 Online 111 GB 0 B
Disk M0 Missing 0 B 0 B *

As you can see, it shows one disk missing in the Dynamic volume, M0, but
that is supposed to be the same disk as Disk 1. Disk 0, 1, and 2
together made up the dynamic volume, but it's not recognizing Disk 1 as
part of the volume, and so it lists M0 as a missing disk in the volume.

While in diskpart, I attempted to "select disk M0" and "online disk",
and that didn't work. Then I tried to do the same with operation on Disk
1, it said that it was already online. How do I get it to recognize Disk
1 as the previously missing disk?

 

[Arno]

A friend of mine has a desktop running Windows 7 Ultimate x64. In it,
there is a 1TB spanned volume consisting of 3 disks: (1) 200GB, (2)
300GB, & (3) 500GB. The middle disk, disk #2, suffered a temporary
communications failure, and disappeared from the volume all of a sudden.
After the reboot, the missing disk came back, SMART status shows it as
healthy (according to Hard Disk Sentinel, though it does mention that
there was a large number of communications errors on it, i.e. 64227
times). I went into Disk Management, but the volume still shows failed.
I attempted to reactivate the disks in the volume, but it didn't work. I
then attempted to go into the command-line utility, diskpart, and ran
the following command:

DISKPART> list disk
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 186 GB 0 B *
Disk 1 Online 279 GB 279 GB
Disk 2 Online 465 GB 1024 KB *
Disk 3 Online 931 GB 0 B
Disk 4 Online 111 GB 0 B
Disk M0 Missing 0 B 0 B *

As you can see, it shows one disk missing in the Dynamic volume, M0, but
that is supposed to be the same disk as Disk 1. Disk 0, 1, and 2
together made up the dynamic volume, but it's not recognizing Disk 1 as
part of the volume, and so it lists M0 as a missing disk in the volume.

While in diskpart, I attempted to "select disk M0" and "online disk",
and that didn't work. Then I tried to do the same with operation on Disk
1, it said that it was already online. How do I get it to recognize Disk
1 as the previously missing disk?

That is one reason not to trust Microsoft: Their engineering is still
3rd rated. What any sane RAID controller would have done here is
fail the whole array, but keep it assembled and allow you to
start it again when all drives are visible. What MS seems to have done
is kick the failed disk from the array, which does not make any sense
at all on non-redundant RAID arrays.

Your best bet is to find some tool that can assemble the spanned array
and works past MS stupidity.

That said: Any type of non-redundant RAID is only suitable as
temporary storage of non-critical data. In that case it can just
be re-created when something like this happens.

Arno

 

[Franc Zabkar]

DISKPART> list disk
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 186 GB 0 B *
Disk 1 Online 279 GB 279 GB
Disk 2 Online 465 GB 1024 KB *
Disk 3 Online 931 GB 0 B
Disk 4 Online 111 GB 0 B
Disk M0 Missing 0 B 0 B *

Disk 1 appears to have no partitions. That's why its free space
matches its size.

Try the following commands:

select disk=1
detail disk
list volume
select volume=x
detail volume

A Description of the Diskpart Command-Line Utility:
http://support.microsoft.com/kb/300415

Use a disc editor to examine Disk 1.

Here are several freeware editors:

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

Roadkil's Sector Editor:
http://www.roadkil.net/program.php/P24/Sector Editor

I'd examine sector 0 on Disk 0 and Disk 2, plus the next few sectors,
and then compare them against Disk 1. I don't know anything about
dynamic volumes, but AFAIK each drive must store metadata that
identify all the other drives in the set.

- Franc Zabkar

 

[Paul]

A friend of mine has a desktop running Windows 7 Ultimate x64. In it,
there is a 1TB spanned volume consisting of 3 disks: (1) 200GB, (2)
300GB, & (3) 500GB. The middle disk, disk #2, suffered a temporary
communications failure, and disappeared from the volume all of a sudden.
After the reboot, the missing disk came back, SMART status shows it as
healthy (according to Hard Disk Sentinel, though it does mention that
there was a large number of communications errors on it, i.e. 64227
times). I went into Disk Management, but the volume still shows failed.
I attempted to reactivate the disks in the volume, but it didn't work. I
then attempted to go into the command-line utility, diskpart, and ran
the following command:

DISKPART> list disk
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 186 GB 0 B *
Disk 1 Online 279 GB 279 GB
Disk 2 Online 465 GB 1024 KB *
Disk 3 Online 931 GB 0 B
Disk 4 Online 111 GB 0 B
Disk M0 Missing 0 B 0 B *

As you can see, it shows one disk missing in the Dynamic volume, M0, but
that is supposed to be the same disk as Disk 1. Disk 0, 1, and 2
together made up the dynamic volume, but it's not recognizing Disk 1 as
part of the volume, and so it lists M0 as a missing disk in the volume.

While in diskpart, I attempted to "select disk M0" and "online disk",
and that didn't work. Then I tried to do the same with operation on Disk
1, it said that it was already online. How do I get it to recognize Disk
1 as the previously missing disk?

The dynamic disk database is duplicated across all (dynamic) disks. The question
would be, what happened to the dynamic disk database on the orphan disk ?

http://technet.microsoft.com/en-us/library/cc737048(WS.10).aspx

"Windows Server 2003 can repair a corrupted database on
one dynamic disk by using the database on another dynamic disk."

That's what I would have expected, based on the design intent of
having the database duplicated.

The orphan disk has two pieces of info. The MBR is specially marked,
to indicate the dynamic nature. Try a copy of PTEDIT32, and examine
what it shows on each drive. There should be something in the
MBR to indicate the disk is a dynamic disk. If the MBR was overwritten,
and the MBR on the orphan no longer indicates Dynamic, that's going
to "shoot you in the foot" right there. Not a leg to stand on.
A person could create that kind of damage, by using something like
TestDisk (which has an option to rewrite the MBR).

(Run as Administrator in Windows 7...)
ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

(Partition type reference. To decode values seen in PTEDIT32)
http://www.win.tue.nl/~aeb/partitions/partition_types-1.html

Once a disk MBR is marked dynamic, then that "1MB thing" near the
end of the disk, has to be intact.

It's possible the dynamic database, uses info like hardware serial numbers,
or something equally reliable, to allow re-importing something that
got damaged. There's bound to be a way to fix this.

I tried to find tools from this list, on my WinXP Pro, but
there's really nothing (except diskpart perhaps). And I'm not even
sure anything in diskpart is appropriate. There is a "repair"
command, but it's for something else.

http://technet.microsoft.com/en-us/library/cc737610

*******

I built a Windows 7 VM, put a copy of Windows on the first virual
disk. Made two more virtual disks. Caused both of the empty virtual
disks to be Dynamic. Created a Spanned Volume across both of them.
(Two 16GB physical disks, become 32GB spanned E. Shut down,
removed one disk of the spanned set, from the VM. Started Windows 7
again. In Disk Management, it shows the disconnected disk, and
shows it as "Missing". Right-clicking, there is a menu which
includes "reactivate". And in the help, some mention of "offline"
and "online" status.

OK, so shut down Windows 7 again, connect up the second disk of the
spanned set. Reboot Windows. And, I didn't even need that "Reactivate"
item. The second disk was automatically detected as present, and
E: came back up.

This exercise doesn't prove much, expect to suggest the orphan disk
lost something in its travels. Either the MBR is busted.
Or the 1 megabyte database has gone missing. The database, is supposed
to be the same on all disks. If you had five disk, split into a two
disk span set, and a three disk RAID5, the database file on each
disk is supposed to contain all of the info for the five disks. So
not only is the span recorded, so is the RAID5, and the same database
is supposed to be present on all the disks.

If you move the Dynamic Disk set to another computer, there's some
deal about "Foreign" and "Import". But if you start that kind of
thing (moving Dynamic Disks to another computer), that just
complicates the outcomes. If, as an amateur, I was trying to
repair it, the last thing I'd do is move the disks to another
computer (for fear of losing something, or say, the foreign import
overwriting something). Maybe "Foreign" and "Import" only affects
the local registry, but I don't know that for sure.

Just a guess,
Paul

 

[Yousuf Khan]

Disk 1 appears to have no partitions. That's why its free space
matches its size.

Try the following commands:

select disk=1
detail disk
list volume
select volume=x
detail volume

A Description of the Diskpart Command-Line Utility:
http://support.microsoft.com/kb/300415

Thanks, I'll give that one a shot when I next get to his place.

Use a disc editor to examine Disk 1.

Here are several freeware editors:

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

Roadkil's Sector Editor:
http://www.roadkil.net/program.php/P24/Sector Editor

I'd examine sector 0 on Disk 0 and Disk 2, plus the next few sectors,
and then compare them against Disk 1. I don't know anything about
dynamic volumes, but AFAIK each drive must store metadata that
identify all the other drives in the set.

Oh, I'm hoping I'm not going to have to go that route. I'm hoping that
there's just some simple combination of commands in diskpart that can do
it for me. I know enough about the basics of diskpart, but some of the
more esoteric commands might be outside of my knowledge. But I don't
want to start using diskpart commands thinking they mean one thing, and
end up meaning something else.

Yousuf Khan

 

[Yousuf Khan]

That is one reason not to trust Microsoft: Their engineering is still
3rd rated. What any sane RAID controller would have done here is
fail the whole array, but keep it assembled and allow you to
start it again when all drives are visible. What MS seems to have done
is kick the failed disk from the array, which does not make any sense
at all on non-redundant RAID arrays.

Your best bet is to find some tool that can assemble the spanned array
and works past MS stupidity.

I've posted this same question on Microsoft Technet, and so far not a
single response yet. It may be a very difficult case.

That said: Any type of non-redundant RAID is only suitable as
temporary storage of non-critical data. In that case it can just
be re-created when something like this happens.

It's a home PC, we paid the extra price for the Win7 Ultimate for
features such as this. Symantec's Volume Manager is a bit too pricey for
this setting.

When I was running Solaris systems, I used to use the included Solaris
RAID software for quick and easy spanning and other functions when the
costs prohibited buying a Symantec license for such a small job. The
Solaris software was competent, if a bit less user-friendly or as fast
as Symantec's, but you could trust it to work right.

Yousuf Khan

 

[Yousuf Khan]

I built a Windows 7 VM, put a copy of Windows on the first virual
disk. Made two more virtual disks. Caused both of the empty virtual
disks to be Dynamic. Created a Spanned Volume across both of them.
(Two 16GB physical disks, become 32GB spanned E. Shut down,
removed one disk of the spanned set, from the VM. Started Windows 7
again. In Disk Management, it shows the disconnected disk, and
shows it as "Missing". Right-clicking, there is a menu which
includes "reactivate". And in the help, some mention of "offline"
and "online" status.

OK, so shut down Windows 7 again, connect up the second disk of the
spanned set. Reboot Windows. And, I didn't even need that "Reactivate"
item. The second disk was automatically detected as present, and
E: came back up.

This exercise doesn't prove much, expect to suggest the orphan disk
lost something in its travels. Either the MBR is busted.
Or the 1 megabyte database has gone missing. The database, is supposed
to be the same on all disks. If you had five disk, split into a two
disk span set, and a three disk RAID5, the database file on each
disk is supposed to contain all of the info for the five disks. So
not only is the span recorded, so is the RAID5, and the same database
is supposed to be present on all the disks.

Well, this is interesting, then I guess I am going to have to go in with
a disk editor on this thing afterall. As Frank Z. noted, the disk is
showing empty right now, when it should show that it is part of a
dynamic volume.

If you move the Dynamic Disk set to another computer, there's some
deal about "Foreign" and "Import". But if you start that kind of
thing (moving Dynamic Disks to another computer), that just
complicates the outcomes. If, as an amateur, I was trying to
repair it, the last thing I'd do is move the disks to another
computer (for fear of losing something, or say, the foreign import
overwriting something). Maybe "Foreign" and "Import" only affects
the local registry, but I don't know that for sure.

Yeah, I had seen some mention of importing disks, but I could not find
the information to indicate how to do it.

Yousuf Khan

 

[Arno]

I've posted this same question on Microsoft Technet, and so far not a
single response yet. It may be a very difficult case.

Just my point: This should be easy. On Linux mdadm,
mdadm --assemble --force <array name/uuid/component list/etc.>
does the trick. Easy to find, easy to use. May cause
data-corruption, but that is unavoidable when a disk
drops out of a non-redundant array without warning.

The other thing I found out recently when I wanted some
Win7 redundancy is that you cannot boot from a dynamic disk.
What the hell is the use of software RAID if you cannot
use it for the most important drive???

It's a home PC, we paid the extra price for the Win7 Ultimate for
features such as this. Symantec's Volume Manager is a bit too pricey for
this setting.

When I was running Solaris systems, I used to use the included Solaris
RAID software for quick and easy spanning and other functions when the
costs prohibited buying a Symantec license for such a small job. The
Solaris software was competent, if a bit less user-friendly or as fast
as Symantec's, but you could trust it to work right.

Well, yes. Same with Linux mdadm (except the "pricey").
But with a three disk spanned array, you have about three
times the chance of something like this happening compared
to one disk. But you are right, ordinarily this should
be easy to repair and any possible corruption should be
limited to files being written at the time. Apparently
MS "upgraded" this to a real problem.

Arno

 

[Yousuf Khan]

Disk 1 appears to have no partitions. That's why its free space

matches its size.



Try the following commands:



select disk=1

detail disk

DISKPART> detail disk

Maxtor 6L300R0 ATA Device
Disk ID: 49721FF3
Type : ATA
Status : Online
Path : 0
Target : 1
LUN ID : 0
Location Path : PCIROOT(0)#PCI(1401)#ATA(C00T01L00)
Current Read-only State : No
Read-only : No
Boot Disk : No
Pagefile Disk : No
Hibernation File Disk : No
Crashdump Disk : No
Clustered Disk : No

There are no volumes.

list volume

DISKPART> list volume

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- ---------
--------
Volume 0 Spanned 931 GB Failed
Volume 1 G DVD-ROM 0 B No Media
Volume 2 E Seag 1TB Da NTFS Partition 736 GB Healthy
Volume 3 D Seag 1TB Bo NTFS Partition 195 GB Healthy
System
Volume 4 H System Rese NTFS Partition 100 MB Healthy
Volume 5 C SanDisk SSD NTFS Partition 111 GB Healthy Boot

select volume=x

detail volume

DISKPART> detail volume

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 465 GB 1024 KB *
Disk 2 Online 186 GB 0 B *
Disk M0 Missing 0 B 0 B *

Read-only : No
Hidden : No
No Default Drive Letter: No
Shadow Copy : No
Offline : No
BitLocker Encrypted : No
Installable : No

Virtual Disk Service error:
The object is in failed status.

Use a disc editor to examine Disk 1.

I`ll download those later and post the results later.

Yousuf Khan

 

[Char Jackson]

It's a home PC, we paid the extra price for the Win7 Ultimate for
features such as this. Symantec's Volume Manager is a bit too pricey for
this setting.

I realize you're well beyond the shopping phase, but I would have
recommended DriveBender <http://www.drivebender.com/> as an alternative to
MS drive spanning. I'm currently running it on a couple of systems and
haven't had any problems yet.

One system consists of 15 physical drives grouped as a single 28TB logical
volume, and the second system has 9 physical drives grouped as a single 13TB
volume. If a drive is removed from the pool, all data on all drives remains
readable.

 

[Yousuf Khan]

The dynamic disk database is duplicated across all (dynamic) disks. The
question
would be, what happened to the dynamic disk database on the orphan disk ?

http://technet.microsoft.com/en-us/library/cc737048(WS.10).aspx

"Windows Server 2003 can repair a corrupted database on
one dynamic disk by using the database on another dynamic disk."

That's what I would have expected, based on the design intent of
having the database duplicated.

The orphan disk has two pieces of info. The MBR is specially marked,
to indicate the dynamic nature. Try a copy of PTEDIT32, and examine
what it shows on each drive. There should be something in the
MBR to indicate the disk is a dynamic disk. If the MBR was overwritten,
and the MBR on the orphan no longer indicates Dynamic, that's going
to "shoot you in the foot" right there. Not a leg to stand on.
A person could create that kind of damage, by using something like
TestDisk (which has an option to rewrite the MBR).

(Run as Administrator in Windows 7...)
ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip


(Partition type reference. To decode values seen in PTEDIT32)
http://www.win.tue.nl/~aeb/partitions/partition_types-1.html

Once a disk MBR is marked dynamic, then that "1MB thing" near the
end of the disk, has to be intact.

It's possible the dynamic database, uses info like hardware serial numbers,
or something equally reliable, to allow re-importing something that
got damaged. There's bound to be a way to fix this.

I tried to find tools from this list, on my WinXP Pro, but
there's really nothing (except diskpart perhaps). And I'm not even
sure anything in diskpart is appropriate. There is a "repair"
command, but it's for something else.

http://technet.microsoft.com/en-us/library/cc737610

Okay, PTEdit worked!!! The partition table on this disk was showing Type
0 "empty", so I used Ptedit to turn them into Type 42 (Dynamic Disk). I
also had to fill in the remaining fields in that partition table by
hand: Starting Cylinder/Head/Sector = all zeros; Ending Cyl/Head/Sector
= 1023/254/63; Sectors Before = zero; Sectors End = Total Sectors -
2111. I found these other parameters out by comparing them to the other
disks in the dynamic volume. After doing all of that, I just rebooted,
and the volume came roaring back to life all on its own after the
reboot. Ran a chkdsk, it found no problems with the structure of the
filesystem. Checked several of the files on the disk, they all seemed to
have proper integrity. So it was just the partition table that was hosed
and nothing else!

Yousuf Khan

 

[Ken Blake]

One system consists of 15 physical drives grouped as a single 28TB logical
volume, and the second system has 9 physical drives grouped as a single 13TB
volume.

Wow! You have *big* systems. Are these home systems or are they used
in a business somewhere?

 

[Yousuf Khan]

I realize you're well beyond the shopping phase, but I would have
recommended DriveBender<http://www.drivebender.com/> as an alternative to
MS drive spanning. I'm currently running it on a couple of systems and
haven't had any problems yet.

One system consists of 15 physical drives grouped as a single 28TB logical
volume, and the second system has 9 physical drives grouped as a single 13TB
volume. If a drive is removed from the pool, all data on all drives remains
readable.

Are these all simple spans, or does this software also do software
RAID-5 or other RAID's?

Yousuf Khan

 

[Paul]

Okay, PTEdit worked!!! The partition table on this disk was showing Type
0 "empty", so I used Ptedit to turn them into Type 42 (Dynamic Disk). I
also had to fill in the remaining fields in that partition table by
hand: Starting Cylinder/Head/Sector = all zeros; Ending Cyl/Head/Sector
= 1023/254/63; Sectors Before = zero; Sectors End = Total Sectors -
2111. I found these other parameters out by comparing them to the other
disks in the dynamic volume. After doing all of that, I just rebooted,
and the volume came roaring back to life all on its own after the
reboot. Ran a chkdsk, it found no problems with the structure of the
filesystem. Checked several of the files on the disk, they all seemed to
have proper integrity. So it was just the partition table that was hosed
and nothing else!

Yousuf Khan

Good catch!

Now, what erased the MBR ???

Paul

 

[Franc Zabkar]

Good catch!
Ditto.

Now, what erased the MBR ???

I suspect that the user accepted Windows' invitation to initialise the
drive. Many users do this without realising that "initialisation" is
data destructive, probably because the term sounds innocuous.

- Franc Zabkar

 

[Char Jackson]

Wow! You have *big* systems. Are these home systems or are they used
in a business somewhere?

Home systems.

Both systems are just about out of capacity so I'm watching HDD prices with
the idea that the 15-drive system (16 drives if you include the OS) can be
expanded to 24 drives and the 9-drive system (10 with the OS) can be
expanded to 13 drives. By then, both systems will be physically out of room
and it's either time for an additional server or piecemeal replacement of
2TB drives with bigger units.

 

[Char Jackson]

Are these all simple spans, or does this software also do software
RAID-5 or other RAID's?

Drivebender is simple spanning, (they call it pooling, as in older versions
of Windows Home Server). You can designate any number of folders for
duplication and Drivebender will ensure that the two copies are always on
different physical disks, but if you need more than that you have to add it
yourself. SnapRAID or FlexRAID make nice additions, for example.

 

[Yousuf Khan]

I suspect that the user accepted Windows' invitation to initialise the
drive. Many users do this without realising that "initialisation" is
data destructive, probably because the term sounds innocuous.

That's a possibility, but he didn't mention doing that, but I'll ask him
directly. He did mention trying the "Reactivate" command in Disk
Management, which of course didn't work. Could Reactivate call an
Initialize? Judging by how quickly & automatically things came right
back after the reboot when the partition table was intact, I would've
expected no need to even touch any of these commands, so either they got
run before the reboot (in a desperate attempt to get things back) and
ended up causing the problem after a reboot, or something truly external
erased the partition table perhaps during the communications problem to
that disk.

Yousuf Khan

 

[Ken Blake]

Home systems.

Both systems are just about out of capacity so I'm watching HDD prices with
the idea that the 15-drive system (16 drives if you include the OS) can be
expanded to 24 drives and the 9-drive system (10 with the OS) can be
expanded to 13 drives. By then, both systems will be physically out of room
and it's either time for an additional server or piecemeal replacement of
2TB drives with bigger units.

Wow, again! You must have lots of very big files--video files perhaps.

If you add up everything on all three of my drives here, it comes to
something around half a terabyte. Add in the drives in the other three
systems in my home--my wife's machine, my laptop, and my Windows Home
Server--and the total is around 1.5 TB.

 

[Franc Zabkar]

He did mention trying the "Reactivate" command in Disk
Management, which of course didn't work. Could Reactivate call an
Initialize?

I don't know, but I would think not. Microsoft's technical articles
aren't really helpful in this regard, though. I like to see what
happens at the bits-and-bytes level, but Microsoft rarely goes that
deep.

- Franc Zabkar