Restore RAID1 with an old disk (I've been hacked) - NAS320

garry
garry Posts: 9  Freshman Member
edited December 2018 in Personal Cloud Storage
Hi all,

I've been hacked and all my data have been altered (encrypted). Naturally, both disks are now contains the altered data (RAID 1 setup).

Hopefully, I have an old HD that contains an old but valuable amount of lost data.

How can I restore my NAS with the data of this old HD as base for the data???

The risk is to put 2 disks and have the most recent data (but encrypted) to be copied into the old disk. How can I be sure to do the right thing?

I have a NSA320, firemware version V4.70(AFO.3).

Thanks in advance

#NAS_Dec_2018

«1

Comments

  • Mijzelf
    Mijzelf Posts: 2,598  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    That old disk once was a data disk for that 320? In that case you can pull both disks from the NAS, and put the old disk in. It should have a degraded array then.
  • garry
    garry Posts: 9  Freshman Member
    Yes, the old disk was in the very same NAS.

    Okay. So I start once with the old disk only, and when I have a degraded array, I just need to push one of the 2 others disks ? Right?

    Thanks mate!
  • Mijzelf
    Mijzelf Posts: 2,598  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited December 2018
    Theoretically yes. If the both 'new disks' do not contain any useful information anymore, you can wipe them first. Open the Telnet backdoor, login as root, and execute
    <div>dd if=/dev/zero of=/dev/sda bs=1M count=16</div><div><br></div><div><div>dd if=/dev/zero of=/dev/sdb bs=1M count=16</div><div></div></div>
    This will overwrite the first 16MB of each disk, which includes partition tables. So after that the disks will be treated as 'new'. To prevent the NAS might sync the wrong way.

  • garry
    garry Posts: 9  Freshman Member
    "Theoretically yes" -> unfortunately not :-(.

    I put the old disk only, it was in degraded state. I'm then put the other and started the repair.... but it obviously started wrong. I stopped it when it was still showing 0.0% but the internal volume was deleted.

    When I now start with the old disk only, I've no volume... I think the partition table was deleted.

    Do I still have a chance to get my data back?
  • Mijzelf
    Mijzelf Posts: 2,598  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited December 2018
    Do I still have a chance to get my data back?
    Maybe. Can you open that telnet backdoor and post the output of
    <div>cat /proc/partitions</div><div><br></div><div>cat /proc/mdstat</div><div><br></div><div>mdadm --examine /dev/sd[ab]2</div><div></div>


  • garry
    garry Posts: 9  Freshman Member
    edited December 2018
    ~ $ cat /proc/partitions
    major minor  #blocks  name
       7        0     140288 loop0
      31        0       1024 mtdblock0
      31        1        512 mtdblock1
      31        2        512 mtdblock2
      31        3        512 mtdblock3
      31        4      10240 mtdblock4
      31        5      10240 mtdblock5
      31        6      48896 mtdblock6
      31        7      10240 mtdblock7
      31        8      48896 mtdblock8



    ~ $ cat /proc/mdstat
    Personalities : [linear] [raid0] [raid1]
    unused devices: <none>



    ~ # mdadm --examine /dev/sd[ab]2
    mdadm: cannot open /dev/sda2: No such device or address
    mdadm: cannot open /dev/sdb2: No such device or address
    ~ # mdadm --examine /dev/sd[ab]1
    mdadm: cannot open /dev/sda1: No such device or address
    mdadm: cannot open /dev/sdb1: No such device or address

  • Mijzelf
    Mijzelf Posts: 2,598  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    The disk was in? The kernel has not detected any disk, so if it was in, you have a hardware problem.
  • garry
    garry Posts: 9  Freshman Member
    I'll check and post the result soon
  • garry
    garry Posts: 9  Freshman Member
    edited December 2018
    Hi Mijzelf,

    Sorry for the delay. I was busy on these christmas days...

    So: I tried again with the NAS and same result ! I then tried to plug the HD on an Ubuntu linux and I got better results!

    ubuntu@ubuntu:~$ cat /proc/partitions<br>major minor&nbsp; #blocks&nbsp; name<br><br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; 2078720 loop0<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp; 1860888 loop1<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 89964 loop2<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;&nbsp;&nbsp;&nbsp; 144260 loop3<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2300 loop4<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 13300 loop5<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 14852 loop6<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3788 loop7<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp; 244198584 sda<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp; 102400 sda1<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp; 101469549 sda2<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;&nbsp;&nbsp;&nbsp; 827392 sda3<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4&nbsp; 141796352 sda4<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 16&nbsp;&nbsp;&nbsp; 7800832 sdb<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17&nbsp;&nbsp;&nbsp; 7800772 sdb1<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 43148 loop8<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 32 1953514584 sdc<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 33&nbsp;&nbsp;&nbsp;&nbsp; 514048 sdc1<br>&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 34 1952997952 sdc2<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 54964 loop9<br>&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10&nbsp;&nbsp;&nbsp;&nbsp; 147028 loop10
    .
    </code>ubuntu@ubuntu:~$ cat /proc/mdstat<br>Personalities : <br>md0 : inactive sdc2[2](S)<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1952997888 blocks<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>unused devices: <none></pre>.</div><div><pre class="CodeBlock"><code>ubuntu@ubuntu:~$ sudo mdadm --examine /dev/sd[ab]2<br>/dev/sda2:<br>   MBR Magic : aa55<br>Partition[0] :   1836016416 sectors at   1936269394 (type 4f)<br>Partition[1] :    544437093 sectors at   1917848077 (type 73)<br>Partition[2] :    544175136 sectors at   1818575915 (type 2b)<br>Partition[3] :        54974 sectors at   2844524554 (type 61)<br><br>
  • Mijzelf
    Mijzelf Posts: 2,598  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    I tried again with the NAS and same result ! I then tried to plug the HD on an Ubuntu linux and I got better results!

    Strange. Does this disk needs more power than the encrypted disks do?

    Anyway, this looks better. On this system the disk is sdc, so to read the raid header the command should be

    mdadm --examine /dev/sdc2<br><br>

    Personalities :
    md0 : inactive sdc2[2](S)

    Somehow  the disk is assigned an 'S' for spare. But there are no personalities (which are raid engines), and I don't know what is supposed to happen then.

    Does executing

    <p>su</p><p>modprobe raid1<br></p>
    Change anything significant in /proc/mdstat?

Consumer Product Help Center