How to repair dynamic disks that go foreign or will not reactivate

Sometimes when frequently switching dynamic disks among machines, moving parts of the disks of a group amongst machines, or doing something not very simple sometimes the LDM (Logical Disk Manager) will break and some or all of the disks will go foreign or missing. The LDM is the table that contains information about all disks layout – partitions, stripes, etc.

In many cases you will be able to get to your volumes using “Import foreign disks” or “Reactivate disk“. Sadly sometimes the Windows Logical Disk Manager goes berserk and fails with “Disk group has no configuration copies” or some other cryptic error.

Consider you have done everything you thought of, and you don’t have a backup of your LDM created with Tiger Technology‘s Dynamic Disk Optimizer tool (which would have saved you). Then there is the last measure – re-building your dynamic disk configuration manually. The rest of this post will explain how do do it.

I assume you:

• Remember by hard the layout – partition sizes, striping, spanning, etc. If you are not 100% certain do not proceed – you will DESTROY your data.
• The you are at least a developer or sys admin. I will be talking in disk sectors, hex, cylinders and complex abbreviations like NTFS, NTLDR.
• You are familiar with working with a disk Hex editor (like WinHex). If you don’t feel crafty with this – do not read further – ask for help
• Understand this is just information I publish. Should you decide to rebuild your dynamic disks following this advise, and you lose your data as a result, the responsibility is yours.

Lets use a stripe of two disks as an example. It won’t import. It looks like this in disk management:

Step 1: First we have to backup the first 4096 bytes of your NTFS. Use a hex editor (like WinHex) to find the NTFS (it should be on disk 1). Depending on weather the disk is MBR, GPT, and how you partitioned the NTFS(es) might be in different places. Look for the string NTFS with the hex editor, and when you find it – check if it matches this picture:

Then from the start of the NTFS sector, write 4096 bytes to a file somewhere. This is the important info to rebuild the volume. If you don’t successfully backup that, and continue – the data is LOST. Also remember disk number and offset where you took the backups from.

You have to do this step for each volume (not disk). You should end up with as many NTFS backup files as many volumes you had. If you had partitions in the middle of the disk – it might be tricky to find all NTFS headers.
Step 2: Convert the disks to basic

Step 3: Convert back to dynamic

Step 4: Create your volumes again as they were. EXACTLY the same. When Windows ask to format the new volume DO NOT ALLOW.

Step 5: Write back all the NTFS headers you backed up in Step 1 (you remembered disk offsets and numbers as I told you right? If not – search for the NTLDR signature as screen on the WinHex screen shot above – it is on the next sector as you can see from the screen shot, and it will be there).

Step 6: Try to mount/access the volume. You should see your data :)

Well, thanks to the long holidays I finally had time to give the Vista release a spin. For the purpose I used my company laptop – a Lifebook T4210 tablet PC. Since i was tempted to switch to Vista completely and wipe out the old XP, I had to prove that all the tools I need for my job will work. One of the most important was OpenVPN, since this is what we use to access our network.

The straightforward approach (simply installing and running it) did not work, since OpenVPN was failing to adjust my routing table. It uses an API (IPAPI) that does not work, even if I “Run as Administrator” it. Fortunately OpenVPN has an option to set routes by executing route.exe (route-method exe), which does the trick. Also, OpenVPN should be run as Administrator, which ruled out the option of using its own right-click menu “Start OpenVPN on this config file”. What i found works best is:

1. Add to your .ovpn file the following two lines:
   route-method exe
   route-delay 2
2. Create a one-line .BAT file to run openvpn on your .ovpn config file like this
   “C:\Program Files\OpenVPN\bin\openvpn.exe” [PATH_TO_OVPN_FILE]
3. To start the VPN, right click on the bat file and choose “Run as Administrator“

Enjoy.

I have been planning to write on that topic since October, but never got the time since I was pretty busy with the releases of MetaSAN and stoneGate. Now during the holidays I finally have time to post.

The issue that I came upon was (at the beginning) looking quite simple – get the serial number of a locally attached hard disk. My first approach was to simply use IOCTL_STORAGE_QUERY_PROPERTY and hope that Microsoft did all the work for me. Unfortunately this was behaving strange. On half the hard disks in our lab it would succeed and return the correct disk serial, on others it will fail (SerialNumberOffset being zero).

Ok, I think to myself, someone must have had the same problem – lets ask google. Soon I figured that 90% of my searches were ending into a commercially sold DLL named GetDiskSerial. Someone had solved the problem, and was selling the solution. By that time I had enough budget for a $19 toolkit, but could not accept that something I thought should be a simple API/IOCTL call should cost money at all. I downloaded an eval, it worked fine on all the machines I had at my disposal.

I did not give up, and after some more hours I found a utility called diskid32 and downloaded it. It did not work, but I found that the author published the source here. I extracted the part that was doing the IDENTIFY, compiled it and it worked fine for me. I did not figure out why their executable failed.

Anyway, here is a free alternative to the GetDiskSerial DLL – getdiskserial.zip.

The source has two functions with identical interfaces – GetDiskSerial1 and GetDiskSerial2. The first is using the MS IOCTL, the second – the method by Lynn McGuire (diskid32). You can easily make a super-function of the two, to always get the disk serial.

I am not claiming the source is my creation – I just wanted to share my experience and give you the result I came up with – simply combining the two approaches and making the interfaces/results match (the diskid32 returns the serial as text, while the MS IOCTL returns it as a string containing the hexadecimal values of the ASCII code of the disk serial).

I still think that the commercial DLL has some benefits – it has versions for various languages and development platforms and probably works with a wider variety of disks. I have not yet found a disk that neither IOCTL_STORAGE_QUERY_PROPERTY nor diskid32 will work on, but if you find one – drop me a line please.

“Setup requires .net framework version 1.1.4322″ with version 2.0 installed

Lost almost half a day trying to install a MSI package that complained “setup requires .net framework version 1.1.4322″, and I had version 2.0 installed. I found the solution in the blog of Hannes Pavelka, which turned out to be one interesting development blog. You can see the solution of the problem here.

Ever wondered how Visual C++ encodes parameter info in the so-called decorated names?
This knowledge is close to useless, and the only time I needed it was when I tried to generate a DLL that needs to completely mimic another DLL’s exports. I wanted to re-create the original CPP & H file for a DLL that I had only the exports for. So I started looking on the Internet for info how decorated names are created. MSDN has just a little paragraph about decorated names stating:

A decorated name for a C++ function contains the following information:
The function name.
The class that the function is a member of, if it is a member function. This may include the class that encloses the function’s class, and so on.
The namespace the function belongs to (if it is part of a namespace).
The types of the function’s parameters.
The calling convention.
The return type of the function.

I found that info insufficient, so I decided to figure out the format by declaring functions and looking at the decorated name that the compiler generates. The conclusions I have made are for sure not complete, I just only went that far so that I can re-create the declaration of each of the functions in that DLL. But the result IMHO is usable and even if I have missed a type it can be easily added.

Here is what I have figured out about the format:

1. C++ decorated names start with a ‘?’ sign.
2. The name and namespace/class follows in format name@class@@
3. Visibility specifier follows:

A – private
I – protected
Q – public

4. Unknown character follows (always A)
5. Definition of the parameters (see below)
6. The decorated name ends with “@Z”

Ok, so number 5 of the above list is pretty general :). Let’s be a little more specific :).
Types can start with an arbitrary number of the following modifiers:

PA:	*
AA:	&
PB:	const *
QA:	*const
AB:	const &

The type signature follows. Here is the table:

E	this pointer
P6	Function pointer (complete function declaration follows)
D	char
X	void
F	short
J	long
H	int
M	float
N	double
O	long double
E	unsigned char
G	unsigned short
I	unsigned int
K	unsigned long
_J	__int64
_F	__int16
_H	__int32
_D	__int8
?	Type name follow terminated by @@
U	User type. If it starts with a digit – index of user type. If it starts with a letter – new user type. Consider the following example – the function void func(MyType *a, MyType b) has decorated name of ?func@@YAXPAUMyType@@U1@@Z
V	Similar to U. Not sure what it is about. Appears when the user type is the class that the method is member of.

Here is a class that will parse a decorated name, and print its declaration :) Have fun hooking C++ DLLs :)

CPPFunc.c
CPPFunc.h