Wednesday, 20 January 2016 00:00

RAID 5 Failure and XOR Mathematics in NTFS 5 (Part 4)

Rate this item
(0 votes)

We have had three installments on RAID 5 failure and how the XOR operation gives us insight into discovering the stripe size and drive order for an array. Understanding the next installment is critical to the entire method of reverse engineering a RAID 5 configuration.

We understand that when we use an XOR operation on the same bits we always return FALSE. So, XORing a TRUE and a TRUE give you a FALSE, and XORing a FALSE and a FALSE give you a FALSE. Understanding this, we can hopefully understand the following.

The Master File Table (MFT) Magic number is ‘FILE’. Four ASCII letters represented in HEX format as 46h, 49h, 4Ch, 45h. These HEX values correspond to the letters ‘F’, ‘I’, ‘L’, ‘E’ respectively. Now, when you XOR 46h with 46h you get 00h. This is illustrated in the following diagram.

RAID 5 MFT Recovery

Figure 1

Next, let’s take a look at the actual data and what happens when the entire magic number is XORed. This next figure is of key importance in understanding what is referred to as a parity block. The parity block is the XORing of all the drives in the array and the result is stored in the parity block for that particular stripe; each stripe in a RAID 5 has its own parity block, and as the stripes progress the parity block switches from drive to drive in a very definable pattern. There are basically two RAID 5 stripe types, right to left, and left to right. Within each of these is there are two types, Asymmetrical, and Symmetrical, or Asynchronous, and Synchronous. These two terms and their meanings have nothing to do with how a RAID 5 actual works. The term ‘symmetrical’ means the same on both sides where ‘asymmetrical’ is the opposite. The term ‘synchronous’ and ‘asynchronous’ mean to either wait for something to finish, or execute then continue on with your task irregardless of what is currently going on. The actual functioning of the parity block in its rotation as well as the order of read precedence will be discussed in the next installment. As for now, below is what using the XORing operation on a RAID 5 looks like.

Bear in mind, this is only for odd numbered RAID 5 failure configurations.


RAID 5 Drive OrderFigure 2

In figure 2 we see Drive 0 as all zeroes, Drive 1, and Drive 2, with the HEX representation for the magic MFT number ‘FILE’. From Figure 2 we can see that the parity block is Drive 0, and the two data blocks are Drive 1, and Drive 2.

In the next installment we will discuss the RAID 5 block reading methods using two different ordering types.


Data Recovery Expert

Viktor S., Ph.D. (Electrical/Computer Engineering), was hired by DataRecoup, the international data recovery corporation, in 2012. Promoted to Engineering Senior Manager in 2010 and then to his current position, as C.I.O. of DataRecoup, in 2014. Responsible for the management of critical, high-priority RAID data recovery cases and the application of his expert, comprehensive knowledge in database data retrieval. He is also responsible for planning and implementing SEO/SEM and other internet-based marketing strategies. Currently, Viktor S., Ph.D., is focusing on the further development and expansion of DataRecoup’s major internet marketing campaign for their already successful proprietary software application “Data Recovery for Windows” (an application which he developed).


  • Comment Link Gretchen Friday, 02 March 2018 21:10 posted by Gretchen

    Hello just wanted to give you a quick heads up and let you know a
    few of the pictures aren't loading properly. I'm not sure why but I think its a linking issue.
    I've tried it in two different browsers and both show the same results.

  • Comment Link Darcy Tuesday, 27 February 2018 04:41 posted by Darcy

    The muse of any asphalt driveway is the bottom.

  • Comment Link Elena Sunday, 25 February 2018 21:42 posted by Elena

    Designed to use on uninsulated steel storage doors.

  • Comment Link Shane Thursday, 15 February 2018 02:51 posted by Shane

    However, nowadays, mostly people use limousines.

  • Comment Link Frederic Tuesday, 13 February 2018 16:10 posted by Frederic

    It may possibly additionally maintain cleaning quick.

  • Comment Link Betty Friday, 09 February 2018 21:04 posted by Betty

    I'd like to thank you for the efforts you
    have put in writing this website. I am hoping
    to check out the same high-grade blog posts by you later on as well.
    In fact, your creative writing abilities has inspired me to get my own, personal blog now

  • Comment Link Josette Wednesday, 07 February 2018 16:16 posted by Josette

    We're one of the best in West Palm Beach Stress Washing.

  • Comment Link Buster Wednesday, 07 February 2018 06:52 posted by Buster

    We had our new garage door put in immediately.

  • Comment Link Eric Tuesday, 06 February 2018 21:42 posted by Eric

    This web site certainly has all the info I needed
    concerning this subject and didn't know who to ask.

  • Comment Link Enid Tuesday, 06 February 2018 07:08 posted by Enid

    Do not use this firm for your dwelling inspections.

Leave a comment

Make sure you enter the (*) required information where indicated. HTML code is not allowed.