Find Linux MD Raid Metadata on a Disk

I used this to find the partition boundaries on a disk with a corrupted partition table. Based on the offset you should be able to calculate the partition boundaries.

The location of the metadata varies depending on the metadata version. Take a look at --metadata section of mdadm's manpage. A more detailed description of the metadata layout can be found in the official wiki.

Usage

find_raid takes one argument, the path to the device to scan. It outputs the offsets of the metadata, the major metadata version, array name, and creation and update timestamps.

$ find_raid /dev/sda
superblock at byte 46893301760:
 version: 0.90.0
 name: unknown
 creation time: 2020年02月15日T20:58:54+01:00
 update time: 2020年02月15日T20:58:54+01:00
 super offset: byte 41418752 or later (relative offset)
 start: byte 46851883008 or earlier (absolute offset)
superblock at byte 46933217280:
 version: 1.x
 name: "dev:0"
 creation time: 2020年02月15日T20:59:25+01:00
 update time: 2020年02月15日T20:59:26+01:00
 super offset: byte 4096 (relative offset)
 start: byte 46933213184 (absolute offset)

Offsets

As far as I have observed the metadata is positioned as follows:

• v0.90 → metadata starts 65536 bytes before end
• v1.0 → metadata starts 8192 bytes before end
• v1.1 → metadata starts at byte 0
• v1.2 → metadata starts at byte 4196

Caveats

• You'll likely get false positives. The magic number is assumed to be aligned at 512-byte boundaries which helps to reduce the number of false positives but you'll still encounter them.
• In case of version 1.x metadata, the minor version number isn't available. This because the minor version isn't stored in the metadata but rather depends on the location of the metadata.
• Metadata of version 0.x uses native-endian while 1.x metadata uses little-endian. By default big-endian support is only enabled on big-endian platforms. Use the big_endian feature gate to force enable it (cargo build --features big_endian).