As a professional data recovery specialist, we come across many types of data storage devices that require data recovery services, and a common set up used by many commercial businesses and an increasing number of domestic users is a RAID array. RAID stands for Redundant Array of Inexpensive Disks and this is a brilliant way to build in some redundancy to your on-line storage solutions as well as back-up devices, but what happens when one or even two drives fail and suddenly this array appears Degraded or even offline?

Well, in some scenarios if this array has been set up correctly, you should be able to simply swap out the faulty disk with another healthy disk and in many cases, automatically repair the RAID array. However, if one or more of your hard drives fail above the RAID tolerance or redundancy threshold, then simply swapping out disks is no longer an option and you’re going to require the services of a data recovery specialist to repair these defective drives and recover and reconstruct the data held within in the array.

We recently worked with a National Business where their server had not been backing up properly for some considerable time and two of the hard drives had failed in their 6 disk RAID5 array. One of the failed drives was indeed a mechanical failure but the other was a relatively simple to fix Firmware issue. As this array was configured with a fault tolerance where 1 drive can be effectively removed from the array without affecting it, then you must ask the question, which one failed first? and more importantly, when? As these 2 defective drives are potentially (and more likely, due to the type of failure of each) to be out of sync with the main array and indeed each other, which drive has the most up to date data on it? This is only a question that can be answered once the drives have been repaired, imaged and their contents compared against images of the other healthy drives from the array. This is usually done using a HEX editor to analyse the array structure and checking for consistency (among other things) within the stored RAW data across all of the drives. This analysis will also allow us to determine the exact storage method used by the host RAID controller (block size, parity, rotation etc.), and once determined correctly, we can then rebuild the RAID array virtually on a separate workstation, reconstruct and extract the clients data.

As in most commercial cases, time was of the essence, as the client was quite literally at a standstill until we could get the information back to them. Luckily for our client, the drive with the Firmware failure was indeed the last to fail in the array so contained the missing RAID data we were looking for.

The bare disks were delivered to us on the Friday by our partner courier after arranging a free collection, the case was diagnosed and quoted that same day and we provided a full file listing on the Monday after working through the weekend. The complete recovery was returned to the client arriving on Tuesday morning and with assistance from their IT Support company they were back up and running later that day.