RAID-0 Data Recovery Case Study: “File is Empty” Error

In this RAID-0 data recovery scenario, the client woke up one morning to find that the RAID-0 array they used to store their WordPerfect files had failed overnight. Like most failed hard drives and RAID arrays, the device had been working just fine the night before. While the client could still power on the drives and could see their files, something had gone wrong. Whenever the client tried to open any of their files, they would be met with an error message: “This file is empty.”

---

---

The client in this RAID-0 data recovery case had two Seagate ST373455SS Cheetah 15K.5 hard drives linked together in their RAID array. Cheetah 15K.5 drives are a brand of enterprise-class hard drives. They have lower capacity than normal hard drives (these were only 73 gigabytes each). But they use the faster SAS (serial attached SCSI) interface instead of SATA, and their platters spin at 15,000 revolutions per minute. This is about double the rotational speed of modern consumer-level hard drive platters. Seagate’s enterprise hard drives also have special firmware that has been optimized for performance in RAID arrays and servers.

Of course, enterprise-class hard drives aren’t immune to failure. There haven’t been any conclusive studies on the failure rates of enterprise-class hard drives compared to consumer-class hard drives, but our data recovery engineers have seen plenty of both in our lab. (We can’t exactly draw any conclusions ourselves about enterprise-class drives just from seeing how many are in our lab, though—enterprise hard drives make up a much smaller market share than consumer hard drives.)

There are many ways the hard drives in a RAID array can be arranged. RAID-0 is one of the simplest. When hard drives are connected in a RAID-0 array, all of the data written to the array is broken up into blocks and striped across the drives. For example, say you have four drives in a RAID-0 array, and you have a 256 kilobyte file you want to write to the array. Say your stripe size is 64 kilobytes. The file will get broken up into four blocks, and each block will be written to a separate drive. Drive 0 will get the kilobytes 1-64, Drive 1 will get 65-128, Drive 2 will get 129-192, and Drive 3 will get 193-256.

Since the multiple drives are working together, having two 1-terabyte drives in a RAID-0 array is actually more efficient than just using one 2-terabyte drive. The multiple drives in a RAID-0 read and write data much faster than a single hard drive with the same capacity. But unlike other RAID levels, there is no fault tolerance whatsoever. No matter how many drives are in the array, you need all of the drives in your RAID-0 array to be perfectly functional in order for the array to work. It only took one hard drive failure for our client to be locked out of their data. RAID stands for “redundant array of independent disks”, but there isn’t really anything redundant about RAID-0. It’s more of an AID than a RAID (or, as some people call it, a JBOD–just a bunch of disks).

RAID-0 Data Recovery

When a RAID-0 array comes into our data recovery lab, it’s important for our engineers to read as close to 100% of each drive as possible. Unlike RAID-1, RAID-5, or RAID-6, there is no fault tolerance. If a chunk of data from even one drive is missing, there’s no other place to get it from. Fortunately, our RAID-0 data recovery engineers were able to make full forensic images of the two enterprise-class hard drives in this client’s array. Each drive was imaged without encountering any unreadable sectors.

One of the hard drives had failed just enough to prevent the client from accessing their files. While the failing hard drive was still showing up, it wasn’t healthy enough to allow the client to open their WordPerfect documents. There were no severe problems with its mechanical components or firmware. But RAID cards and computers have a low tolerance for hard drive performance issues (much lower than our data recovery tools). One of the hard drives was just barely squeaking by that threshold. But its performance was just poor enough that it couldn’t read all of its fragments of the user’s files in the array without encountering a file error. This is why the RAID array thought the client’s files were all empty.

We were able to use our forensic images of the user’s RAID array to perform a RAID-0 data recovery procedure that was just about flawless. All of the client’s critical WordPerfect documents were fully recovered, with no file corruption. Our data recovery engineers rated this case a 10 on our ten-point scale.

RAID-0 offers the biggest performance boost of any other RAID level, but it comes at a cost. The more hard drives you put in your RAID-0 array, the more likely you are to have one fail on you. And one hard drive failure is all it takes to lock you out of your data. No RAID array is failure-proof, but RAID-0 is by far the most vulnerable. While you should always get in the habit of backing up your critical data, this is doubly true if you are using a RAID-0 array to store your data. Don’t let your guard down—your data may be here today, but gone tomorrow.