How to Recover RAID 5 Data – NAS RAID 5 Data Recovery

Step 1: Make write-protected (read-only) disk clones of each of the healthy drives in the array.

Gillware’s first step in RAID 5 data recovery services is to take each of the all the disk drives in the failed array and create write-protected disk images of them. Our disk image is a 100% identical copy of the original drive, down to the last bit. By using write-blocking tools, we ensure that we’ve created the most exact replica possible and can’t alter any of the data contained on the independent disks (on either the original drive or its clone).

Because RAID 5’s of data redundancy, it has single-drive fault tolerance in the event of drive failure. Therefore, a RAID 5 array won’t crash, even if one of the independent disks fails. However, if there is a second failed drive at the same time, the RAID array becomes inaccessible, resulting in data loss.

Step 2: Diagnose any broken drives, make the necessary repairs, and create as complete disk images of them as possible.

The failed RAID 5 arrays we receive in our lab tend to have two or more failed hard drives. We need to image the broken hard drives, too. But before we can do that, we must fix them first. We make the necessary repairs in our Madison, Wisconsin-based data recovery lab, which features ISO 5 Class 100 cleanroom workstations and an ample library of replacement hard drive parts.

After repairing the drives, a data recovery specialist will make disk images of them as well as the healthy drives. Sometimes, if a hard drive’s hard disk platters have become scratched or scored, a 100% complete disk image isn’t possible. This is due to the destruction of physical sectors on the disks, which we cannot reverse.

Step 3: By analyzing the RAID metadata on each drive, determine which drive (if any) is stale and should be excluded.

Every hard drive in a RAID array has metadata placed on it to help determine its role in the array. The metadata, among other things, can tell us the last time data was written to a given drive in the array, helping us determine which failed hard drive is stale. Out of two failed hard disks in a RAID 5 array, we only need one to “fill in” the holes in the array. We avoid using the stale drive to fill in these holes whenever possible. But in some situations, in order to recover RAID 5 data, our engineers have to rebuild the RAID 5 array with the stale drive and salvage the usable data from the array.

RAID 5 uses special parity functions to reconstruct lost data if one drive fails, but cannot handle two drive failures. After one hard disk drive fails in a redundant array, the rest of the array functions normally. But as time passes, the data trapped on the failed drive becomes increasingly out-of-date. Sometimes, two or more hard drives fail almost instantaneously. But in most RAID 5 recovery cases, one disk fails independently.

Step 4: Use the metadata on each hard drive to determine the RAID array’s geometry, disk sequence, parity data, rotation, stripe size, and RAID algorithm.

RAID 5 arrays use parity calculations to provide fault tolerance if one hard drive fails. Under these RAID parameters, the parity data (or parity checksum) created by the array spreads out in a particular disk striping pattern throughout the disk drives. In order to reconstruct the failed array, we must understand exactly how this parity data has been spread out. Using the metadata on each drive, our RAID recovery engineers can determine how the RAID controller has distributed this data across the disk drives (data striping).

Step 5: Emulate the physical RAID 5 array and find the logical units on the array.

To rebuild the array, our RAID recovery technicians write customized emulation software to string the disk images together. We can then identify how the array’s storage space has been carved up into logical units. Small RAID 5 arrays will often have one logical unit spanning their entire capacity. Larger storage area networks may carve up their data storage space into multiple units.

Step 6: Find the filesystem geometry within these logical units.

Many of the RAID 5 arrays we see here at Gillware have suffered physical damage. But we also see RAID arrays that have suffered logical damage as well (and occasionally, both). The filesystem comprises the backbone of your RAID’s logical structure, acting as a roadmap to point you to the locations of your files.

Step 7: Extract and test sample files to make sure the array has been correctly reassembled.

RAID 5 arrays break all of the data written to them into stripes, distributed across the array’s hard drives. If we don’t put the stripes together in the right order, useful data turns into a Picasso painting (only with less value to the artistic world). By testing large files—large enough to have chunks on every drive in the array—our engineers can make we’ve placed the disk images in the proper order. Since this testing method works best with bitmap image files, our engineers call it “the bitmap method.”

Step 8: If necessary, run a raw scan of the RAID 5 array to pick up any files which may have disappeared due to filesystem damage.

Logical damage to a RAID 5 array can cause damage to the filesystem. This can erase the signposts pointing to some files and make them appear to have vanished. Using an advanced RAID recovery tool and data recovery software of our own design, we can scan through the reconstructed RAID 5 array to pick up any files that the directory structure may have made “homeless” to restore data and recover files from the corrupted RAID.

Step 9: Extract all available data from the RAID 5 array.

Our work to recover data ends with the failed RAID 5 array properly reassembled. Finally, our RAID engineers recover data from the array and place it on a healthy external hard drive or other portable media to return to the client. Our engineers make sure that the client’s most important data is as functional as possible. If necessary, we show our clients a list of recovered files to make sure we have successfully met their goals. We also take data security seriously and maintain the confidentiality of data when performing secure data recovery.