How To Handle Introduction
RAID Array
You implemented a RAID array to protect your data. While RAID
Failures arrays may fail less often than single drives, RAID array failure
does occur. Your organization should have many contingency
By Julius “Bud” Younke, CDRP,
plans in place for a variety of circumstances. What is your backup
MCSE, MCP + I, MCP, A+
plan when your RAID array fails?
Problem Statement
RAID1 and RAID5 (as well as others) are designed to provide high
availability of your data. RAID arrays that are truly redundant
(RAID0 is NOT a redundant configuration) are designed to
continue to function in the event that one drive physically fails.
They do not provide protection from logical corruption, file system
corruption or some physical issues such as bad, unreadable
sectors, or weak heads in the drive.
Any problems your RAID encounters which do not cause one of
the drives to completely fail and go offline can result in the RAID
volume itself going offline and not being accessible. While it still
exists on the drives, your data is effectively gone–locked away–
unable to be accessed by normal means.
Reclamere, Inc. • 905 Pennsylvania Avenue • Tyrone, PA 16686 • Phone: (814) 684-5505
How To Handle Issues
RAID Array
Failures (cont.) What RAID Level Is It?
By Julius “Bud” Younke, CDRP, Often a RAID volume that fails is a result of logical corruption in the
MCSE, MCP + I, MCP, A+ file system. Regardless of whether the issue is a file system fault
or an actual physical failure of the drive, more complex RAID types
often require professional recovery. RAID1 volumes are pretty
straightforward since they are simply the same data ‘mirrored’ onto
two drives. Only one of the drives needs to be recovered in order
to recover all your data. Attempting to recover a RAID array
without expert professional help can often result in unrecoverable
data.
How was the volume configured?
Striped raid volumes (RAID0 and RAID5) require a deeper
understanding of how the volume was configured. Drive order,
stripe size, parity direction, and offsets to the data--all items
defined by the particular RAID controller used–need to be
determined and accounted for in the recovery process.
What storage devices are connected to the network?
Storage devices connected to the network (NAS or SAN) can
represent their own issues. Simple consumer-type network
connected drives often contain two disks and boot a modified Linux
kernel as the OS for drive management. Part of the surface of one
of the disks will contain the Linux OS files to boot the storage
Reclamere, Inc. • 905 Pennsylvania Avenue • Tyrone, PA 16686 • Phone: (814) 684-5505
device, while the remaining portions of the disk are configured in a
How To Handle Linux soft RAID. This particular configuration is all but impossible
for consumer-type data recovery tools to recover.
RAID Array
Commercial NAS and SAN devices can also have some unusual
Failures (cont.) configurations. In a standard hard drive, a sector size is 512 bytes.
Some vendors use a sector size of 520 bytes on their SAN/NAS
By Julius “Bud” Younke, CDRP,
RAIDs. This results in recovery software looking for the 512 byte
MCSE, MCP + I, MCP, A+
sectors getting effectively ‘lost’ on the disk surface.
Should I attempt to recover the data myself?
While it is possible in some cases for a RAID volume to be
recovered using DIY means, it is much more complex than a
simple single drive recovery. As with any other type of recovery, it
is possible that simply trying to recover the data yourself can result
in more damage. Since RAID arrays often store mission critical
data or data subject to litigation, the best step when a RAID fails is
to contact a data recovery company with experience in RAID
volumes. Ask them about some of the RAIDs they have worked on
to see if they understand some of the intricacies of network
attached RAID devices. Be sure to ask if they perform ALL of the
work in-house or if they are simply a reseller of data recovery
services performed by others. If the data is subject to litigation or a
litigation hold, it is critical that the proper chain of custody be
maintained at all times.
Reclamere, Inc. • 905 Pennsylvania Avenue • Tyrone, PA 16686 • Phone: (814) 684-5505
Conclusion
The best protection for your data on ANY device is, of course, a
good backup policy with regularly tested backups. If a file is
deleted, or corrupted on the drive, no RAID can bring that file back.
RAIDs only purpose as far as redundancy is to maintain availability
of the data in the event of a disk failure. When it comes to
recovering your data when your RAID goes offline, an experienced
data recovery company is often your only choice.
Bud Younke, CDRP, MCSE, MCP+I,
MCP, A+
Lead Data Recovery Engineer and IT
Manager
Reclamere, Inc. • 905 Pennsylvania Avenue • Tyrone, PA 16686 • Phone: (814) 684-5505