Our Intern vs. a Smashed Panasonic HDC TM55P: A Data Recovery Case Study
July 12, 2012
Gillware Logo
Customer Experience: 100 Percent Would Recommend Gillware
September 21, 2012

Today is RAID-pocalypse at the Gillware Data Recovery Lab

How to Recover RAID 5 Data

The year 2012 looks like it marks a RAID-pocalypse.

There are bins of dead hard drives everywhere in Gillware data recovery lab. A bin of 24. A bin of 18, 16, 11 — all carefully numbered and ordered, but quiet, still and heavy.

What were once active, humming multiple-hard drive arrays built to offer redundancy and protection against data loss are now ordered piles as the images taken from them are involved in the urgent work of data recovery.

It is commonplace for us to have many active RAID data recovery cases, but today the ranks have swelled to epic proportions.

We have over 40 active RAID cases, and 10 of them are priority service — our fastest upgrade available.

Our RAID engineers will be working nonstop around the clock until these cases are solved.

When we are through with our work, we present our results. And, just like all other data recovery cases, we do not charge anything for RAID data recovery unless our clients decide we were successful and want the data we were able to get back.

This is a recipe for intense, concentrated work. Our industrial strength coffee machine better fare better than the multiple-hard drive systems crowding our lab.

Here’s a look at a few of the cases:

  • A 24 x 1TB hard drive RAID-6 with one hot spare with one large 21 TB NTFS volume. None of the drives was accessible. All the RAID info was wiped out. The RAID card was wiped, and the RAID configurations stored independently on each of the drives are gone. The job will require repairing multiple drives and choosing the best 21 of 24 drives to rebuild from.
  • An 18-drive RAID-5 using 73 GB and 146 GB SCSI hard drives. The system has at least 2 failed drives and a less common interface and file system.
  • A 2 drive RAID-0 with 147 GB SCSI hard drives. One of the drives failed, and to make matters more complicated, an operating system was re-installed on the healthy drive, destroying the partition table and other pieces of important meta data.
  • A Drobo, which isn’t a RAID per se, but a proprietary device that employs multiple hard drives.

For each case, we will quickly create an image of each drive. That means we make a read-only copy of what’s on the hard drive and work with that replica. No data is ever altered on the original equipment, which is supplied power for as little time as possible.

As the drives are being imaged, we are simultaneously noticing and recording clues that tell us, among other things, how recent the data from each drive is. These insights help when we have to analyze patterns and decide how the data was distributed among the multiple drives. We have built custom software that allows us to emulate the RAID controller, and allows us to move forward and test our theories without having to rebuild an array or ever use the original equipment. This means much greater speed in completing the recovery, and a guarantee that the source equipment is safe.

We have tips for how to avoid RAID data recovery, as well as a more in-depth look at how RAIDs handle data. We also have stories about other RAID failures and data recoveries.

Don’t just trust that that big tray or black box with all your important data on it is going to last forever: the RAID-pocalypse may be upon us.

 

Leave a Reply

Your email address will not be published. Required fields are marked *