Hard Drive Platter Damage Recovery Case Study: Western Digital
September 22, 2016
One of the four Seagate Barracuda hard drives pulled from the DiskStation DS411 unit for data recovery
DS411 Synology DiskStation Recovery Case Study: RAID-5 Crash
September 28, 2016

Dell PowerVault Recovery Case Study: Lost RAID Configuration

One of the Constellation SAS drives from this Dell PowerVault recovery case

In this Dell PowerVault recovery case, the client came to us after their Hyper-V host machine had failed. The client’s IT technicians attempted a hard reboot of the server containing their Hyper-V datastores in an attempt to fix the problem. However, when the server came back online, it reported a troubling message. The server could no longer see the RAID configuration, rendering it unable to access the contents of the drives. The client sent the Hyper-V datastore server to Gillware to recover their critical virtual machines.

One of the Savvio 10K.6 SAS drives from this Dell PowerVault recovery case

One of the Savvio 10K.6 SAS drives from this Dell PowerVault recovery case


Dell PowerVault Recovery Case Study: Lost RAID Configuration
RAID Level: RAID-10 (RAID 1+0)
RAID Model: Dell PowerVault MD1220
Drive Model: Dell Savvio 10K.6
Drive Capacity: 600 GB
Operating System: Windows Server 2012
Situation: Hyper-V host machine became unresponsive. After hard rebooting the Hyper-V datastore server, the server could no longer see the RAID configuration
Type of Data Recovered: Hyper-V datastores
Binary Read: 100%
Gillware Data Recovery Case Rating: 10


In this data recovery case, the client’s critical data lived on virtual machines created using Microsoft Hyper-V. Virtual machines behave like physical computers, but exist only as data. A hypervisor such as Hyper-V manages virtual machines and doles out access to their host machine’s physical components (such as the CPU and RAM). With virtual machines, users can remotely access multiple “computers” that all use the same hardware, making virtualization an extraordinarily powerful and useful tool. This client used the several virtual machines on their RAID-10 server to manage their facilities.

RAID-10 Overview

In this Dell PowerVault recovery situation, the client’s Hyper-V datastores were set up in a RAID-10 array. RAID-10 is a nested RAID array: in other words, it is two RAID arrays stacked on top of each other. In a RAID-10, the two RAID sub-arrays are RAID-0 and RAID-1.

RAID-0 takes two or more hard drives and “stripes” them together. These stripes are typically 64 kilobytes, or 128 sectors, in size, as they were in this case. A RAID controller breaks all of the data written to the drives into 64 kilobyte chunks and distributes the chunks among the drives. Because the controller can access stripes from multiple drives simultaneously, RAID-0 offers increased read and write speeds. However, there is no data redundancy. One drive crash will force the entire array offline.

RAID-1 takes two hard drives and “mirrors” them. Both drives are exact duplicates of each other, so that if one fails, the user still has all of their data. RAID-1 is essentially the conceptual opposite of RAID-0, sacrificing performance and capacity for data redundancy, whereas RAID-0 sacrifices data redundancy and failure insurance for performance and capacity.

RAID-10 stacks the two RAID levels on top of each other to create a “best of both worlds” situation. In this setup, the client had the eight Dell Savvio 10K.6 hard drives in their PowerVault server separated into four RAID-1 mirrors. All four mirrored pairs were then striped together, as they would be in a RAID-0 array. Their RAID-10 array gave the client the expanded capacity and increased performance of RAID-0 and the peace of mind of knowing that every block of data written to the array had a duplicate somewhere else on the array.

RAID-10 Dell PowerVault Recovery

RAID users know very well that there’s always the possibility of hard drive failure. This is why the most popular RAID levels, such as RAID-5, RAID-6, RAID-10, and RAID-50, are all fault-tolerant. Each of these RAID arrays can lose at least one hard drive without any of the user’s data going missing. In a RAID-10 array, the array can handle losing as many as one drive from each set of mirrored pairs (but will fail if two drives from the same set of twins fails).

However, there is one often-overlooked point of failure—the RAID controller itself.

In a RAID array, each hard drive has special metadata on it, which tells the RAID controller how to put the drives together properly. The exact format of the metadata varies depending on the brand and model of the controller. Therefore, only the controller used to create the array knows exactly how to put it together. In this data recovery case, the RAID controller failed and inadvertently wiped the RAID server’s configuration data.

As a result, the RAID controller no longer had any idea how the eight hard drives in the RAID-10 server should fit together. As far as it was concerned, it was merely looking at eight separate drives, with no intelligible data on any of them.

To recover the Hyper-V datastores from this failed RAID-10 array, our RAID recovery expert Cody had to reverse-engineer the array’s configuration. A computer wouldn’t know how to put the drives together just from looking at the metadata. But our RAID data recovery experts are smarter. Cody could examine the metadata and write custom RAID controller emulation software to link the drives together.

RAID Recovery Results

Cody’s RAID emulation software did the trick. With the RAID array pieced together, we could access all of the contents of the client’s Hyper-V datastore. We had fully recovered the virtual machines containing the client’s critical data. Our RAID data recovery engineers rated this Dell PowerVault recovery case a 10 on our ten-point scale.

Will Ascenzo
Will Ascenzo
Will is the lead blogger, copywriter, and copy editor for Gillware Data Recovery and Forensics, and a staunch advocate against the abuse of innocent semicolons.
//]]>