RAID-5 is one of the most common RAID setups for small businesses and a RAID crash can be devastating. Luckily, Gillware is here to assist with your RAID 5 data recovery.
RAID-5 offers, for a small reduction in overall storage, one drive worth of redundancy. RAID-5 arrays will need at least 3 drives but will commonly consist of up to 8. The main idea is that if one drive fails, the RAID controller will remove it from the group but there is no immediate impact to the data or the business. In this degraded state you can still boot, access data and write new data. But, if a second drive fails none of those things will be true.
Ideally, an IT professional will ideally be notified of the degraded state and then replace the failed drive. This positive logical state will then get back to redundancy by a RAID rebuild process. The RAID controller will read all the information from the current drives, and run an XOR parity calculation, writing the results to the new healthy drive. At the end of this process the array is no longer degraded and you’re in position to have another drive go down.
If RAID-5 is so great why does Gillware see so many of them come into our data recovery lab?
RAID-5 Is Not A Logical Backup
There is no second copy of your data anywhere unless you run something like Gillware Online Backup. If a human makes a mistake and deletes a bunch of data, RAID-5 is useless to help you. If a malicious human or process infects the contents of a RAID-5 with a ransomware virus, RAID-5 is useless to help you. If you fail to make this distinction between RAID and backup you can get burned by all manner of logical problems and end up in the lab.
This was a Dell PowerEdge that Gillware performed a RAID 5 data recovery effort on.
Two Drives Failing in a RAID-5
Multiple drive failure is the most common cause for needing a RAID-5 data recovery. Sometimes two or more drives will fail simultaneously because of sudden power loss or a power surge. More often one of the drives has failed historically and we regard its data as stale. Depending on how long a drive has been stale it will have limited usefulness in a RAID 5 data recovery effort.
Regardless of how we got here, with only N-2 drives in the volume, the XOR parity cannot be fully calculated and you are left with 50% or less of the RAID 5 volume’s binary. The volume’s binary content is actually striped across the drives and the stripe size is typically measured in kilobytes. So you don’t have access to 50% of your files, you only have access to 50% of the binary of each file. Worse, you’ll only have access to 50% of the file definitions. And this is only if you can even get the RAID controller to serve up this partial RAID, which is a terrible idea because file system consistency checkers will run around destroying data that looks corrupted but is simply incomplete.
So How Does Gillware Perform RAID-5 Data Recovery?
We always start with a free evaluation of all of the drives in the RAID. If you are in the continental US we’ll even overnight ship them in via UPS on our dime. Even if you are 99% certain a hot spare didn’t engage or a drive has been stale for years, send all the drives! We typically do not want you to send in any miscellaneous computer equipment like motherboards or RAID controllers. We bypass all those restrictions that a RAID controller will roadblock us with and bake this cake from scratch.
Independent Analysis of Individual Drives
Gillware data recovery engineers will access each drive’s health. If a drive is healthy enough, we will make a forensic write-blocked image copy of their contents. We aren’t just making a copy, our Hombre framework is inspected each and every sector of data and when it sees file system meta data or file contents that it recognizes as boot sectors or MFT entries or OLE2 headers, we are adding that information to a large relational database. We never alter the data on your drives.
RAID recovery engineers will assess each drive independently first, and then determine if any of them are stale. Because we have a relational database of all the millions of file entries we can sort those by date to determine the exact moment each drive fell offline.
Determine the Physical RAID-5 Volume Geometry
This chart shows how a RAID-5 controller may lay out the data blocks and the parity blocks in a RAID 5 array. Gillware’s RAID 5 Data Recovery engineers need to determine the overall geometry of a RAID 5 in order to emulate the behavior of the RAID controller.
A big moment in any RAID-5 data recovery case is when we have a candidate physical volume. We use our Hombre relational database of binary sniffs to determine the overall geometry of the RAID-5 volume. We need to figure out if the RAID controller offset the data, what the stripe size was, what the stripping pattern was and what the drive order is.
Sometimes, we get lucky and we can construct a physical RAID55 volume without any individual drive repairs. Other times we have to perform individual temporary repairs to individual drives first, then we make our forensic clones and perform the analysis.
Find the Logical Units and File Systems
Having achieved an emulated physical RAID-5 volume on at least N-1 of the drives we now have to find the Logical Units or LUNs. Many RAID arrays will carve their physical volumes into multiple logical volumes. On a NAS RAID-5 device, you’ll want the Linux operating system on a separate LUN than the user data. You may want to carve one logical unit for your marketing group and another for the engineering department. Sometimes, there’s one big LUN that comprises the entirety of the physical RAID.
After finding the logical units we proceed with a pretty normal data recovery effort. Find all the file system geometry, the file meta data for each file system, assign their inodes and dirents to them in our Hombre platform. Ultimately then we need to test the individual files, paying particular attention to large highly fragmented files because those files will span each and every drive’s data stripes. We then will be sure to test the most recently altered files to ensure we have an optimal physical build without any stale drive in the mix.
Why Pick Gillware For My RAID-5 Data Recovery?
The primary reason is the experts that work here. Our RAID engineering staff have computer science or computer engineering degrees and most of us have over 10,000 hours of data recovery experience. We’ve seen it all before and you aren’t going to throw anything at us that is beyond our technical abilities.
We also offer free evaluations and financially risk free data recovery attempts. Unless we achieve a positive result at a budget that works for your organization, you won’t pay us anything.
Best-in-class engineering and software development staff
Gillware employs a full time staff of electrical engineers, mechanical engineers, computer scientists and software developers to handle the most complex data recovery situations and data solutions
Strategic partnerships with leading technology companies
Gillware is proud to be a recommended provider for Dell, Western Digital and other major hardware and software vendors. These partnerships allow us to gain unique insight into recovering from these devices.
RAID Array / NAS / SAN data recovery
Using advanced engineering techniques, we can recover data from large capacity, enterprise grade storage devices such as RAID arrays, network attached storage (NAS) devices and storage area network (SAN) devices.
Virtual machine data recovery
Thanks to special engineering and programming efforts, Gillware is able to recover data from virtualized environments with a high degree of success.
SOC 2 Type II audited
Gillware has been security audited to ensure data safety, meaning all our facilities, networks, policies and practices have been independently reviewed and determined as completely secure.
Facility and staff
Gillware’s facilities meet the SOC 2 Type II audit requirements for security to prevent entry by unauthorized personnel. All staff are pre-screened, background checked and fully instructed in the security protocol of the company.
We are a GSA contract holder.
We meet the criteria to be approved for use by government agencies
GSA Contract No.: GS-35F-0547W
Our entire data recovery process can be handled to meet HIPAA requirements for encryption, transfer and protection of e-PHI.
No obligation, no up-front fees, free inbound shipping and no-cost evaluations.
Gillware’s data recovery process is 100% financially risk free. We only charge if the data you want is successfully recovered.
Our pricing is 40-50% less than our competition.
By using cutting edge engineering techniques, we are able to control costs and keep data recovery prices low.
Instant online estimates.
By providing us with some basic information about your case, we can give you an idea of how much it will cost before you proceed with the recovery.
We only charge for successful data recovery efforts.
We work with you to define clear data recovery goals for our technicians, and only charge you upon successfully meeting these goals and recovering the data that is most important to you.
Gillware is trusted, reviewed and certified
Gillware has the seal of approval from a number of different independent review organizations, including SOC 2 Type II audit status, so our customers can be sure they’re getting the best data recovery service possible.
Gillware is a proud member of IDEMA and the Apple Consultants Network.