After a RAID-5 crash, your data is especially vulnerable. How you treat your crashed server before you bring it to a data recovery lab can have a huge effect on a data recovery lab’s chances of success at recovering your data.
This RAID-5 data loss scenario was about as bad as it gets. The prospective client came to us after their five-drive RAID-5 array had crashed. But unfortunately, they didn’t come to us right after the server had crashed. They had taken the three remaining healthy hard drives in the array, arranged them into a new three-drive RAID-5 array, and started loading their backups onto the array. No harm, no foul, no need for data recovery—until they realized their backups were out of date. There was important data on that crashed RAID-5 array that didn’t live anywhere else on their system!
And so, the client had five hard drives. Two had failed. The remaining three had all been filled about two-thirds of the way with next-to-useless data. When you write data to a sector on a hard drive’s platters, the hard drive doesn’t keep a backup of that sector. If you had important data living there, and then wrote new data to that sector, there is no way to get the old sector back. Period. End of story.
And so this would be a situation in which maybe one-third of the data on the three healthy drives would be relevant to the client. Of the two failed hard drives, one would be filled with “stale” data, months out of date compared to its peers (depending on when the first drive failed). In addition, there was no telling what condition these two failed drives were in. There could be any degree of platter damage affecting them, from tiny scratches to severe scoring. To make matters worse, the client’s critical files lived inside a Hyper-V virtual hard disk file.