How to Recover RAID 5 Data – NAS RAID 5 Data Recovery
RAID 5 is a popular RAID level for data storage, seeing use in servers for businesses of all shapes and sizes. While RAID 5 is resilient and features redundant data to protect itself in case of a hard drive failure, it is not immune to failure, and a RAID 5 failure can be devastating. Loss of data, loss of revenue, and loss of customer confidence can set you back days, weeks, or even months. The consequences of RAID 5 data loss can wreak havoc on your business—if you don’t start looking for RAID 5 recovery solutions on the double.
The RAID recovery experts here at Gillware know how to recover data from RAID 5 better than anyone else.
Gillware’s data recovery lab collects some of the most brilliant RAID recovery engineers in the world under one roof.
If your RAID-5 array has crashed and you need help recovering your data, contact us for a free in-lab RAID recovery evaluation.
Gillware Data Recovery has a simple, step-by-step method to recover data from a RAID 5 configuration after a server crash. With our nine-step process, our RAID 5 recovery experts have saved thousands of clients from RAID 5 failure over our past decade-plus of data recovery work. Our data recovery process is 100% financially risk-free, with free inbound shipping and free evaluations. We don’t charge our clients for our work until we successfully meet their RAID 5 data recovery goals.
The vast majority of our clients have had a few days of technical history battling this crash. They have worked with their SAN/NAS or RAID card manufacturer’s support personnel to no avail. They may have had their IT technician run RAID data recovery software and use data recovery tools to no avail: Even the best RAID recovery software cannot fix physically broken hard drives.
Even in situations like these, Gillware still has an over-90% success rate, so don’t lose hope. Your RAID 5 data may still be recoverable.
How to Recover RAID 5 Data: Gillware’s 9 Step Method
Gillware has a nine-step process to recover data from RAID 5 servers and NAS (network area storage devices):
1. Make write-protected (read-only) disk clones of each of the healthy hard disks in the array.
2. Diagnose any broken drives, make the necessary repairs, and create as complete disk images of them as possible.
3. By analyzing the RAID metadata on each drive, determine which drive (if any) is stale and should be excluded.
4. Use the metadata on each of the disks to determine the RAID array’s geometry, drive order, parity, rotation, stripe size, and RAID algorithm.
5. Emulate the physical RAID 5 array and find the logical units on the array.
6. Find the filesystem geometry within these logical units.
7. Extract and test sample files to make sure the array has been correctly reassembled.
8. If necessary, run a raw scan of the RAID 5 array to pick up any files which may have disappeared due to filesystem damage.
9. Extract all available data from the RAID 5 array.
Read on to learn what goes on in each step in further detail:
Step 1: Make write-protected (read-only) disk clones of each of the healthy drives in the array.
Gillware’s first step in RAID 5 data recovery services is to take each of the healthy hard disk drives in the failed array and create write-protected disk images of them. Our disk image is a 100% identical copy of the original drive, down to the last bit. By using write-blocking tools, we ensure that we’ve created the most exact replica possible and can’t alter any of the data (on either the original drive or its clone).
Step 2: Diagnose any broken drives, make the necessary repairs, and create as complete disk images of them as possible.
The failed RAID 5 arrays we receive in our lab tend to have two or more failed hard drives. We need to image the broken hard drives, too. But before we can do that, we must fix them first. We make the necessary repairs in our Madison, Wisconsin-based data recovery lab, which features ISO 5 Class 100 cleanroom workstations and an ample library of replacement hard drive parts.
After repairing the drives, we make disk images of them as well as the healthy drives. Sometimes, if a hard drive’s hard disk platters have become scratched or scored, a 100% complete disk image isn’t possible. This is due to the destruction of physical sectors on the disks, which we cannot reverse.
Step 3: By analyzing the RAID metadata on each drive, determine which drive (if any) is stale and should be excluded.
Every hard drive in a RAID array has metadata placed on it to help determine its role in the array. The metadata, among other things, can tell us the last time data was written to a given drive in the array, helping us determine which failed hard drive is stale. Out of two failed hard disks in a RAID 5 array, we only need one to “fill in” the holes in the array. We avoid using the stale drive to fill in these holes whenever possible. But in some situations, in order to recover RAID 5 data, our engineers have to rebuild the RAID 5 array with the stale drive and salvage the usable data from the array.
How to Safely Handle a Crashed RAID 5 Server
When you need someone to recover RAID 5 data for you, now you know where it needs to go. You need to bring it to a professional data recovery lab like Gillware. But what should you do before you get in touch with us?
When your RAID 5 server crashes, the actions you take before you even start thinking about data recovery can have a huge impact on the safety of your data. Gillware has twelve handy tips for safely handling your crashed RAID 5 storage device:
Step 4: Use the metadata on each hard drive to determine the RAID array’s geometry, disk sequence, parity, rotation, stripe size, and RAID algorithm.
RAID 5 arrays use parity calculations to provide fault tolerance if one hard drive fails. The parity data (or parity checksum) created by the array spreads out in a particular pattern throughout the disks. In order to reconstruct the failed array, we must understand exactly how this parity data has been spread out. Using the metadata on each drive, our RAID recovery engineers can determine how the array has distributed this data across the disks (data striping).
Step 5: Emulate the physical RAID 5 array and find the logical units on the array.
To rebuild the array, our RAID recovery technicians write customized emulation software to string the disk images together. We can then identify how the array’s storage space has been carved up into logical units. Small RAID 5 arrays will often have one logical unit spanning their entire capacity. Larger storage area networks may carve up their storage space into multiple units.
Step 6: Find the filesystem geometry within these logical units.
Many of the RAID 5 arrays we see here at Gillware have suffered physical damage. But we also see RAID arrays that have suffered logical damage as well (and occasionally, both). The filesystem comprises the backbone of your RAID’s logical structure, acting as a roadmap to point you to the locations of your files.
Step 7: Extract and test sample files to make sure the array has been correctly reassembled.
RAID 5 arrays break all of the data written to them into stripes, distributed across the array’s hard drives. If we don’t put the stripes together in the right order, useful data turns into a Picasso painting (only with less value to the artistic world). By testing large files—large enough to have chunks on every drive in the array—our engineers can make we’ve placed the disk images in the proper order. Since this testing method works best with bitmap image files, our engineers call it “the bitmap method”.
Step 8: If necessary, run a raw scan of the RAID 5 array to pick up any files which may have disappeared due to filesystem damage.
Logical damage to a RAID 5 array can cause damage to the filesystem. This can erase the signposts pointing to some files and make them appear to have vanished. Using an advanced RAID recovery tool and data recovery software of our own design, we can scan through the reconstructed RAID 5 array to pick up any files that the directory structure may have made “homeless”.
Tips to Prevent Your Next RAID 5 Crash
When your RAID 5 array crashes, nobody has a good time. In an ideal world, your RAID 5 server would never crash. Nobody would ever need data recovery services. Gillware (and our competitors) wouldn’t exist. But we don’t live in an ideal world. However, just like you, we’d rather live in a world with less RAID 5 server crashes. The better care you take of your server, the less likely you are to end up needing us to help you recover your RAID 5 data:
Step 9: Extract all available data from the RAID 5 array.
Our work to recover RAID 5 data ends with the failed RAID 5 array properly reassembled. Finally, our RAID engineers recover data from the array and place it on a healthy external hard drive or other portable media to return to the client. Our engineers make sure that the client’s most important data is as functional as possible. If necessary, we show our client a list of recovered files to make sure we have successfully met their goals. We also take data security seriously and maintain the confidentiality of data.
Why Choose Gillware for RAID 5 Data Recovery Services?
There are plenty of good reasons to choose Gillware for RAID 5 data recovery. The best reason by far, though, is that we have some of the world’s best RAID 5 recovery experts at our disposal. Our RAID engineering staff all have degrees in computer science and computer engineering, and most have over 10,000 hours of professional data recovery experience logged over the past decade. We’ve seen it all before – all RAID levels and data loss situations imaginable – and you aren’t going to throw anything at us that is beyond our technical abilities. We also offer free evaluations and financially risk-free data recovery attempts. Unless we achieve a positive result at a budget that works for your organization, you won’t pay us anything.
Talk to a RAID 5 Data Recovery Expert Today!
Our client advisors are available by phone during business hours (M – F: 8am – 7pm; Sat: 10am – 3pm).
Send us an email including the type of phone you have and the problem you are experiencing. A client advisor will respond within 25 minutes during business hours (M – F: 8am – 7pm; Sat: 10am – 3pm).
Have a quick question about the data recovery process? Use our chat feature to chat with one of our client advisors (not a robot!) during business hours (M – F: 8am – 7pm; Sat: 10am – 3pm).
How To Rebuild RAID 5 Without Losing Data
Ideally, an IT professional will be notified of the degraded state from monitoring software, like Nagios, or from the RAID controller. The logical state of the union should be good, the unit is degraded but there is full data access and functionality. However, if data is inaccessible or the volume isn’t online, a rebuild will never help. In fact, it will potentially be catastrophic. All a rebuild does is take the logical state of affairs and make it redundant. If the logical state of affairs is bad, that is something we don’t want redundant.
After confirming that everything from the end user’s perspective is great, the IT professional must pull and then replace the failed drive. This positive logical state will then get back to redundancy by a RAID rebuild process. Some RAID controllers will be configured to automatically rebuild when they detect the new healthy drive. Some will require an operator to run proprietary commands on the RAID card, sometimes through a GUI. The RAID controller will read all the information from the current drives, and run an XOR parity calculation, writing the results to the new healthy drive. At the end of this process the array is no longer degraded and you’re back to redundancy–back in position to have another drive go down safely.
Can You Recover RAID 5 Data From One Drive?
With only one drive of a RAID 5, you will not recover any significant amounts of data. This is because most important files are going to be significantly bigger than the stripe size of the array. A four-megabyte picture will be broken up into hundreds of 64-kilobyte pieces, and in a 4 drive RAID 5 array, each drive will contain 25% of those pieces. We need to analyze and copy each drive so we can determine the overall geometry of the array and to determine which drive set is optimal, but we must have all pieces of the puzzle.
If RAID-5 is so great, then why does Gillware see so many of them come into our data recovery lab?
RAID 5 offers, for a small reduction in overall storage, one disk worth of data redundancy. RAID 5 arrays will need at least 3 drives but will commonly consist of up to 8. The main idea is that if one drive fails, the RAID controller will remove it from the group but there is no immediate impact to the data or the business. In this degraded state you can still boot, access data and write new data. It sounds like a well-maintained RAID 5 array should never crash.
But even well-looked-after RAID arrays can need a trip to a data recovery lab – sometimes even RAID recovery software technology can’t cut it. Here’re a few of the reasons why:
1. RAID 5 Is Not a Logical Backup
Even with the redundancy provided by RAID 5, there is no second copy of your data anywhere unless you fastidiously back up the data using a data backup service. If a human makes a mistake and deletes a bunch of data, RAID 5 cannot help you. If a malicious human or process infects the contents of a RAID 5 with a ransomware virus, RAID 5 cannot help you. If you fail to make this distinction between RAID and backup you can get burned by all manner of logical problems and end up calling into a professional RAID data recovery lab.
2. Two Drives Fail in a RAID 5
Multiple drive failure is the most common cause for needing a RAID 5 data recovery. We are commonly called on to recover data from a RAID 5 configuration with 2 failed drives. Sometimes two or more drives will fail simultaneously because of sudden power loss or a power surge. More often one of the drives has failed historically and we regard its data as stale. Depending on how long a drive has been stale it will have limited usefulness in a RAID 5 data recovery effort.
Regardless of how we got here, with only n-2 drives in the volume, the XOR parity cannot be fully calculated and you are left with 50% or less of the RAID 5 volume’s binary.
The volume’s binary content is actually striped across the drives and the stripe size is typically measured in kilobytes. So you don’t have access to 50% of your files, you only have access to 50% of the binary of each file.
Worse, you’ll only have access to 50% of the file definitions. And this is only if you can even get the RAID controller to serve up this partial RAID–which is a terrible idea because file system consistency checkers will run around destroying data that seems to them to be corrupted but is simply incomplete.