RAID LEVELS AND DATA RECOVERY
 

A redundant array of independent disks (RAID) is a set of two or more physical disks (such as hard disk drives) that are treated like a single logical disk by the operating system. When compared to a traditional standalone disk, RAIDs pose a number of challenges when it comes to data recovery. Complicating the issue of data recovery from a RAID further are the numerous RAID levels and classifications. Because of these complexities, most techies will caution the everyday user away from attempting a RAID data recovery. In many cases, this advice is valid. Professional data recovery agencies are the best equipped to salvage data from failed RAIDs, but their services come at a very high price (if you have to ask, you can’t afford it). But if the value of your data falls short of the cost of a professional RAID recovery, you may have more to gain than lose by attempting a do-it-yourself RAID recovery using commercial off-the-shelf software.

Before you begin, it’s best to gain a high level understanding of your chances for a successful RAID data recovery. Without regard to the cause of your lost data (RAID failure due to power outage, improperly expanded RAID, failed RAID migration, failed RAID rebuild), here’s a brief overview of the different scenarios you may face with the most common RAID levels.
RAID 0 DATA RECOVERY
 
RAID 0 is a bit of a misnomer, as a RAID 0 offers zero redundancy. Instead, RAID 0 (also known as a stripe set or striped volume) utilizes two or more disks being read/written in parallel for additional storage and increased performance. When data is written to a RAID 0, the file will be fragmented across each of the disks in the set. For this reason, a failure in any one of the disks will cause a failure of the entire RAID.

Because of the lack of redundancy, recovering data from a failed RAID 0 is often a lost cause. There are a few circumstances where you may have some luck. If the RAID controller has failed, then you can simply replace the RAID controller and continue using the RAID as normal. If a RAID has been reformatted, repartitioned, or a file has been deleted by the operating system, you can run file recovery operations on the disk as if it were a single disk.

If a disk within a RAID 0 has failed, then file recovery becomes challenging. The best approach is to recover each of the drives individually and attempt to build a virtual RAID. This will be similar to recovering a RAID 5 (see below).

RAID 1 DATA RECOVERY
 
RAID 1 offers redundancy but no performance advantages. In a RAID 1, the data is mirrored across all the disks. If one of the disks in a RAID 1 fails, the RAID will remain functional (this is called “critical status”). If there are more than two disks, a RAID 1 volume can remain functional with more than one failed disk, as long as one mirrored disk remains intact.

The typical approach is to simply replace the disk in the RAID that has failed. But removing the wrong disk can lead to catastrophic data failure (this happens more frequently than you might imagine). It’s also possible that the other disks may be nearing failure as well. Independent studies have shown that multiple disks failing within the same RAID within a few hours is several times more likely than is often advertised.

A more conservative approach to a RAID 1 data recovery is to remove the physical disks from the RAID and perform the best practice data recovery procedures on them individually. Begin by creating an image of one of the disks and evaluating the damage. If all of the essential files are present on the first healthy disk, then it may be unnecessary to recover data from the remaining disks. If multiple disks have failed, you may be able to recover all the data you need by combining the results of each data recovery operation. For example, if a set of files is not recoverable on one failed hard drive, it may be on the other failed hard drive (presuming that the bad sectors on each disk do not overlap).

A middle of the road approach is to immediately backup your data from the RAID 1 as soon as the RAID becomes critical. The key here is to cross your fingers and hope that the other disks do not fail during this process.
 
RAID 5 DATA RECOVERY
 
RAID 5 volumes offer redundancy as well as performance advantages. A single disk in a RAID 5 volume can fail and the RAID will remain operational. As with a RAID 1 volume, a failed disk in a RAID 5 can be replaced and the data will be rebuilt, with all the data intact. Also similar to a RAID 1, removal of the wrong disk or failure of another disk during rebuild will lead to catastrophic failure.

The conservative approach to a RAID 5 in a critical state is to image each of the physical disks and rebuild them in a virtual RAID. Do this by shutting down the RAID, removing each disk, and then mounting the disks individually for imaging. Then, build a virtual RAID using the disk images.

The key here is to properly replicate the parameters of the original RAID 5 when you create the virtual RAID. Take careful note of the file system, block size, block order and offset. The correct block order (stripe) must be configured, otherwise the RAID data recovery software won’t recognize the file system. Also, if the block size is incorrect, the files may be recognized, but will appear corrupted when they are launched or previewed.

For more information on determining RAID parameters, see Finding RAID Parameters, a guide intended for use with R-Studio.

This short article is meant as an overview of your options. Even if you feel comfortable with the tasks described above, you should still fully investigate your specific situation before proceeding. If there is any doubt, contact a data recovery professional.
Good luck!
 
 
Back to the main page