RAID Data Recovery

RAID Data Recovery for Logical Defects

With a logical defect the hardware is intact – what is disturbed is the array's management level or the file system. When data has been partially or completely overwritten or deleted, we can recover it in most cases by reconstructing the array virtually and evaluating the metadata of the file systems (NTFS, ext4, Btrfs, ZFS).

The data loss often goes unnoticed at first: a volume no longer mounts after a restart, shares disappear from the network, or a folder suddenly shows no content. Because the payload data is still physically unchanged on the drives in such cases, one thing above all determines the outcome: that nothing further is written to the array.

Typical logical failure patterns in RAID and NAS systems:

• accidentally deleted or formatted volumes
• virus or ransomware infection with encrypted or overwritten data
• a lost or damaged RAID configuration and metadata
• an incorrectly initialised or newly created array
• a failed firmware or NAS update
• a damaged file system after a power failure or crash
• inconsistent parity after an interrupted write operation

Our overview of logical defects on storage media explains the failure patterns that arise at file system level in more detail.

RAID Data Recovery for Physical Damage to the Disk Array

In the event of hard drive failure due to power surges, overheating, or manufacturing defects, we recover data quickly and reliably. We first restore defective drives in the cleanroom laboratory – for example by replacing read heads or repairing the circuit board – and then read them out as a write-protected copy. Mechanical damage to the platters cannot be undone, but access to the undamaged areas can be restored. This makes recovery possible even when several drives in the array have failed at once.

Because an array usually contains identical drives from the same production run, they age at a similar rate. When one drive fails, the others are frequently affected too: faulty sectors, an unstable preamplifier or an already weakened motor go unnoticed in normal operation until the redundancy makes them visible. We therefore read weakened drives in several passes and with an adapted read strategy, so that the condition of the storage device does not deteriorate further during imaging. Read more about the symptoms of a defective RAID.

Common Causes of Defective RAID Disk Arrays

• drive failure due to power surges or overheating
• a defective controller or a failed power supply
• loss of the RAID configuration
• one or more defective hard drives
• incorrect parity calculation
• partial overwriting
• incorrect initialisation of the RAID array
• loss of reallocation information
• drives returned to the wrong order after maintenance
• an aborted rebuild after replacing a drive

How a RAID Array Distributes Data

A RAID is not one large storage device but a set of rules. The payload data is split into blocks of a fixed size and written across the participating drives in a fixed pattern – depending on the level as pure striping, as mirroring, as a combination of both, or supplemented by parity blocks from which the content of a missing drive can be recalculated. It is precisely this rule set that is lost when the controller or the configuration fails, while the data itself is still present.

For data recovery, the hardware therefore matters less than the correct determination of these parameters. Five values have to be right before an array can be read again:

1. RAID level – determines whether blocks are mirrored, striped or protected by parity.
2. Drive order – the physical arrangement in the enclosure does not necessarily match the logical order within the array.
3. Block size (stripe size) – typical values range from 4 KB to 1 MB; an incorrect value yields nothing but unusable files.
4. Parity rotation – the direction in which the parity block moves from stripe to stripe (left- or right-symmetric, synchronous or asynchronous).
5. Start offset – the position at which the payload data begins behind the controller's metadata.

Because these values combine, several hundred theoretically possible configurations quickly arise. Rather than trying them out, our specialists narrow them down using the metadata on the drives, recognisable file signatures and the structure of the file system – trial and error on the original would be risky and would cost substance with every write attempt.

Data Recovery for All Known RAID Levels

Which method was in use makes no difference to us – historic and rarely used levels for which barely any original hardware remains available can be reconstructed as well. The table shows how much fault tolerance each level provides and what matters during recovery:

In addition there are vendor-specific arrays that deviate from this systematic approach: Synology Hybrid RAID (SHR) combines drives of differing capacity into several stacked RAID groups, while DynamicRAID and comparable implementations create their own metadata structures. Such systems cannot be reconstructed from generic assumptions – knowledge of the respective format is the prerequisite for a usable result.

Software RAID, JBOD and Arrays Built from SSDs

Not every disk array depends on a hardware controller. Servers and NAS systems just as often use software RAID, where the operating system handles the distribution. Under Linux this is usually mdadm and the Logical Volume Manager, frequently combined with Btrfs or ZFS pools; under Windows it is dynamic disks and Storage Spaces. The metadata is then held not in the controller but as a superblock on the drives themselves – an advantage for reconstruction, as long as that area has not been overwritten.

With a JBOD there is no redundancy at all: the drives are merely concatenated into one large volume and filled one after another. If a drive fails, exactly the portion of the data set that resided on it is missing – the remaining files can often be reconstructed in full, provided the concatenation boundaries are determined accurately.

Arrays built from SSDs behave differently again. The controller in each SSD manages the flash memory internally, relocates blocks in the background and releases areas freed by TRIM for erasure. After accidental deletion or formatting the window of opportunity therefore shrinks noticeably, while a firmware or controller fault means the individual SSD has to be made readable again before the array can be assembled at all. You will find more on our pages about SSD data recovery and data recovery from NAS systems.

Data Recovery for RAID Error Messages

• lost volume
• RAID offline
• RAID critical
• Drive missing
• Invalid RAID volume
• In degraded mode Read only
• Multiple Disk Failure
• Disk failed
• failed hard drive "x"
• Problem is detected with Array "x"

Rebuild and Degraded Mode: The Decisive First Hours

When an array reports the failure of a drive it continues to run in degraded mode – without redundancy and therefore without any reserve for a second fault. The obvious step, replacing the defective drive and starting a rebuild, is particularly delicate at this point: during the rebuild the controller reads all remaining drives in full. At today's capacities that takes hours or days and brings to light exactly those weak sectors that are never read in day-to-day operation. The risk of a second failure is thus at its highest precisely when no redundancy is left. If the process aborts, the array is often in a worse state than before.

The following approach improves the starting position:

• Shut the system down and leave it switched off as soon as you notice the data loss
• Photograph the error message from the controller or the NAS interface and note down its wording
• Label the position of the drives in the bays before you remove anything
• Save the configuration data while it is still accessible: RAID level, block size, capacity per drive
• Check any existing backups before work is carried out on the original
• Leave the array unchanged and wait for our diagnosis

Our article RAID is not a backup explains in detail why a RAID safeguards operation but does not replace a backup.

Why Data Recovery Software Reaches Its Limits with a RAID

Standard data recovery software presumes an intact, mounted storage device. That is exactly what a failed array does not provide: without correctly determined parameters the program sees only a sequence of unrelated blocks and at best finds small, unfragmented files. Once fragmentation across several stripes is added, the result is files that can be opened but whose content is damaged – an outcome that looks like success at first glance.

Three points are relevant in practice:

• Recovery software writes. Temporary files, indexes and recovery targets end up on the affected volume if in doubt, overwriting precisely the areas that matter.
• Parameters are guessed, not determined. RAID-capable programs work through combinations. A plausible-looking but incorrect result is hard to spot and sends the subsequent work in the wrong direction.
• Mechanical and electronic defects remain unresolved. No software makes a drive with a defective read head or a damaged circuit board readable again; every further start attempt puts additional strain on it.

As a specialised data recovery service we therefore start one level deeper: we first clone each drive individually and write-protected, and then reconstruct the array exclusively on those copies. Which techniques we use – from a head swap in the cleanroom to the evaluation of file system metadata – depends on the findings of the diagnosis. The original remains unchanged and is available for a second attempt should the first reconstruction not deliver the desired result.

RAID Data Recovery Compared to Classic Hard Drive Data Recovery

Unlike a single hard drive, reading out one storage device is not enough with a RAID. The data is distributed across several drives, and only the correct reconstruction of the array makes it readable again. To achieve this, our specialists determine the RAID level, the drive order, the block size and the parity information exactly. Only then can file systems such as NTFS, ReFS, ext4, XFS, Btrfs, ZFS or VMFS be reassembled together with their metadata.

There is also the matter of effort: an array of eight drives means eight separate diagnoses and eight cloning operations before the actual reconstruction even begins. This combination of many individual drives into one coherent array is the central difference to the recovery of a single hard drive or SSD – and the reason why effort and duration are assessed differently for RAID systems.

RAID Systems, Controllers and Manufacturers We Work With

As a data recovery company with its own cleanroom laboratory we work independently of the manufacturer – neither matching original hardware nor the original controller is required. In practice these systems reach us most often:

• Servers: Dell PowerEdge, HPE ProLiant, Fujitsu PRIMERGY, Lenovo and IBM System x, Supermicro as well as storage systems from NetApp
• Hardware controllers: LSI / Broadcom MegaRAID, Adaptec, Areca, Dell PERC, HPE Smart Array, Intel RST
• NAS devices: Synology, QNAP, Buffalo, Netgear, Western Digital, Thecus and other vendors
• Software RAID: Linux mdadm and LVM, ZFS and Btrfs pools, Windows Storage Spaces and dynamic disks
• Storage media within the array: SATA and SAS hard drives, SATA, SAS and NVMe SSDs as well as mixed configurations

Virtualised environments are a regular use case too: if VMDK or VHDX files reside on the array, we additionally evaluate the file system inside the virtual machine once we have reconstructed the array itself. How that works for VMware, Hyper-V, Proxmox and the remaining platforms is described on our page about data recovery for virtual systems.

What Determines the Prospects of a RAID Data Recovery

A blanket success rate cannot be stated responsibly for RAID systems – the starting situations differ too widely. From more than 20 years of experience with failed arrays in companies, public authorities and IT departments, however, it is possible to name clearly which factors shift the success rate up or down in an individual case:

Diagnosis therefore always comes first: only once the condition and readability of every single drive are known can we say reliably what is achievable. You receive that assessment before placing the order – together with a binding quote and a fixed-price guarantee. Before handover we present you with a list of the recovered files so that you can check completeness before releasing the job. Our page on the data recovery process describes how we proceed overall.

Costs / Prices of RAID Data Recovery

• Standard RAID data recovery: from 449 EUR (for logical errors, depending on the number and condition of the drives)
• Express RAID data recovery: fixed price on request (24/7 processing, individual effort)

These are the lowest possible prices. We quote the individual fixed price on the basis of the preliminary analysis. The following points are decisive for the assessment:

• the number of drives in the array, since every drive is diagnosed and cloned individually
• the type of damage: purely logical cases involve less effort than mechanical or electronic defects
• the extent of the cleanroom work required, for example when replacing read heads
• the complexity of the level – a RAID 1 is opened up faster than a nested RAID 60
• urgency: express processing runs around the clock and is scheduled with priority

You will find an overview of all services and prices in our price overview.

Frequently Asked Questions about RAID Data Recovery

Is RAID data recovery possible without the original controller?

Yes. Since we reconstruct the array in software from write-protected copies of the individual drives, the original controller is not required. What matters instead are the correct array parameters – RAID level, drive order, block size, parity rotation and start offset – which we determine during the analysis. This applies equally to systems in which the controller itself caused the failure.

Do I have to send in the complete server or are the hard drives enough?

In most cases the storage devices are sufficient. What matters is that the set is complete – including apparently defective drives and any hot spare – and that the bay positions are labelled. With NAS devices using a vendor-specific array, or with unusual configurations, the enclosure can be helpful; we clarify that with you briefly before shipping.

How long does a RAID data recovery take?

That depends on the number and condition of the drives and on the complexity of the array. Purely logical cases are often completed within a few days; with physical damage to several drives or nested configurations the reconstruction takes longer, because we have to restore and clone each drive individually. For time-critical systems, express processing is available around the clock.

What should I do if a rebuild has already failed?

Switch the system off and leave it in that state. A second rebuild attempt generally overwrites further areas and worsens the starting position. It helps us to know how far the process got, which drive was replaced and whether the order was changed in the process – we can usually reconstruct the original state from the metadata that remains.

Which RAID configurations are easiest to recover?

A RAID 1 is the most straightforward, since each drive contains a complete copy. RAID 5 and RAID 6 involve more effort because the data is distributed via parity information and the rotation has to be determined exactly. Nested levels such as RAID 10, 50 or 60 add further complexity; a RAID 0 without redundancy is the riskiest, because there every missing drive leaves a gap in the data set.

When is express or emergency data recovery worthwhile?

Whenever a production system is down and every day of downtime causes costs in the company – for example with servers, virtual machines or central NAS storage. Express processing runs around the clock with prioritised reconstruction; we quote the fixed price after the analysis.

How secure and confidential is my data?

We carry out the entire recovery in our own laboratory – on write-protected copies, not on the original. For data security that means: as an ISO 9001 and TÜV certified data recovery service provider we treat all data as strictly confidential and do not pass it on to third parties. Once the case is complete and you have released it, we delete the working copies created in the laboratory.