The abbreviation RAID means Redundant Array of Independent Disks. A RAID array is a collection of several disks interconnected by data links and combined into a single storage device. RAID can provide data storage redundancy, which has a beneficial effect on the reliability of the entire storage subsystem. Currently, there are several types (levels) of RAID, differing in performance, total capacity of the array and reliability of data storage.
How does RAID work?
The following types (levels) of RAID are most commonly used: 0, 1, and 5. RAID-0 is used to increase the speed of the disk subsystem, there is no storage redundancy in this case, so the term RAID applies here only conditionally. RAID-1 is used to duplicate stored data. For RAID-0 and RAID-1 to work, you need at least 2 disks. The RAID-5 level provides high speed performance along with the reliability of the stored data by calculating checksums, while the data are recorded in blocks on several disks in the array. To organize a RAID-5 you need at least 3 disks.
How does a RAID fail?
- In the case of RAID 0, if one of the disks fails, the entire array fails.
- In the case of RAID 1, the array will fail only if both drives fail.
- In the case of RAID 5, only if more than one disk fails, the array becomes inoperative.
What can be done?
Without special equipment and knowledge of how RAID levels function, recovery of information seems impossible. Therefore, ask for help only from qualified specialists and in no case try to recover the data yourself – this can only worsen the situation. They say that there are programs that can return everything as it was / the manufacturer recommends updating the device firmware. Unfortunately, this is not the case: there are no such programs, and technical support advice on updating the firmware of a device can lead to irreparable consequences. So you have to contact some service that will be able to do raid array recovery for you.
Give me the data!
First of all, it should be borne in mind that each case is unique and the removal of images of damaged disks in the array will take place in a different scenario each time. Plus, as a rule, there are difficulties with the numbering of disks in the array and determining the size of the data block. Only after the array has been reconstructed from the images, you can access the recoverable data.
The main reasons for the failure of the RAID array
- Physical crash of a NAS server or NAS
- Failure of more than one hard drive from RAID 5
- Failure of more than 2 hard drives from RAID 6
- Hard Drive Failure in RAID 0
- Dropout during rebuild of one or more hard drives
- RAID controller failure
- Reset / delete RAID array configuration (disk order, block size, level)
- Failure of two or more drives in a RAID 10 system
- Rebuild RAID array with irrelevant data blocks
- File system errors, data deleted / lost / not visible
- Rebuild / Initialize RAID Array
- Destruction of an array file system.
How to recover data from a RAID array
It is necessary to subtract a sector copy of each disk in the array, including the faulty ones. Defective drives before these are reanimated separately. After receiving full copies of all hard drives in the array, the logic and file system are parsed using HEX editors. The file system determines the parameters of the array – raid level, actual and irrelevant data blocks, XOR, data block size, the order of alternation of blocks, metadata, file table and so on. To perform work of this level requires serious knowledge of various file systems and extensive experience in recovering individual hard drives. After determining all the necessary parameters with the help of the HEX editor, the raid controller is emulated and data blocks are assembled in the correct order and sequence with the detection of blocks with errors, damaged, irrelevant. With the correct “gluing together” of the blocks at the output, we get the correct image of the RAID array, from which we later save data if there are no additional tasks on the logical structure.