RAID Data Recovery - How It Works

RAID data recovery is probably one of the most complex processes any data recovery firm can perform. More often than not, the problems are compounded by the actions of the client prior to sending the drives in for recovery. Many users feel that it is important to try and recover the data themselves or repair the array through various system utilities, and this may be fine if the data is not critical. However, it has been our experience that when you have a RAID failure that has resulted in substantial data loss, more often than not, somebody's job is on the line if that data is not recovered. The biggest piece of advise this article can provide in the event of a RAID failure: LEAVE IT ALONE.

IT professionals have a lot of pressure placed on them when a catastrophic system failure occurs. It is their job to make sure that all systems are up and running. Many times, out of panic, troubleshooting processes are initiated in order to correct the problem. Often times these processes only make a bad situation even worse, and in many instances they can render the data unrecoverable. Let's keep in mind what this data can consist of in an average corporate environment. You are probably dealing with information that cost many hundreds of thousands of dollars in labor and resources to create. Much of the data probably can't be duplicated. The intellectual value alone could be in the many millions of dollars. Corporate executives really don't care to hear about how the failure occurred, or what unbelievable string of events led up to the server crashing. They don't care to hear the technical jargon as you try to explain to them what happened, and hope they understand that it wasn't your fault. They only want to know one thing..."why was this data not backed up, and how can we get it back?"

Instead of taking chances on your own, call a data recovery professional. RAID data recovery can be expensive, but in most cases it is much less costly than trying to recreate the data that has been lost. There is a set procedure that most data recovery professionals follow when it comes to performing any recovery work. These procedures are followed and expanded upon when dealing with a RAID recovery. The first step of any RAID recovery is to make sure all of the drives are functional. In order to properly complete the recovery it is essential that all drives are fully functional (this is especially true with a RAID 0). This may involve taking any physically damaged drives into the clean room, in order to make the necessary repairs so that they function normally again. Once that is completed the next step is to make complete, sector-by-sector clones of every drive. This is not "Ghosting", but a very low-level process that allows the recovery technician to work around bad sectors, and have complete control over how the drive functions. During the cloning process, the original source drive that you sent in, is generally put in a "write protect" mode so that no data can be written to the drive. This insures that the original source data is not altered in any way.

Once the cloning process is complete, the original drives you sent in are set off to the side and are no longer touched. The actual recovery process is performed on the cloned copies, so nothing that is done during recovery can make the situation worse. After the drives are cloned, they will be loaded into an emmulator and destriped. Destriping is like taking the scattered pieces of a puzzle and putting them together neatly. Simply stated, destriping is taking the data scattered among the multiple drives that make up array and placing it onto a single destination drive. From there we have a single drive in which we can complete what we would consider to be a "normal" recovery. We can complete this process even at the multi-terrabyte level. If the damage to the stripe is not too severe, in most cases a complete rebuild of the directory structure and all associated data can be completed.