RAID, NAS and SAN
RAID data recovery
What RAID is, how a NAS uses it, the difference between software and hardware RAID, why a RAID still fails, and what to do and not to do when it happens.
Recovery
Hard disk and SSD HDD, SSD, external drives, flash cards RAID, NAS & SAN All levels, all controllers, virtualisation Smartphones and tablets iPhone, Android, iPad, Huawei Tapes LTO, DAT, DLT and older formats
Access after signing in.
EN · RU · ZH · ES
RAID, NAS and SAN
What RAID is, how a NAS uses it, the difference between software and hardware RAID, why a RAID still fails, and what to do and not to do when it happens.
RAID (Redundant Array of Independent Disks) spreads data over several drives, which work together as a single volume. Depending on the level, that gives more speed, more protection against a failed drive, or both.
That protection relies on redundancy: a copy of the data (mirroring) or a calculated check value (parity), from which the contents of a failed drive can be recalculated.
RAID is not a backup. It protects against a drive failing, not against deleted files, ransomware, a failed controller or a mistake during a rebuild.
Each level is a trade-off between speed, capacity and protection.
| Level | How it works | Min. drives | Can lose |
|---|---|---|---|
| RAID 0 | Data split into blocks across all drives (striping). Fast, but without protection. | 2 | none |
| RAID 1 | Every drive holds the same data (mirroring). | 2 | all but one |
| RAID 5 | Striping with parity spread across all drives. | 3 | 1 drive |
| RAID 6 | Striping with double parity. | 4 | 2 drives |
| RAID 10 | Mirrored pairs, striped together. | 4 | 1 per mirror pair |
| JBOD / spanning | Drives chained into one volume, without protection. | 2 | none |
There are also combinations such as RAID 50 and 60, and vendor-specific variants such as SHR on Synology and RAID-Z on ZFS.
In RAID 5 the parity block is the XOR of the data blocks in the same stripe. If one drive fails, its block is the XOR of the remaining blocks and the parity. RAID 6 adds a second, independent check value (usually Reed-Solomon, the Q parity), so two missing blocks can be calculated.
During a rebuild, every block on every remaining drive therefore has to be read without error. A single unrecoverable read error (URE) is enough for a block not to be recalculated.
A NAS is a small server with several drives. Most NAS devices do not use a separate RAID card, but Linux software RAID, often with a volume management layer and a file system on top. A few examples:
For a recovery this means we have to reconstruct not only the RAID itself, but also the layers above it (LVM, Btrfs, ZFS) to reach your files. We do not need the NAS device itself.
If the RAID volume also uses deduplication, for example Windows Server deduplication, ZFS dedup or that of a backup appliance, reconstructing the RAID is not enough: the deduplication layer must also be consistent again before the files become readable (deduplication issues). That is a typical case of multi-layer recovery.
A separate controller (for example from Broadcom/LSI, Adaptec, HPE Smart Array or Dell PERC) with its own processor and cache, often protected by a battery or flash memory (BBU, flash-backed write cache). The configuration is stored in a vendor-specific format.
The operating system manages the RAID: mdadm on Linux, ZFS, Windows Storage Spaces or dynamic disks. The configuration is easier to read, and the drives are not tied to one controller.
RAID configured in the motherboard BIOS, such as Intel RST. It looks like hardware RAID, but the work is done by a driver in the operating system.
For recovery the type matters less than people think: we reconstruct the data directly from the drives, independently of the controller or device they were in.
Linux software RAID (mdadm) keeps a superblock on every drive: with version 1.2, the default, 4 KiB from the start of the drive or partition; with the older versions 0.90 and 1.0 at the end. Hardware controllers use the DDF format (Disk Data Format) or their own format, usually at the end of the drive. Intel RST (IMSM) also places its metadata at the end.
If that metadata was overwritten, for example by re-initialising the RAID, the data itself is usually still there. The parameters then have to be derived from the data.
A RAID protects against one fault, but in practice we mostly see these causes:
The stripe size (or chunk size) is usually between 16 KiB and 1 MiB; mdadm defaults to 512 KiB. For RAID 5 there are several parity layouts, such as left-symmetric, the mdadm default, and left-asymmetric or right-symmetric.
We derive them from recognisable structures: where partition tables, file system structures and file headers land on the individual drives reveals the drive order, the stripe size and the parity layout.
Entropy scanning measures how random the data in each block is. Compressed or encrypted data and parity score high; empty regions, text and file system structures score low. Where those values change at fixed intervals, they reveal the stripe size and the position of the parity, even when there are no recognisable structures.
No. RAID protects against a drive failing. It offers no protection against deleted files, ransomware, a failed controller or a failed rebuild. For that you need a separate backup.
Not necessarily. Often one of the failed drives is still partly readable, or it failed long before the other. After an analysis we know whether the data can be recovered.
No, the drives are enough. We reconstruct the RAID independently of the controller or NAS. Do send all drives, including the failed ones, and note their order.
If all other drives are healthy, it may work. If there is another weak drive, the rebuild can make that one fail too, or write wrong data over good data. When in doubt, shut the system down and request an analysis first.
Yes. We recover software RAID from NAS devices, hardware RAID from server controllers, as well as ZFS, Btrfs and LVM.
That depends on the number of drives, their condition and how the system is built. The analysis is free and without obligation: you hear what is wrong and what it costs before you decide anything.
Shut the system down and request a free analysis, or call us. We tell you what is wrong and what it costs, before anything happens.