Data Recovery Digest

Recovering Data from a Failed RAID 5
The main advantages of a RAID 5 volume are its faster data access and fault tolerance. The latter advantage means that a RAID 5 volume can continue working even if one of the disks in the array fails. The failed disk can be hot swapped out for a new one without any data loss or downtime. The data will then be rebuilt using the parity data saved on the other drives.
While RAID 5 protects against downtime and data loss caused by a single failed hard dive in the array, a RAID 5 remains vulnerable to other causes of data, such as virus attacks, accidental deletion, file system corruption, power outages, and user error. Furthermore, problems with the RAID controller itself—such as improper flashing of the cache—can also cause catastrophic data corruption and data loss. Likewise, having two disks fail in the RAID, or accidentally removing the wrong disk when servicing a RAID in a critical state can cause the entire RAID to fail.
If any of these events occur, you’ll be faced with two options: restore your data from a backup (a RAID volume, after all, is no replacement for a backup device) or attempt to recover your data from a failed RAID.
Recovering data from a RAID volume—particularly one that is corrupted—is significantly more difficult than recovering data from a single, independent disk. This is because RAID volumes do not write files contiguously on a single drive. Instead, the data is striped across two or more of the drives in the volume. If the RAID volume will not mount, due to two missing disks or some other type of failure, then your system will lack that crucial metadata that’s needed to piece this striped data back together.
The typical method for recovering data from a failed RAID is to attempt to virtually rebuild the RAID. This is done by imaging each member disk in the RAID configuration, including the corrupted or failed hard disk drives. Imaging the disks is an important step, since it allows you to attempt a repair or other recovery options on the disks without causing further data loss. Forcing a RAID to rebuild with the wrong settings or the wrong disk order can also be catastrophic. By imaging your drives, you are preserving the state they were in prior to any data recovery attempts.
Once the RAID member disks are imaged, they can be configured into a virtual RAID using advanced data recovery software. Although most consumer-oriented undelete programs do not support RAID data recovery, higher end products come with RAID recovery modules. The key here is to recreate your original RAID settings exactly, including the same disk order, stripe size and offset. If you can’t remember the original RAID configuration, check the manufacturer’s website for the default settings. Fortunately, because we are using read-only disk images, there’s room for some trial and error. If you can see the files, but the contents appear corrupted, then you are getting close—try adjusting the block size and mounting again.
Once the RAID mounts, you can run data recovery operations on it as if it were a normal, single disk volume. Recover the files you need and save them to another location.
If the RAID cannot be rebuilt, it’s possible to recover data from the individual disks. However, you will be limited to files that are smaller than the block size. For example, if you have a RAID 5 configuration with a block size of 128 KB, you should be able to restore files from individual drives that are less than 128 KB by running data recovery on the individual disk. This may allow you to recover some smaller files, such as text files, database entries, spreadsheets and Word documents. But again, it’s always a good idea to image the drive first.