RAID 5 data recovery

RAID 5

A RAID 5 uses block-level striping with parity data distributed across all member disks. Generally, RAID 5 is implemented with hardware support for parity calculations.

RAID 5, 4 disks, forward rotation

Every time a block is written to a disk in a RAID 5, a parity block is generated within the same stripe. A block is often composed of many consecutive sectors on a disk. A series of blocks (a block from each of the disks in an array) is collectively called a "stripe".

A hardware RAID 5 array presents itself to the end user and the operating system as one large single disk. This disk can be treated as such and can be divided in single or multiple partitions.

Data recovery from an intact array

Damage to logical structures on an intact RAID array (resulting in loss of data) can be treated as logical damage on a single disk. So, if for example a file is deleted from a volume residing on a RAID 5 array, file recovery can be attempted using conventional undelete software. Many software vendors advertise their software to be RAID 5 capable if they can perform data recovery under such conditions, which is basically a scam because they do not have to do anything at all to achieve this so called compatibility. Even the simplest undelete software can recover deleted files as long as an array is intact.

Data recovery from a broken array

Due to the parity information a RAID 5 array can survive one single disk failing, RAID 5 is 'fault tolerant'. The failing disk can be replaced (hot swapped) and the data on the disk is rebuild using the parity information. However, on some occasions due to different circumstances this may fail. It can also happen that the RAID adapter itself fails and very often it is not possible to migrate an existing array to another RAID adapter. As a result you have a bunch of disks, all containing bits of your data but you can not access that data. This is where you will need true RAID capable data recovery software.

You will need software that can treat the separate disks as one single array. The software should enable the user to add disks that were part of the array and to configure RAID parameters such as stripe size. However, most users will not be knowledgeable enough to provide the parameter sets so ideally the software should be able to detect RAID parameters such as stripe size and rotation (for example, in the above illustration you see forward rotation, inverted rotation is also possible).

As soon as the software has virtually recreated the array, data recovery proceeds normally; the disk is scanned for file system structures and a virtual file system is created from which data can be recovered. DIY DataRecovery iRecover follows this procedure. Alternatively, the reconstructed array is copied entirely to another disk or raw image file. The destination disk can then be analyzed with any data recovery software, or the image can be analyzed with any software that is capable of processing a raw image file. The latter is the method used by RAID Reconstructor from Runtime Software (www.runtime.org)

RAID recovery using DIY DataRecovery iRecover

Note 1: Because multiple disks have to be scanned the process can be lengthy.

Note 2: This procedure is only required if the array is damaged. For a functional array select simple volume recovery!

Select 'reconstruct RAID layout, then recover data' in the recovery type selection dialog.

In the next step select the disks which were members of the array. If the array is RAID5 with one disk missing, select all available array members; the missing disk will be virtually reconstructed automatically based on the RAID5 parity data.

The procedure is fully automated. Expect the following progress indications:

Checking RAID5 parity: early in the process, iRecover checks to see if it needs to reconstruct a missing RAID5 member disk. This only appears if RAID5 was marked as the possible layout.

Scanning disks: during this stage all the array member disks are scanned and the fragments of the file system structures and data files are identified. These fragments are then used to reconstruct the layout of the array.

Reading sequence numbers: during this stage objects marked as "worth attention" are read again and processed.

Calculation: this is displayed when number-crunching is progressing to determine the stripe size and reference tables for use during the next stage.

Probing [different layouts]: during this stage, different hypotheses are tried and their relevance measured.

Once RAID re-construction is completed the session will proceed as if it is a 'simple disk' recovery session.