“Superb job following some disastrous errors, which threathened to destroy some extremely important data. Thanks for the hard work, after our RAID volume vanished following an engineer coming on-site, who was supposed to get our backup system working again after it failed.”
Vijay Sarathkumar, Heathrow
Eight 2TB HGST hard disk drives arrived from Heathrow at our laboratory in Fleet Street, London. An examination of the drives revealed that they were all working correctly. Sector-by-sector image copies of all the drives were secured to our servers, with no unreadable bad sectors encountered during the process. Our RAID data recovery specialisted examined the secured images of the drives, which revealed that they were arranged in a RAID 5 configuration across all eight drives. Once the striping order and lengths were determine a virtual RAID was created.
An examination of the virtual RAID array did not find any partitions defined at the start of the array as we would expect, despite it being clear that at least one NTFS data volume was present. The start of a single 14TB NTFS volume was located, an indication that the volume had been deleted. The NTFS volume was scanned, which revealed a lot of inconsistencies in the data, suggesting that the data on one or more of the drives may be incorrect.
Visually inspecting the data on each drive did not reveal any conclusive prove. Being a RAID 5, it is possible to drop a single drive from the configuration, with the data for it being recreated using the data from the others. Each drive was dropped from the configuration in turn with the volume analysed, eventually revealing which drive was incorrect. An examination of the drive revealed that it had either temporarily stopped working some time prior to the problems, or drive bay unmounted but left in place. Fortunately, it proved unnecessary for the purposes of data recover, but had left data at serious risk. 10.4TB of recoverable data was contained on the RAID array, consisting of many virtual images, databases, photos, scanned image data and many office documents, all of which were returned to the customer.
