RAID Data Recovery Norwich

The first failure was planned for. Then the rebuild finishes off a tired second disk, which represents both the ultimate disaster of array recovery as well as our most consistent source of arrivals.

Half completed rebuilds poison the parity they were relying on. How far this damage reaches is mapped out using images before we touch any structure.

Controllers take their configuration with them to the grave; instead the geometry must be derived again directly from the member drives, without the use of any replacement card or vendor utility.

Months old data forced back into an active set tears the file system apart at the seam where the two do not agree. Unpicked instead at image level, so that the disagreement may be examined rather than compounded.

A new config built on top of a live config. A surprising amount of what lay underneath can be recovered if the initialisation is stopped before it's too late.

Multiple members are downed by a single power event. Each disk is repaired individually and gets its own image prior to performing any group maths.

When the issue is with the chassis wiring rather than the disks, whole banks will appear to have died together. Here, diagnosis precedes alarm (and diagnosis is usually less expensive).

The array maths looks perfect but the NTFS or ext4 sitting on top of it is in shreds. That is what parser level rebuilding brings back home.

Removed in error and recoverable quickly while the blocks it described have not been written over. Time is the only true enemy in such a situation.

With the write hole left open and the two of them out of sync due to a flat cache battery and loss of power, it is reconciled using images (in which being wrong does not cost anything).

H710s and P420s expire still holding the definition nobody ever wrote down. We lift the layout off the member drives and skip the replacement card theatre.

The member which has bad heads goes to the head-swap bench first, and then returns to the imaging queue with the rest of the members. Nothing progresses without it, because a set is only as complete as its worst member.

Sets of matched drives purchased together for a small business will generally wear at about the same rate. Imaging these drives in parallel before the second drive fails is the entire game.

With very little prompting, both mdadm superblocks and Storage Spaces metadata disappear. The raw members are used to rebuild this lost information on a slow and methodical basis.

Instead of failing suddenly, a member that remaps sectors each day is failing gradually, and gradual failure has an ending like every other type. If you image the member early enough, the whole set lives; however if you wait too long, some of it will be gone.

A RAID 10 with both sides of a single mirror lost defeats the design on paper. Lab imaging will often lift one of those sides far enough to close the stripe. That's where the paper and reality part company.

An auto rebuild lands on a hot spare that has sat idle for years and has also quietly degraded the entire time. Nothing that hasn't been imaged is trusted here, and this includes the hot spare.

One hopeful click against stale metadata will scramble the entire set. The true layout is pulled back from the member drives, and these drives have been keeping accurate records the whole way through.

Drives that do not limit their error recovery are kicked out under load for taking too long over a bad sector. They are imaged on hardware capable of waiting, then the set is reassembled.

Hypervisor builds lose their pool metadata when there is a power cut. The transaction history is then walked backward from full member images until a point is reached at which there is consistency.

A scheduled consistency check is exactly the sustained load a marginal drive can't carry; therefore, it fails right on time, part way through the scan. Image it before the next one is due rather than after.

During degraded running, medium errors that were picked up are written into parity as permanent "scars". The locations of these punctures are mapped from images and then routed around.

Membership is denied to the incorrect sector format and attempting to force this results in a substantial increase in the damage. Sector sizes are flexible at the image level, but they are always rigid on live hardware.

Firmware in the HBA or expander which did not fully apply discards drives in clusters over the following days. The hardware fault is identified first, since the data was never the cause.

Two modules striped for the benchmark figures, no parity at all, and one module failed. Each module is recovered as an NVMe case in its own right and the stripe is assembled from the images.

Alert emails were sent to an email account that nobody was checking after someone had left. The array has been running on borrowed redundancy for half a year, and when the second drive fails, everyone will know about it. All of the drives are imaged (including the drive that the controller claims is fine).

Although the capacity may be the same on paper, there can be differences of several thousand sectors between models and generations. The controller refuses the replacement, somebody clears the configuration so that the new disk is accepted, and you now have two problems. However, when imaging the disks, the differences in size no longer matter.

Drives are pulled from an old server and reused, and they still carry array signatures from that older server. A controller reading both sets will make decisions based on what it sees and not on what anybody wanted. Therefore, the true layout needs to come directly from the data itself, not from whichever set of metadata screamed the loudest.

One thing that applies to both JBOD and spanned sets is that there is no redundancy. They just keep writing across the drives in sequence. If you lose one drive then your file system will be missing a chunk in the middle. The files that were entirely located on the remaining good drives come back whole, and that is usually more of them than people expect.

One side of a RAID 1 quietly dropped out and the pair carried on unmirrored. Once the live disk eventually failed, the old side was put back in service. It had an older copy of everything on it since it hadn't been updated in a year. Both drives are imaged; the newest data is retrieved from the failed drive instead of being declared "lost".