Hard Drive RecoveryData recovery & digital forensics

Emergency

CCTV recorder showing a degraded array

If your CCTV recorder my NAS is showing a degraded array, the most useful thing on this page is above this paragraph, and it is free. What follows is what the fault usually turns out to be, how recoverable this class of failure is, and what it would cost, including the cases we would tell you to take elsewhere.

What this usually turns out to be

Recorders write in a manufacturer's own format and loop over the oldest footage continuously. The clock on a CCTV job is retention, not hardware.

  • Single member disk failurebetter news

    The array is doing exactly what it was designed to do. Your data is intact and readable, and the danger is entirely in what happens next.

  • Second disk failing during a rebuild

    The classic way arrays are lost. The rebuild's sustained full-surface read is what surfaces the weakness in the next disk.

  • Controller or NAS unit failurebetter news

    The disks are all healthy but the thing that knew how they fit together has died. Recoverable by reassembling the array from the members directly.

  • Members reinserted in the wrong order

    The array cannot be assembled without knowing the original order and parameters. Recoverable, but only if nothing has been written since.

  • Accidental reinitialise or new array created

    The configuration has been overwritten. Much harder, and the outcome depends on how much was written afterwards.

Try this before you pay anyone

Nothing to install, but three things to record before anyone touches it

  1. Power the unit down rather than leaving a degraded array running under load.
  2. Label the disks with their current bay positions before removing any of them, and photograph the bays. Order is one of the parameters the array cannot be rebuilt without.
  3. Photograph or write down the array's reported configuration: RAID level, member count, which bay is flagged failed, and any stripe size shown in the interface.

Do not accept the unit's offer to rebuild, repair, or initialise, and do not replace the failed disk yet. Each of those writes to the array. The recording above costs ten minutes and is frequently the difference between a straightforward reassembly and an expensive one, and none of it involves running any software.

How recoverable this is

Often very good, because a degraded array is by definition one that still holds your data. Arrays are reassembled from the member disks directly rather than by trusting the controller that failed, so a dead NAS unit with healthy disks is routine work. What changes the picture is what happened after the degrade: a completed rebuild in the wrong order, or a reinitialise, writes over the real contents and that is a different job entirely.

What moves it, for your device specifically:

  • Whether a rebuild or reinitialise has already been attempted
  • How many members have actually failed, as opposed to being flagged
  • Whether the original disk order and array parameters are known or recoverable
  • Whether the filesystem on top of the array is intact

We will not give you a percentage for your device, and you should be wary of anyone who does. Nobody can know what is recoverable until the media has been imaged and read. What is above describes this class of failure; your drive gets its own answer after an assessment, in writing, at no cost.

What it costs

Quoted after assessment

CCTV, NVR and DVR footage

Proprietary recorder formats parsed directly from the disk. Priced on recorder type, number of disks and the time window needed.

Nothing is charged until you have seen a fixed quote for your actual device and agreed to it, and the assessment that produces it is free.

Not quite your situation?

Pick the device and what it is doing, and this gives you the same answer for that combination instead.

1What kind of device is it?