Hard Drive RecoveryData recovery & digital forensics

Emergency

NAS showing a degraded array

If your NAS my NAS is showing a degraded array, the most useful thing on this page is above this paragraph, and it is free. What follows is what the fault usually turns out to be, how recoverable this class of failure is, and what it would cost, including the cases we would tell you to take elsewhere.

What this usually turns out to be

An array is a set of member disks plus the arrangement that binds them. Losing the arrangement loses the data even when every disk is healthy.

  • Single member disk failurebetter news

    The array is doing exactly what it was designed to do. Your data is intact and readable, and the danger is entirely in what happens next.

  • Second disk failing during a rebuild

    The classic way arrays are lost. The rebuild's sustained full-surface read is what surfaces the weakness in the next disk.

  • Controller or NAS unit failurebetter news

    The disks are all healthy but the thing that knew how they fit together has died. Recoverable by reassembling the array from the members directly.

  • Members reinserted in the wrong order

    The array cannot be assembled without knowing the original order and parameters. Recoverable, but only if nothing has been written since.

  • Accidental reinitialise or new array created

    The configuration has been overwritten. Much harder, and the outcome depends on how much was written afterwards.

Try this before you pay anyone

Nothing to install, but three things to record before anyone touches it

  1. Power the unit down rather than leaving a degraded array running under load.
  2. Label the disks with their current bay positions before removing any of them, and photograph the bays. Order is one of the parameters the array cannot be rebuilt without.
  3. Photograph or write down the array's reported configuration: RAID level, member count, which bay is flagged failed, and any stripe size shown in the interface.

Do not accept the unit's offer to rebuild, repair, or initialise, and do not replace the failed disk yet. Each of those writes to the array. The recording above costs ten minutes and is frequently the difference between a straightforward reassembly and an expensive one, and none of it involves running any software.

How recoverable this is

Often very good, because a degraded array is by definition one that still holds your data. Arrays are reassembled from the member disks directly rather than by trusting the controller that failed, so a dead NAS unit with healthy disks is routine work. What changes the picture is what happened after the degrade: a completed rebuild in the wrong order, or a reinitialise, writes over the real contents and that is a different job entirely.

What moves it, for your device specifically:

  • Whether a rebuild or reinitialise has already been attempted
  • How many members have actually failed, as opposed to being flagged
  • Whether the original disk order and array parameters are known or recoverable
  • Whether the filesystem on top of the array is intact

We will not give you a percentage for your device, and you should be wary of anyone who does. Nobody can know what is recoverable until the media has been imaged and read. What is above describes this class of failure; your drive gets its own answer after an assessment, in writing, at no cost.

What it costs

from $690

RAID, NAS and servers

Arrays rebuilt from the member disks rather than trusting the controller that failed. Any filesystem, including ext4, Btrfs, ZFS and VMFS.

What moves a job within its band: capacity, how much of the media is unstable, whether the filesystem is encrypted, and how much of the drive has to be read before the files you need are reachable. You get one fixed figure after the assessment and it does not move afterwards. If we can’t recover what matters to you, there is no recovery fee.

Not quite your situation?

Pick the device and what it is doing, and this gives you the same answer for that combination instead.

1What kind of device is it?