Blog

Rebuilt RAID data recovery

BounceBack has begun work for a premiere phone recording company. Many people require this critical data for legal purposes. This particular raid had two drives that failed. The two drives were replaced and fsck was run in an attempt to repair it. There was also a partial rebuild attempt. It’s important to note that when you have a raid where a drive has failed its imperative to clone each drive in the RAID before anything else is done. Most RAID systems are comprised of drives that are of the same model and manufactured on the same day. There may be a flaw in this particular run of drives in the manufacture process where many can experience a failure around the same time. It’s also very important to note that after two drives have failed in a RAID 5 system, a rebuild or fsck will never get the data back. It’s not possible, and these procedures will create layers of difficulty for a recovery company. Any partial rebuild process must be reversed before the RAID system is destriped. Needless to say, it can be a daunting and tedious task to find the exact point were the rebuild was stopped, and especially tedious to find out exactly what the process was doing and how to reverse it. These jobs are simply not possible for most data recovery companies. This level of recovery requires extensive knowledge of file systems, manipulating and correcting corruption on the low level of a hex editor, and knowledge of programming for sector-level access in order to create custom scripts and code to reverse complicated mixing-up of raw data. The bottom line here is if you have a RAID with valuable data and two drives have failed, this is not the time to task risks and using a trial-and-error approach. Clone each and every RAID member using a hard drive cloning device before you try anything at all.

0