Home / Case Studies / NAS & Network Storage
NAS & Network Storage · case file

Twenty-Four Disks, Two Arrays, One Weekend Promise

On paper, this Sheffield enquiry is a negotiation. However, there is a technical decision embedded in it. The enquirer has "a SAN with 24 disks" holding "two RAID 5 arrays". A competing firm has quoted a five-figure sum and promises to "do it all by close of play on Sunday", and the only question put to us is whether we can "improve on their price or timeframe". An entirely truthful answer is that no one can commit to a Sunday deadline until the disks have been imaged, since with RAID 5 the schedule always belongs to the weakest member of the group, not the calendar.

RAID / NASRAID Failure
// case at a glance
Media24-disk enterprise SAN shelf with two arrays of twelve members each, in a RAID 5 configuration; the state of each member was unknown at the enquiry stage.
Reported situationRecovery is needed across both arrays · a competing quote is already in hand, with a fixed weekend deadline · the enquirer is connected to data centre operations with recurring requirements · price and timeframe are both being negotiated
Fault classMulti-member array recovery where the failure details for individual members haven't been stated yet: member condition, not array count, determines the difficulty, duration and cost of the recovery
Equipment usedEach member is imaged individually under hardware write-blockers before any assembly. A DeepSpar Disk Imager is used for degraded members, with per-head control, and PC-3000 UDMA where a member is unstable or firmware-impaired. Controller metadata and parity are analysed on the images in UFS Explorer RAID and R-Studio Technician, with XOR consistency and checksum verification across each stripe set before extraction.
// the decode

The decode

RAID 5 survives one missing member per array, but not two. An array may continue operating with only one failed member; however, a second failure in the same array will take the array down. Regardless of what caused these failures, the recovery question is how many of the twenty-four disks read cleanly. A twelve-member RAID 5 is already at the extreme end of that design, stretching one disk's worth of parity protection across eleven neighbouring disks.

All the disks in an array are the same age, and that is not a comfort. Because all the disks in a RAID system are purchased together, from the same production batch, and have been performing the same task for the same amount of time, they are also typically at similar levels of wear. Therefore, if one disk fails due to wear, it is likely that the other disks are approaching their own failure point. This is precisely why the second disk so often fails during the stress of a rebuild.

A weekend deadline can only honestly be promised after imaging, never before. When all twenty-four disks image cleanly, completing the entire recovery within a weekend is realistic. However, when two members of one array are having difficulty producing readable data, extracting usable sectors from those two failing disks will set the speed of the recovery, and no promise made on Tuesday changes that.

Nothing is ever put back together on the original disks. Each member gets imaged first, and the arrays are rebuilt virtually from those images. Forcing a rebuild on the original hardware writes to every disk at once, which makes it the most common way a recoverable RAID case turns into an unrecoverable one.

Parity layout and member order are read from the disks, not assumed. The controller metadata, stripe size and rotation, as well as member order, are all determined by reading them off the disks. An XOR consistency check is then performed before a single file is extracted, to verify that there are no inconsistencies. Otherwise an incorrectly assembled array could give you corrupted files that look okay.

An honest quote cannot be just one number given before the disks are assessed. A single figure given before the members are assessed will either be priced for the worst-case scenario or gamble on the best case. A solid quote prices the imaging first, then fixes the recovery cost based on the actual condition of both arrays.

// on the bench

On the bench

Each member was catalogued, serial-matched to its slot on the shelf, and imaged individually under hardware write-blockers: healthy members directly, degraded members on DeepSpar Disk Imager with per-head control, and any member that behaved unstably through PC-3000 UDMA. Once every member had been imaged, both arrays were assembled virtually in UFS Explorer RAID, with the layout checked against the controller metadata and cross-checked in R-Studio Technician. They were then verified stripe by stripe using XOR consistency checks before the data was extracted onto new media.

// the outcome

The outcome

Twenty-four members were imaged individually, the two arrays assembled virtually from those images, verified with parity checks, and then extracted. The assessment is free, with one fixed written figure, plus VAT; where a drive has to be opened, 50% of parts and labour is payable upfront, with the balance only if we recover your data. The decode: the deadline belongs to the weakest disk. Image first, and the calendar becomes a promise you can keep rather than a risk you are taking with someone else's arrays.

A failed RAID with a tempting deadline on the table

Don't allow anyone to perform a rebuild on the original disks, and view a fixed completion date quoted before every disk has been individually imaged as a warning sign rather than a selling point. Power the shelf down, keep the members in order, and note which slots reported failure. The number that decides everything is how many disks image cleanly; establish that first, and the price and timeframe follow from the evidence.

Sending this in from Sheffield? We give every customer a free diagnostic and a fixed written quote before starting any work, and in most cases you only pay if we recover your data. Get your quote first by calling free on 0800 689 0668, or use our free online diagnostic tool. If the data is inside a laptop, PC, Mac or server, take out the hard disk or SSD and send us only the drive. Please note that we don't remove internal drives from devices, and we don't recover storage soldered onto a motherboard (for example Apple Silicon Macs). If you're unsure whether yours is soldered, ring us first. Server, RAID and SAN disks should be removed before they're sent, each clearly labelled with the bay it came from. For a NAS, try to remove the disks if possible; failing that, send the whole NAS unit. A single external drive goes whole, in its enclosure, with its cable and power supply. Post it tracked and insured to our Leeds Data Recovery lab, or drop it off at the lab's reception in Leeds, Monday to Friday, 9am to 5:30pm, no appointment needed. Full sending instructions and the shipping form are here.
Start a free diagnostic

Our case files are written up from genuine enquiries our lab has handled for customers across Sheffield and South Yorkshire, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.

// related case files

More cases like this one

Browse all case studies →

Got a device with a story like this?

Free diagnostic, fixed quote, and in most cases you only pay if we recover your data. Start now or call our freephone number.