Increasing The Level Of Difficulty: RAID Recovery
More and more enthusiast users approach Kroll Ontrack with destroyed RAID arrays. Generally, data recovery from such a RAID array is possible, but keep in mind that the effort increases disproportionately. First of all, data has to be copied from a RAID drive onto a server, and the data set has to be put back together. The distribution of data into smaller blocks across one or more drives makes RAID 0 the worst possible type to recover. Increasing performance doesn't necessarily do your data any good here! If a drive is completely defective, only small files, which ended up on only one of the RAID drives (despite the RAID stripe set), can be recovered (at 64 kB stripe size or smaller). RAID 5 offers parity data, which can be used for recovery as well.
Instead of accessing drives on a controller level, the file system level (most likely NTFS) is used, as logical drives will provide the basis for working on a RAID image. This allows the recovery specialist to put together bits and bytes after a successful recovery using special software. Kroll Ontrack can illustrate data structure visually (see above). The recovery of known data formats is an important approach in order to reach towards a complete data recovery. Take a JPEG file for example - will you be able to recognize a picture after recovery? Or will you be able to open Word.exe, which is found on almost every office system? The selected file should be as large as possible, so it was distributed across all drives and you can know for sure that its recovery was successful.
If two drives of a RAID 5 are flawed, but enough data can be saved from the malfunctioning data mediums, Kroll Ontrack is usually able to recover this data. Two dead hard drives in a RAID 5 are more likely to be restored than two single platters, since RAID still provides parity data.
